{
  "_type": "https://in-toto.io/Statement/v1",
  "predicate": {
    "generated_at": "2026-02-06",
    "generator": {
      "corpus_version": "gold-rules@2026-04-24",
      "model": "n/a-static-corpus",
      "name": "cloudsigma",
      "prompt_version": "p1",
      "seed": 0,
      "version": "cloudsigma@v1.0-stub"
    },
    "input": {
      "enrichment": [],
      "id": "T1562.001",
      "type": "technique"
    },
    "publish_decision": {
      "embed_status": "experimental",
      "integrity_level": "L1"
    },
    "rule_metadata": {
      "corpus_path": "cloud/aws/T1562.001.yml",
      "level": "high",
      "status": "experimental",
      "title": "AWS Security Tool Disabled or Modified via GuardDuty"
    }
  },
  "predicateType": "https://a13e.com/cloudsigma-rule-attestation/v1",
  "subject": [
    {
      "digest": {
        "sha256": "013e8f4ebfd01448f4e1790d05d51e3eb83cb4425ad92bc66752d025c4798e09"
      },
      "name": "/library/attack/T1562.001-impair-defenses-disable-or-modify-tools/sigma-rule"
    }
  ]
}