← Research

Backlog baseline batch — Windows detectability gaps

Campaign: backlog-baseline-batch-2026-10-13 (ledger led-55e9780207af) · Measured: 2026-10-14 · Triage: 2026-10-15

The first high-volume measurement batch: 23 Windows backlog techniques — ones the emulation plan does not exercise and that have no lab analytic — were each detonated once via Atomic Red Team on win-victim and graded by joining fired alerts to the technique's ATT&CK id. A bundled Wazuh rule tagged with the technique firing is a real detected; nothing tagged it is a real coverage gap. (The 2 Linux entries were deferred — lin-victim lacks pwsh/ART — see led-55e9780207af.)

Headline

• 3 runs detected — 2 techniques, both via bundled Wazuh Sysmon rules (public-rule-backed, not lab-original).
• 24 runs blind — ~20 techniques where nothing attributable to the technique fired. These are the real gaps.
• Every run graded partially-detected or detected at max_rule_level 15 with ~13+ incidental alerts and a benign baseline of ~250 alerts/hour. For a backlog probe (empty expected_wazuh_rules), partially-detected here means marker + incidental noise fired, but no technique detection — not "half caught." The noise floor is itself a finding (below).

Detected (incidental, bundled-rule-backed)

These need no lab rule — bundled coverage already tags the technique. Record as covered; do not claim novelty.

Blind — the coverage gaps (24 runs)

Nothing tagged the technique fired. Ranked by how tractable a host-telemetry detection is in this lab:

A — Feasible candidate-rule targets (clear Sysmon EID1 command-line / EID11 observable; the engineer's G2 backlog):

• credential-dumping-tooling (T1003) — Credential Manager dump via rundll32 keymgr.dll,KRShowKeyMgr
• lsass-memory-dumping (T1003.001) — LSASS access/dump (EID10 ProcessAccess to lsass, or comsvcs MiniDump)
• lsa-secrets-cached-credential-dumping (T1003.005) — cmdkey /list
• api-key-secret-leakage (T1552) — PowerShell reading ConsoleHost_history.txt for secrets
• dpapi-secret-theft (T1555) — vaultcmd /listcreds
• infostealer (T1555.003) — staging browser credential files (note: lab rule 100200 targets cookie-store copies and did not fire — worth checking whether its path/image filter should cover this)
• ad-cs-acl-ca-misconfiguration-esc4esc7 (T1649) — Export-Certificate of local certs
• wmi-remote-execution (T1047) — wmic process call create / WmiPrvSE child
• trojan (T1036) — system binary written/run from an unusual path
• default-hardcoded-iot-credentials (T1078.001) — net user Guest /active:yes
• lateral-movement-via-remote-services (T1021.006) — enable WinRM (Enable-PSRemoting)

B — Harder / noisier / advanced (candidate possible but lower-value or FP-prone here):

• packet-sniffing (T1040) — pktmon/netsh trace
• loader (T1055) — Dirty Vanity process injection (EID8/EID10)
• macro-malware (T1204.002) — MirrorBlast user-exec chain
• port-scanning-service-discovery (T1046) — PowerShell /24 scan (network discovery, inherently noisy)
• replication-through-removable-media (T1091) — USB-spread simulation

C — Needs infrastructure the isolated single-victim lab lacks (defer):

• lateral-movement-via-remote-services T1021.002 (admin-share map) / T1021.003 (DCOM MMC20) — need a second reachable host
• brute-force-password-guessing (T1110.001) — needs a directory/DC to guess against
• forced-authentication-coercion (T1187) — unsigned authenticated RPC to a remote endpoint

The noise floor (separate finding)

win-victim's benign baseline is ~250 alerts/hour and every detonation window hit max_rule_level 15. That volume of unrelated high-level alerts means a genuine technique detection would be hard to surface even if a rule fired. Before trusting Windows detection fidelity, tune down the dominant bundled noise sources (identify the level-15 repeaters in a quiet window and suppress/raise their threshold). Tracked as a Windows FP-hygiene follow-up.

Next steps (the loop)

1. Engineer (G2, draft-not-deploy): draft candidate rules for the A set, each keyed on the Atomic's known observable, proven reachable with wazuh-analysisd -t and a real round-trip — never deployed to the live manager without validation + human approval. Start with the command-line-observable ones (cmdkey, vaultcmd, rundll32 keymgr, Export-Certificate, net user Guest), the same idiom that landed 100203/100213. 2. Check 100200 vs T1555.003 — the infostealer stage didn't trip the pass-the-cookie file rule; confirm whether its target-path/image filter should extend to browser credential files. 3. Hunt (needs live SIEM/archives): for the A/B blind techniques, search the run windows for undetected residue — requires the indexer/logall_json, so it is operator-side, not repo-only. 4. Noise hygiene: cut the ~250/h baseline so real detections are legible.

_This report is the analyst/author output of the loop; rule drafting (G2) and residue hunting are the engineer/hunter steps that follow._