AG-013-T3: Cryptographic Chain Compromise (T3)

What this rule means

The Merkle-chain of the temporal ledger is invalid, indicating cross-session memory tampering or a sleeper agent attack.

Why it matters

T3 threats involve multi-session poisoning where adversarial state sits dormant until triggered.

How to fix it

Investigate the ledger for adversarial writes. Re-initialize the ledger and rotate keys.

Detect it

pip install lucin
lucin scan .                  # all rules
lucin explain AG-013-T3          # this rule, in your terminal

Findings carry a file:line and, where the rule supports it, a witness path showing the flow that triggered it. Precision and recall for the whole rule set, with the commands that regenerate them, are on the benchmarks page — and the gaps are on limits.

← All detection rules