<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: testing-endpoint-detection-coverage
description: >-
  Validate endpoint detection and response (EDR) coverage by executing
  technique-specific tests and measuring EDR alert fidelity. Covers Sysmon
  telemetry validation, Wazuh rule testing, and EDR bypass detection.
domain: cybersecurity
subdomain: purple-team
tags:
  - edr
  - endpoint-detection
  - sysmon
  - wazuh
  - crowdstrike
  - carbon-black
  - detection-validation
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1059"]
---

# Testing Endpoint Detection Coverage

## Overview

Endpoint detection coverage testing validates that EDR sensors and host-based
rules detect specific ATT&CK techniques on endpoints. This includes testing
Sysmon event generation, Wazuh rule triggers, and commercial EDR alert fidelity
across process creation, file operations, registry changes, and network connections.

## Prerequisites

| Requirement | Install |
|---|---|
| Sysmon | `sysmon64.exe -accepteula -i sysmonconfig.xml` |
| Wazuh Agent | `/var/ossec/bin/agent-auth -m <manager>` |
| Atomic Red Team | `Install-AtomicRedTeam -getAtomics` |
| Python 3.10+ | For agent tooling |

## Key Concepts

### Sysmon Event Coverage

| EID | Event Type | ATT&CK Relevance |
|---|---|---|
| 1 | Process Create | T1059, T1053, T1547 |
| 3 | Network Connect | T1071, T1041, T1048 |
| 7 | Image Load | T1055, T1574 |
| 8 | CreateRemoteThread | T1055.001, T1055.002 |
| 10 | Process Access | T1003.001 |
| 11 | File Create | T1105, T1027 |
| 12/13/14 | Registry | T1547.001, T1112 |
| 22 | DNS Query | T1071.004, T1568 |

### Detection Test Matrix

```
For each technique:
  1. Execute atomic test on endpoint
  2. Check Sysmon: expected EID generated? (telemetry)
  3. Check Wazuh: rule triggered? (detection)
  4. Check EDR: alert generated? (detection)
  5. Score: telemetry_present + rule_fired + edr_alerted
```

## Workflow

### 1. Validate Sysmon Telemetry

```bash
# Check Sysmon is running
sc query Sysmon64 | findstr RUNNING

# Verify config covers required EIDs
sysmon64.exe -c | findstr -i "ProcessCreate NetworkConnect ImageLoad"

# Execute test and check event log
Invoke-AtomicTest T1003.001 -TestNumbers 1
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" -MaxEvents 10 |
  Where-Object { $_.Id -eq 10 } | Format-List
```

### 2. Test Wazuh Detection Rules

```bash
# Check Wazuh agent status
/var/ossec/bin/wazuh-control status

# Run test and check Wazuh alerts
node scripts/agent.js test-endpoint \
  --technique T1003.001 \
  --edr wazuh \
  --wazuh-api https://wazuh-manager:55000 \
  --output results.json
```

### 3. Batch Endpoint Coverage Test

```bash
# Test multiple techniques against endpoint stack
node scripts/agent.js batch-test \
  --techniques T1003.001,T1059.001,T1053.005,T1547.001 \
  --edr wazuh \
  --check-sysmon \
  --output endpoint-coverage.json
```

## Detection

```yaml
title: Testing Endpoint Detection Coverage Detection
id: 92cc6b97-117f-46ff-adc9-fa0c5c262475
status: experimental
description: Detects suspicious activity related to testing endpoint detection coverage techniques in purple team context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*testing*endpoint*"
  condition: selection
level: medium
tags:
  - attack.t1059
  - attack.defense_evasion
falsepositives:
  - Authorized adversary simulation exercises during scheduled windows
```

## Verification

| Check | Method |
|---|---|
| Sysmon active | `sc query Sysmon64` — RUNNING state |
| Events generated | Expected Sysmon EIDs appear within 5 seconds |
| Wazuh alerts | Alert with matching rule_id in Wazuh API |
| EDR coverage | Alert generated with correct technique mapping |
| No blind spots | All tested techniques have telemetry present |

## References

- [Sysmon Documentation](https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon)
- [Wazuh Ruleset](https://documentation.wazuh.com/current/user-manual/ruleset/)
- [SwiftOnSecurity Sysmon Config](https://github.com/SwiftOnSecurity/sysmon-config)
