Lab coverage

What the isolated detection lab has actually measured. Each cell is an ATT&CK technique on one victim platform, graded from benign emulations against the lab's Wazuh rules. As of DB build 2026-11-02.

From corpus to detection

Of 657 attacks in the corpus, 43 have been exercised in the isolated lab and 33 produced a SIEM detection on at least one run. The gap is the roadmap — not a claim the rest are undetectable.

43 of 657 attacks have a lab measurement; 279 ATT&CK techniques appear in the corpus and 13 are in the emulation plan.

Emulation plan

Measured vs. predicted detectability

Predicted counts public detection content (Sigma, Elastic …) for the technique; measured is whether our lab SIEM fired. They answer different questions, so a disagreement is a finding, not an error.

measured (lab)   predicted (public content)  ·  35 lab-lower (SIEM caught less than public rules predict — detection-engineering work), 5 agree, 2 lab-higher.

Detection latency

How long the SIEM took to raise an alert after each emulation fired.

Each dot is one detected lab run (82 total); x is wall-clock time from the emulation to the SIEM alert (log scale). Faster is further left.

Lab runs

Next targets

1. T1021.004 · windows — Lateral movement via remote services detection only partial — tighten the analytic, then re-grade
2. T1539 · windows — Cookie theft detection only partial — tighten the analytic, then re-grade
3. T1550.002 · windows — Pass-the-hash detection only partial — tighten the analytic, then re-grade
4. T1571 · windows — Modbus/DNP3/S7 protocol abuse detection only partial — tighten the analytic, then re-grade
5. T1021.004 · windows — Lateral movement via remote services in the plan (E1) but never detonated — run it
6. T1550.003 · windows — Pass-the-ticket in the plan (E1) but never detonated — run it
7. T1110.002 — AI-agent-assisted cybercrime operations (BUGSTER case study), JWT weak-secret brute force, Password cracking / rainbow tables +2 no plan entry yet (5 corpus attack(s)); an atomic/test exists; bucketed low/none detectability; MITRE documents a detection strategy — propose a benign entry
8. T1657 — Cross-chain bridge exploit, Crypto private key theft, Data-only extortion +2 no plan entry yet (5 corpus attack(s)); an atomic/test exists; bucketed low/none detectability; MITRE documents a detection strategy — propose a benign entry
9. T1671 — Cloud app / OAuth integration abuse, Malicious OAuth app persistence, OAuth consent phishing +1 no plan entry yet (4 corpus attack(s)); an atomic/test exists; bucketed low/none detectability; MITRE documents a detection strategy — propose a benign entry
10. T1542.001 — Firmware rootkit (CosmicStrand), UEFI firmware implant (LoJax), UEFI / system-firmware implant no plan entry yet (3 corpus attack(s)); an atomic/test exists; bucketed low/none detectability; MITRE documents a detection strategy — propose a benign entry
11. T1566.003 — Angler phishing, Fake job / recruiter lure, Spear phishing via service no plan entry yet (3 corpus attack(s)); an atomic/test exists; bucketed low/none detectability; MITRE documents a detection strategy — propose a benign entry
12. T1558.001 — Diamond Ticket, Golden Ticket no plan entry yet (2 corpus attack(s)); an atomic/test exists; bucketed low/none detectability; MITRE documents a detection strategy — propose a benign entry
13. T1561 — Cyber warfare / state destructive attacks, Disk wipe / firmware corruption no plan entry yet (2 corpus attack(s)); an atomic/test exists; bucketed low/none detectability; MITRE documents a detection strategy — propose a benign entry
14. T1588.001 — Malware-as-a-service (MaaS), Ransomware-as-a-service (RaaS) no plan entry yet (2 corpus attack(s)); an atomic/test exists; bucketed low/none detectability; MITRE documents a detection strategy — propose a benign entry
15. T1692 — Building automation attack, Modbus/DNP3/S7 protocol abuse no plan entry yet (2 corpus attack(s)); an atomic/test exists; bucketed low/none detectability; MITRE documents a detection strategy — propose a benign entry
16. T1003 — Credential-dumping tooling no plan entry yet (1 corpus attack(s)); an atomic/test exists; bucketed low/none detectability; MITRE documents a detection strategy — propose a benign entry
17. T1003.004 — LSA secrets / cached credential dumping no plan entry yet (1 corpus attack(s)); an atomic/test exists; bucketed low/none detectability; MITRE documents a detection strategy — propose a benign entry
18. T1003.005 — LSA secrets / cached credential dumping no plan entry yet (1 corpus attack(s)); an atomic/test exists; bucketed low/none detectability; MITRE documents a detection strategy — propose a benign entry
19. T1027.006 — HTML smuggling no plan entry yet (1 corpus attack(s)); an atomic/test exists; bucketed low/none detectability; MITRE documents a detection strategy — propose a benign entry
20. T1207 — DCShadow no plan entry yet (1 corpus attack(s)); an atomic/test exists; bucketed low/none detectability; MITRE documents a detection strategy — propose a benign entry