<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: mapping-attack-to-detection-coverage
description: >-
  Map ATT&CK techniques to existing detection rules and telemetry sources.
  Build ATT&CK Navigator layers showing coverage, gaps, and priorities.
  Use when assessing detection posture against specific threat actors or
  building coverage matrices for purple team planning.
domain: cybersecurity
subdomain: purple-team
tags:
  - mitre-attack
  - attack-navigator
  - coverage-mapping
  - detection-engineering
  - threat-intelligence
  - gap-analysis
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1003.001"]
---

# Mapping ATT&CK to Detection Coverage

## Overview

Detection coverage mapping overlays existing SIEM rules, EDR detections, and
telemetry sources onto the MITRE ATT&CK matrix. The output is a Navigator
layer JSON that visually shows green (covered), yellow (partial), and red (gap)
for every technique relevant to your threat model.

## Prerequisites

| Requirement | Install |
|---|---|
| ATT&CK Navigator | `git clone https://github.com/mitre-attack/attack-navigator && cd attack-navigator/nav-app && npm install && ng serve` |
| attack-scripts | `pip install mitreattack-python` |
| sigma-cli | `pip install sigma-cli` |
| Python 3.10+ | For agent tooling |
| jq | JSON layer manipulation |

## Key Concepts

### Navigator Layer Format

```json
{
  "name": "Detection Coverage Q1 2026",
  "versions": {"attack": "15.1", "navigator": "5.1.0", "layer": "4.5"},
  "domain": "enterprise-attack",
  "techniques": [
    {
      "techniqueID": "T1003.001",
      "tactic": "credential-access",
      "score": 80,
      "color": "#2ecc71",
      "comment": "Sigma rule sigma-123 + Sysmon EID 10",
      "metadata": [
        {"name": "rule_id", "value": "sigma-123"},
        {"name": "data_source", "value": "Sysmon"},
        {"name": "last_validated", "value": "2026-03-01"}
      ]
    }
  ],
  "gradient": {
    "colors": ["#ff0000", "#ffff00", "#00ff00"],
    "minValue": 0,
    "maxValue": 100
  }
}
```

### Coverage Scoring

| Score | Color | Meaning |
|---|---|---|
| 0 | Red | No telemetry, no rule |
| 25 | Orange | Telemetry available, no rule |
| 50 | Yellow | Rule exists, not validated |
| 75 | Light green | Rule validated, FP tuned |
| 100 | Green | Rule validated + automated re-test |

### Mapping Workflow

1. Export all Sigma rules with ATT&CK tags: `grep -r 'attack\.t' rules/ -l`
2. Parse technique IDs from each rule's `tags` field
3. Cross-reference with telemetry inventory (which log sources are collected)
4. Score each technique based on rule + telemetry + validation status
5. Generate Navigator layer JSON

## Workflow

### 1. Extract Rule-to-Technique Map

```bash
# Extract ATT&CK mappings from Sigma rules
for rule in rules/*.yml; do
  techniques=$(grep -oP 'attack\.t\d{4}(\.\d{3})?' "$rule" | sort -u)
  echo "$rule: $techniques"
done

# Using mitreattack-python for technique metadata
python3 -c "
from mitreattack.stix20 import MitreAttackData
attack = MitreAttackData('enterprise-attack.json')
techniques = attack.get_techniques()
for t in techniques[:5]:
    print(t['external_references'][0]['external_id'], t['name'])
"
```

### 2. Build Telemetry Inventory

```bash
# Check Sysmon coverage
sysmon -c | grep -E 'ProcessCreate|NetworkConnect|FileCreate'

# Verify Windows Event Log channels
wevtutil el | grep -i security
wevtutil gli Security | grep numberOfLogRecords

# Check Linux audit rules
auditctl -l | grep -E 'execve|connect|open'
```

### 3. Generate Navigator Layer

```bash
# Generate layer from agent script
node scripts/agent.js generate-layer \
  --rules-dir rules/ \
  --telemetry-map telemetry.json \
  --output coverage-layer.json

# Merge with threat actor layer
node scripts/agent.js merge-layers \
  --coverage coverage-layer.json \
  --threat-actor apt29-layer.json \
  --output gap-analysis.json
```

### 4. Prioritize Gaps

```bash
# List uncovered techniques used by a threat actor
node scripts/agent.js list-gaps \
  --layer gap-analysis.json \
  --min-score 0 \
  --max-score 25
```

## Detection

```yaml
title: Mapping Attack To Detection Coverage Detection
id: 58926cec-acd5-407f-9b9d-5f72f63e8c9a
status: experimental
description: Detects suspicious activity related to mapping attack to detection coverage techniques in purple team context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*mapping*attack*"
  condition: selection
level: medium
tags:
  - attack.t1003.001
  - attack.defense_evasion
falsepositives:
  - Authorized adversary simulation exercises during scheduled windows
```

## Verification

| Check | Method |
|---|---|
| Layer JSON valid | `jq . coverage-layer.json` — parses without error |
| All rules mapped | Every Sigma rule with ATT&CK tag appears in layer |
| Score accuracy | Spot-check 10 techniques against actual SIEM rules |
| Navigator renders | Import layer into ATT&CK Navigator — no errors |
| Gap list complete | Techniques with score 0 match telemetry blind spots |

## References

- [ATT&CK Navigator](https://mitre-attack.github.io/attack-navigator/)
- [mitreattack-python](https://github.com/mitre-attack/mitreattack-python)
- [MITRE ATT&CK Data Sources](https://attack.mitre.org/datasources/)
