SAF-T1004: reconcile SAF tactic, strengthen example, add diagram, verify refs

[fkautz]

Summary

Addresses the SAF-T1004 (Server Impersonation / Name-Collision) review (scored 85.8, merge-with-minor-revisions). Detection rule unchanged (still 12/12).

• Tactic/taxonomy (priority): the Overview declared ATT&CK tactics (Credential Access + Collection) while the framework index files SAF-T1004 under Initial Access. Set the Overview SAF tactic back to Initial Access (ATK-TA0001) to match the index, and moved the Credential Access / Collection framing into a note in the MITRE ATT&CK Mapping section where T1557's tactics belong.
• Example Scenario: expanded from one registry record to the actual name collision (legitimate vs. attacker record) with the resolution step, mapped to Attack-Flow stages 2-4 and to the detection selections.
• Visual aid: added a discovery-hijack flow diagram (DNS + rogue DHCP + ARP + registry).
• Verification: confirmed the odr.exe Microsoft Learn reference is real ("Windows on-device agent registry" CLI with odr mcp add/list/remove), plus the Server Cards roadmap, JRC DNSSEC report, and Internet Society DNSSEC maps (2021 snapshot) by content.
• Fixed the non-resolving detection-rule references URL (SAF-MCP -> secure-agentic-framework); gave attack-flow stage 6 a stated pivot mechanism; softened "dangerous"; normalized author-name casing.

Test

python3 techniques/SAF-T1004/test_detection_rule.py
# Test Summary: 12/12 tests passed (100.0%)

🤖 Generated with Claude Code