Coverage & Detection Gaps — standing analysis
_Discovery Engine (Phase 3) · miner: gaps · seed 1729 · source DB git_commit 92a83fc (built 2026-09-19, 633 attacks, 15 sources) · generated from analysis/output/gaps.json._
These are candidates, not discoveries. Every item here is raw miner output. The validation harness (coverage-artifact / statistics / prior-art / adversarial) decides what becomes a recorded finding; see discovery-pass-01.md for the adjudicated verdicts. Read the caveats at the bottom before acting on anything.
1. Detection-content gaps — documented strategy, no ruleized content
62 attacks bucket at detectability = none (zero public Sigma/Elastic rule content) yet carry a detected_by relation to an ATT&CK Detection Strategy — i.e. MITRE documents how to detect them but no community rule implements it. Distribution by category:
| category | attacks | share |
|---|---|---|
| wireless-mobile-iot-ot | 33 | 53% |
| network-infrastructure | 9 | 15% |
| social-engineering | 7 | 11% |
| malware | 4 | 6% |
| cloud-container-supply-chain | 4 | 6% |
| identity-credential | 3 | 5% |
| web-application | 1 | 2% |
| physical-insider-cross-cutting | 1 | 2% |
Representative items (all detectability=none, all carry a documented DET strategy): plc-logic-manipulation (3 strategies, 20 mitigations), alarm-suppression, change-operating-firmware-mode, evil-twin-ap, historian-compromise, arp-spoofing-poisoning (15 mitigations), component-firmware-malware.
Harness outcome (important — read before acting): this gap splits into a confirmed narrow claim and a refuted broad one.
- CONFIRMED (low-risk, published prior art): 100% of assessable ATT&CK-ICS (22/22) and mobile (12/12) attacks have zero public Sigma/Elastic host-log rules despite a documented strategy, vs an enterprise median of 11 rules. This is a real, reproducible corpus census.
- REFUTED as a broad "ruleization gap": ~22/62 map to sub-techniques whose parent technique is ruleized (the importer does not roll parent rules down), and the ingested Sigma/Elastic corpora contain zero ICS (T0xxx) techniques — so many "none" values are manufactured by namespace/granularity, not measured. The title's "Splunk/Sentinel" was never counted (only Sigma + Elastic). Treat this as a corpus-coverage map, not proof of undetectability.
The honest, defensible restatement: public SigmaHQ/Elastic mainline carries no ATT&CK-for-ICS and near-zero Mobile technique tags, so these attacks are invisible to technique-ID rule-coverage metrics. OT detection lives in protocol DPI (Zeek/Suricata/Nozomi/Dragos), mobile in MTD/EMM — outside these corpora by design.
2. Structural outliers (feature-space, enriched subset only)
LocalOutlierFactor (k=20, euclidean) over category+facet+embedding features on the 321 enriched attacks. Spearman(LOF, facet_fill) = 0.231 (p=2.9e-5) — outlierness is mostly not explained by how sparsely an attack was enriched, so none of the top items are flagged coverage_artifact_suspected.
Top LOF outliers: exploitation-for-defense-evasion (2.41), container-escape (1.93), blastpass (1.78), safe-mode-boot-evasion (1.76), malicious-backdoored-images (1.75), zigbee-z-wave-attacks (1.74), cloud-infrastructure-modification (1.73), zero-click-mobile-spyware (1.72), jwt-alg-none (1.70), website-defacement (1.70).
Caveat surfaced by the harness: a schema-design reading of the wireless/RF-proximity + zero-click-mobile cluster (proposing a new "RF-medium" facet) was refuted — adding such a facet did not reduce LOF, and a semantically meaningless shared column reproduced the same shift (a k>cluster-size artifact). CVSS attack_vector=adjacent + platform/environment already model this region; the true issue is enrichment (e.g. blastpass mis-tagged attack_vector=local), not schema.
3. Coverage context (why gaps must be read as tiers, not hard ANDs)
| metric | value |
|---|---|
| attacks total | 633 |
| with detectability facet | 209 |
| with impact facet | 111 |
| with severity facet | 48 |
| with mitigation relation | 223 |
| no mitigation relation | 410 |
Enrichment coupling: detectability and mitigation enrichment are coupled — P(has mitigation | has detectability) = 0.976 vs 0.045 without (Fisher p=1.8e-135). So the strict "high-impact AND low-detect AND no-mitigation" intersection is near-empty by construction. This is why risk hotspots are reported in evidence tiers (see risk-hotspots.md), and why the naive "60 undetectable high-impact attacks" list collapses to 2 under a coverage control (a confirmed methodological negative result — do not act on the raw list).
Caveats (standing)
- Candidates, not discoveries. Nothing here is asserted confirmed; the harness gates everything.
- Curated-dataset selection bias. The 633 attacks and their enrichment were hand-seeded and importer-driven — absence of a facet is missing data, not a measured negative.
- Detectability is derived and instrument-bounded. It counts Sigma/Elastic rules keyed to ATT&CK technique IDs. Attacks keyed to ATLAS/OWASP/CVE/CWE (agentic-AI, many web-app, hardware side-channel) are structurally unmeasurable and read as "none/unknown" regardless of real-world detectability. This is an instrument-coverage limit, not a security finding.
- Empirical detectability is deferred to Phase 4 (lab detonation with false-positive measurement).