# E15. Companion tooling and validation record

## Tool scope

The companion implements a parse-only JavaScript triage scanner, an experimental YARA rule and two Sigma rules. It is separate from the original key-recovery deobfuscator. The scanner parses with Acorn, traverses the AST, recognizes selected clipboard calls and campaign strings, and reports locations and an input hash. It folds limited literal strings but does not evaluate dynamic arguments or execute the input. [S1, S2]

The documented CLI checks file type, UTF-8 encoding and an 8 MiB size limit. Parsing occurs in-process, so those checks do not prove resistance to resource exhaustion. Syntactic receiver names can be misleading; a clipboard-call finding is not proof of malicious behavior or displayed/copied-content divergence. [S2]

## Detection logic

The YARA rule requires a framework marker, an environment marker and at least two wallet-related strings in a file smaller than 64 MiB. This deliberately combines framework and collection indicators. The Linux Sigma rule selects the recorded system or user systemd unit path; the Windows rule selects schtasks process creation containing the capture-task name. Renaming, different registration APIs and absent telemetry remain blind spots. [S3–S5]

## Recorded validation

The 21 October validation record reports eight AST tests and four detection tests passing. YARA compiled and matched positive ASCII/wide fixtures while rejecting framework-only and partial-marker fixtures. Both Sigma documents parsed, and their positive and negative field fixtures passed. The eight AST tests were rerun offline on 24 October 2026 and passed (Exhibit E15-5). The four detection-test results remain historical and were not rerun for this exhibit set. [S1]

Held-file spot checks reported two clipboard-write findings in a 73,545-byte lure bundle, five campaign-marker findings in a 1,140,214-byte JavaScript payload, and a YARA match on a Go implant. The corresponding hashes appear in E02 and E05. [S1]

## Limits

Fixture success and three spot checks are not estimates of production precision or recall. No fleet-wide evaluation, cross-platform execution test or production SIEM conversion was reported. The supplied CI configuration had not run on GitHub at the time of the record. Source and test files are hashed below to identify the reviewed implementation; the separate execution record in Exhibit E15-5 identifies the AST rerun. No public release identifier has been assigned. [S6–S8]