SecureAEye LAB ONLINE · SIG 657 · DET ~41s

← Research

Coverage map — technique × detection status

_Phase 8 · red-team ↔ blue-team loop · source DB git_commit 58a372e (built 2026-10-02, 633 attacks) · plan lab/emulation/plan.yaml · generated from analysis/output/coverage.json._

Deterministic and reproducible: python analysis/coverage.py --report. The "as of" stamp is the DB build time, never wall-clock. In-plan cells are graded from real lab_runs; backlog is ATT&CK techniques in the corpus with no emulation entry yet, ranked by DB-only signals (see the bottom).

13 planned cells across 9 techniques — detected 4, partial 1, missed 0, skipped 2, untested 6. 249 corpus techniques have no plan entry (of 256 ATT&CK techniques total).

What the loop should target next

#targetplatformstatuswhy
1T1021.004 · lateral-movement-via-remote-serviceswindowspartialdetection only partial — tighten the analytic, then re-grade
2T1021.001 · lateral-movement-via-remote-serviceswindowsuntestedin the plan (E1) but never detonated — run it
3T1539 · cookie-theftwindowsuntestedin the plan (E1) but never detonated — run it
4T1550.002 · pass-the-hashwindowsuntestedin the plan (E1) but never detonated — run it
5T1550.003 · pass-the-ticketwindowsuntestedin the plan (E1) but never detonated — run it
6T1563.002 · rdp-hijackingwindowsuntestedin the plan (E1) but never detonated — run it
7T1571 · modbus-dnp3-s7-protocol-abusewindowsuntestedin the plan (E2) but never detonated — run it
8T1657—untested (no plan entry)no plan entry yet (5 corpus attack(s)); an atomic/test exists; bucketed low/none detectability; MITRE documents a detection strategy — propose a benign entry
9T1110.002—untested (no plan entry)no plan entry yet (4 corpus attack(s)); an atomic/test exists; bucketed low/none detectability; MITRE documents a detection strategy — propose a benign entry
10T1671—untested (no plan entry)no plan entry yet (4 corpus attack(s)); an atomic/test exists; bucketed low/none detectability; MITRE documents a detection strategy — propose a benign entry
11T1542.001—untested (no plan entry)no plan entry yet (3 corpus attack(s)); an atomic/test exists; bucketed low/none detectability; MITRE documents a detection strategy — propose a benign entry
12T1566.003—untested (no plan entry)no plan entry yet (3 corpus attack(s)); an atomic/test exists; bucketed low/none detectability; MITRE documents a detection strategy — propose a benign entry
13T1558.001—untested (no plan entry)no plan entry yet (2 corpus attack(s)); an atomic/test exists; bucketed low/none detectability; MITRE documents a detection strategy — propose a benign entry
14T1561—untested (no plan entry)no plan entry yet (2 corpus attack(s)); an atomic/test exists; bucketed low/none detectability; MITRE documents a detection strategy — propose a benign entry
15T1588.001—untested (no plan entry)no plan entry yet (2 corpus attack(s)); an atomic/test exists; bucketed low/none detectability; MITRE documents a detection strategy — propose a benign entry
16T1692—untested (no plan entry)no plan entry yet (2 corpus attack(s)); an atomic/test exists; bucketed low/none detectability; MITRE documents a detection strategy — propose a benign entry
17T1027.006—untested (no plan entry)no plan entry yet (1 corpus attack(s)); an atomic/test exists; bucketed low/none detectability; MITRE documents a detection strategy — propose a benign entry
18T1207—untested (no plan entry)no plan entry yet (1 corpus attack(s)); an atomic/test exists; bucketed low/none detectability; MITRE documents a detection strategy — propose a benign entry
19T1556.001—untested (no plan entry)no plan entry yet (1 corpus attack(s)); an atomic/test exists; bucketed low/none detectability; MITRE documents a detection strategy — propose a benign entry
20T1558.002—untested (no plan entry)no plan entry yet (1 corpus attack(s)); an atomic/test exists; bucketed low/none detectability; MITRE documents a detection strategy — propose a benign entry

_All 7 in-plan target(s) plus the top backlog techniques, capped at 20. 249 backlog techniques score above zero in all; the full ranking is in the backlog table and coverage.json._

In-plan matrix (graded from lab_runs)

techniqueplatformattackstatusrunsexpected ruleslast run
T1550.004windowscloud-console-session-hijackskipped0100200, 100201, 100202, 100240—
T1539windowscookie-theftuntested0100200, 100201, 100202—
T1021linuxinsecure-iot-network-servicesdetected21003112026-09-29
T1021windowsinsecure-iot-network-servicesdetected11003012026-09-28
T1021.001windowslateral-movement-via-remote-servicesuntested0100210—
T1021.004windowslateral-movement-via-remote-servicesskipped0——
T1021.004windowslateral-movement-via-remote-servicesdetected21003022026-09-30
T1021.004windowslateral-movement-via-remote-servicespartial11003022026-09-30
T1571linuxmodbus-dnp3-s7-protocol-abusedetected11003102026-10-02
T1571windowsmodbus-dnp3-s7-protocol-abuseuntested0100300—
T1550.002windowspass-the-hashuntested0100221, 100240—
T1550.003windowspass-the-ticketuntested0100222, 100240—
T1563.002windowsrdp-hijackinguntested0100210, 100211—

Skipped (documented not-applicable):

Backlog — corpus techniques with no plan entry

Ranked by DB-only signals: testable (an atomic/test exists, +4), blind (detectability none/low, +2), strategy (MITRE documents detection, +1). High-priority rows are the best candidates for a new benign emulation entry.

techniqueprioritytestableblindstrategycorpus attacks
T16577✓✓✓5
T1110.0027✓✓✓4
T16717✓✓✓4
T1542.0017✓✓✓3
T1566.0037✓✓✓3
T1558.0017✓✓✓2
T15617✓✓✓2
T1588.0017✓✓✓2
T16927✓✓✓2
T1027.0067✓✓✓1
T12077✓✓✓1
T1556.0017✓✓✓1
T1558.0027✓✓✓1
T1558.0047✓✓✓1
T1606.0027✓✓✓1
T16127✓✓✓1
T16597✓✓✓1
T15575✓·✓10
T11995✓·✓8
T12005✓·✓7
T14865✓·✓6
T16495✓·✓6
T1566.0025✓·✓5
T11905✓·✓4
T14855✓·✓4

_Showing top 25 of 249 backlog techniques (the rest score 0 on every signal). Full list in coverage.json._