<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# ATT&CK Coverage Mapping and Gap Analysis Reference

## Coverage Measurement Methodology

1. Export current detection rules as a list of technique IDs (from Splunk, Elastic, Sigma rule set)
2. Load techniques into ATT&CK Navigator → color covered techniques green
3. Identify gaps (grey techniques) — prioritize by threat actor relevance
4. Classify coverage levels per technique:
   - **Blind spot**: No logging at all (e.g., no Sysmon = no T1055 detection possible)
   - **Gap**: Logging exists but no rule written
   - **Partial**: Rule exists for one sub-variant only
   - **Covered**: Rule covers all meaningful variants with alerting

## ATT&CK Navigator Layer JSON Format

```json
{
  "name": "Current Detection Coverage",
  "versions": {"attack": "14", "navigator": "4.9"},
  "domain": "enterprise-attack",
  "techniques": [
    {"techniqueID": "T1003.001", "score": 100, "comment": "Sysmon EID 10 + rule deployed"},
    {"techniqueID": "T1059.001", "score": 50,  "comment": "PowerShell AMSI but no Sigma rule"},
    {"techniqueID": "T1021.002", "score": 0,   "comment": "No SMB lateral movement detection"}
  ],
  "gradient": {"colors": ["#ff6666", "#ffe766", "#8ec843"], "minValue": 0, "maxValue": 100}
}
```

## Gap Analysis Table Format

| Technique | Name | Coverage | Gap | Log Source | Rule Needed |
|-----------|------|----------|-----|------------|-------------|
| T1003.001 | LSASS Dump | Partial | comsvcs.dll variant not covered | Sysmon EID 10 | Process accessing lsass.exe from rundll32 |
| T1055.012 | Process Hollowing | Blind | No memory analysis logging | Sysmon EID 8 | CreateRemoteThread from non-standard parent |
| T1021.006 | WinRM | Gap | WinRM logging not enabled | EventLog 4688 | Enable WinRM audit + rule on wsmprovhost.exe |

## Coverage-Per-Tactic Summary

```
Tactic                  | Covered | Gap | Blind | Total | %
Initial Access          |   5     |  3  |   2   |  10   | 50%
Execution               |   8     |  4  |   1   |  13   | 62%
Credential Access       |   3     |  5  |   3   |  11   | 27%  ← priority
Lateral Movement        |   2     |  6  |   2   |  10   | 20%  ← priority
```

**Anti-pattern:** Measuring coverage by rule count rather than technique coverage — 100 rules covering 5 techniques is worse than 20 rules covering 25 techniques.

## Detection Validation and Tuning

### Coordinated Test Cycle

```
1. RED executes technique (CALDERA ability or Atomic test)
2. BLUE observes in real-time (SIEM, EDR console)
3. Check: did alert fire?
   YES → record detection time, rule name, confidence (FP rate)
   NO  → check if log source captured the event
         NO LOG → blind spot; fix log source before writing rule
         LOG EXISTS → gap; write and deploy Sigma rule
4. BLUE tunes rule if FP rate > threshold
5. Document outcome in gap analysis table
```

### Detection Time Measurement (MTTD)

```
T_exec = timestamp when red team ran technique
T_alert = timestamp when SIEM alert fired
MTTD_technique = T_alert - T_exec
Target: MTTD < 5 min for high-severity, < 60 min for medium
```

### Sigma Rule Template for Gaps

```yaml
title: Suspicious LSASS Access via Comsvcs DLL
status: experimental
logsource:
    category: process_access
    product: windows
detection:
    selection:
        TargetImage|endswith: '\lsass.exe'
        SourceImage|endswith: '\rundll32.exe'
        CallTrace|contains: 'comsvcs.dll'
    condition: selection
falsepositives:
    - Unlikely in most environments
level: high
tags:
    - attack.credential_access
    - attack.t1003.001
```

## Emulation Planning (Threat Intel → Test Plan)

### TTP Extraction from Source Intel

- ISAC reports, CISA advisories, vendor threat reports → extract observable behaviors
- Map each behavior to ATT&CK technique
- Sequence by kill chain phase

### Emulation Plan Template

```markdown
## T1566.001 — Spearphishing Attachment

**Threat Actor Context:** APT29 sends macro-enabled DOCX

**Procedure:**
1. Create macro-enabled DOCX with calc.exe payload
2. Deliver to test mailbox
3. User opens attachment, enables macros
4. Verify: calc.exe spawned as child of winword.exe

**Expected Log Artifacts:**
- Sysmon EID 1: winword.exe → cmd.exe
- Sysmon EID 11: DOCX written to %TEMP%

**Detection Hypothesis:**
Office application spawning cmd.exe, powershell.exe, or wscript.exe

**Pass Criteria:** Alert fires within 5 minutes
**Fail Criteria:** No alert; add Sigma rule
```

**Anti-pattern:** Designing emulation plans from ATT&CK technique pages alone — use threat reports for procedure-level fidelity.
