Detection Coverage Heatmap

T1589 Gather Victim Identity Information 33 rules T1589.001 Credentials 12 rules T1589.002 Email Addresses 21 rules T1589.003 Employee Names 6 rules T1590 Gather Victim Network Information 18 rules T1590.001 Domain Properties 4 rules T1590.002 DNS 5 rules T1590.003 Network Trust Dependencies 2 rules T1590.004 Network Topology 6 rules T1590.005 IP Addresses 7 rules T1590.006 Network Security Appliances 4 rules T1591 Gather Victim Org Information 15 rules T1591.001 Determine Physical Locations 6 rules T1591.002 Business Relationships 8 rules T1591.003 Identify Business Tempo 2 rules T1591.004 Identify Roles 6 rules T1592 Gather Victim Host Information 20 rules T1592.001 Hardware 3 rules T1592.002 Software 6 rules T1592.003 Firmware 2 rules T1592.004 Client Configurations 6 rules T1593 Search Open Websites/Domains 16 rules T1593.001 Social Media 5 rules T1593.002 Search Engines 3 rules T1593.003 Code Repositories 8 rules T1594 Search Victim-Owned Websites 12 rules T1595 Active Scanning 89 rules T1595.001 Scanning IP Blocks 10 rules T1595.002 Vulnerability Scanning 31 rules T1595.003 Wordlist Scanning 7 rules T1596 Search Open Technical Databases 5 rules T1596.001 DNS/Passive DNS 5 rules T1596.002 WHOIS 2 rules T1596.003 Digital Certificates 5 rules T1596.004 CDNs 5 rules T1596.005 Scan Databases 5 rules T1597 Search Closed Sources 3 rules T1597.001 Threat Intel Vendors 3 rules T1597.002 Purchase Technical Data 3 rules T1598 Phishing for Information 21 rules T1598.001 Spearphishing Service 2 rules T1598.002 Spearphishing Attachment 8 rules T1598.003 Spearphishing Link 21 rules T1598.004 Spearphishing Voice 4 rules T1681 Search Threat Vendor Data 5 rules T1682 Query Public AI Services 5 rules

T1583 Acquire Infrastructure 138 rules T1583.001 Domains 84 rules T1583.002 DNS Server 9 rules T1583.003 Virtual Private Server 47 rules T1583.004 Server 33 rules T1583.005 Botnet 8 rules T1583.006 Web Services 33 rules T1583.007 Serverless 3 rules T1583.008 Malvertising 3 rules T1584 Compromise Infrastructure 95 rules T1584.001 Domains 23 rules T1584.002 DNS Server 7 rules T1584.003 Virtual Private Server 15 rules T1584.004 Server 22 rules T1584.005 Botnet 12 rules T1584.006 Web Services 7 rules T1584.007 Serverless 2 rules T1584.008 Network Devices 8 rules T1585 Establish Accounts 35 rules T1585.001 Social Media Accounts 23 rules T1585.002 Email Accounts 24 rules T1585.003 Cloud Accounts 6 rules T1586 Compromise Accounts 86 rules T1586.001 Social Media Accounts 4 rules T1586.002 Email Accounts 21 rules T1586.003 Cloud Accounts 4 rules T1587 Develop Capabilities 41 rules T1587.001 Malware 50 rules T1587.002 Code Signing Certificates 11 rules T1587.003 Digital Certificates 13 rules T1587.004 Exploits 9 rules T1588 Obtain Capabilities 43 rules T1588.001 Malware 28 rules T1588.002 Tool 100 rules T1588.003 Code Signing Certificates 17 rules T1588.004 Digital Certificates 13 rules T1588.005 Exploits 9 rules T1588.006 Vulnerabilities 7 rules T1588.007 Artificial Intelligence 5 rules T1608 Stage Capabilities 22 rules T1608.001 Upload Malware 40 rules T1608.002 Upload Tool 12 rules T1608.003 Install Digital Certificate 5 rules T1608.004 Drive-by Target 13 rules T1608.005 Link Target 8 rules T1608.006 SEO Poisoning 5 rules T1650 Acquire Access 63 rules T1683 Generate Content 2 rules T1683.001 Written Content 5 rules T1683.002 Audio-Visual Content 4 rules

T1189 Drive-by Compromise 97 rules T1190 Exploit Public-Facing Application 211 rules T1195 Supply Chain Compromise 27 rules T1195.001 Compromise Software Dependencies and Development Tools 10 rules T1195.002 Compromise Software Supply Chain 21 rules T1195.003 Compromise Hardware Supply Chain 2 rules T1199 Trusted Relationship 22 rules T1200 Hardware Additions 5 rules T1566 Phishing 115 rules T1566.001 Spearphishing Attachment 195 rules T1566.002 Spearphishing Link 104 rules T1566.003 Spearphishing via Service 27 rules T1566.004 Spearphishing Voice 11 rules T1659 Content Injection 44 rules T1669 Wi-Fi Networks 5 rules

T1047 Windows Management Instrumentation 85 rules T1053 Scheduled Task/Job 56 rules T1053.002 At 9 rules T1053.003 Cron 10 rules T1053.005 Scheduled Task 111 rules T1053.006 Systemd Timers 6 rules T1053.007 Container Orchestration Job 4 rules T1059 Command and Scripting Interpreter 201 rules T1059.001 PowerShell 176 rules T1059.002 AppleScript 6 rules T1059.003 Windows Command Shell 158 rules T1059.004 Unix Shell 27 rules T1059.005 Visual Basic 66 rules T1059.006 Python 32 rules T1059.007 JavaScript 51 rules T1059.008 Network Device CLI 6 rules T1059.009 Cloud API 10 rules T1059.010 AutoHotKey & AutoIT 8 rules T1059.011 Lua 6 rules T1059.012 Hypervisor CLI 4 rules T1059.013 Container CLI/API 16 rules T1072 Software Deployment Tools 27 rules T1106 Native API 59 rules T1129 Shared Modules 22 rules T1203 Exploitation for Client Execution 115 rules T1204 User Execution 75 rules T1204.001 Malicious Link 68 rules T1204.002 Malicious File 149 rules T1204.003 Malicious Image 7 rules T1204.004 Malicious Copy and Paste 24 rules T1204.005 Malicious Library 6 rules T1559 Inter-Process Communication 34 rules T1559.001 Component Object Model 17 rules T1559.002 Dynamic Data Exchange 25 rules T1559.003 XPC Services 10 rules T1569 System Services 15 rules T1569.001 Launchctl 2 rules T1569.002 Service Execution 35 rules T1569.003 Systemctl 3 rules T1609 Container Administration Command 51 rules T1610 Deploy Container 16 rules T1648 Serverless Execution 6 rules T1651 Cloud Administration Command 64 rules T1674 Input Injection 6 rules T1675 ESXi Administration Command 6 rules T1677 Poisoned Pipeline Execution 6 rules

T1037 Boot or Logon Initialization Scripts 86 rules T1037.001 Logon Script (Windows) 4 rules T1037.002 Login Hook 2 rules T1037.003 Network Logon Script 3 rules T1037.004 RC Scripts 7 rules T1037.005 Startup Items 2 rules T1098 Account Manipulation 116 rules T1098.001 Additional Cloud Credentials 11 rules T1098.002 Additional Email Delegate Permissions 8 rules T1098.003 Additional Cloud Roles 11 rules T1098.004 SSH Authorized Keys 9 rules T1098.005 Device Registration 6 rules T1098.006 Additional Container Cluster Roles 4 rules T1098.007 Additional Local or Domain Groups 13 rules T1133 External Remote Services 107 rules T1136 Create Account 68 rules T1136.001 Local Account 33 rules T1136.002 Domain Account 13 rules T1136.003 Cloud Account 9 rules T1137 Office Application Startup 12 rules T1137.001 Office Template Macros 4 rules T1137.002 Office Test 4 rules T1137.003 Outlook Forms 3 rules T1137.004 Outlook Home Page 4 rules T1137.005 Outlook Rules 3 rules T1137.006 Add-ins 3 rules T1176 Software Extensions 8 rules T1176.001 Browser Extensions 10 rules T1176.002 IDE Extensions 9 rules T1505 Server Software Component 27 rules T1505.001 SQL Stored Procedures 6 rules T1505.002 Transport Agent 6 rules T1505.003 Web Shell 57 rules T1505.004 IIS Components 7 rules T1505.005 Terminal Services DLL 5 rules T1505.006 vSphere Installation Bundles 6 rules T1525 Implant Internal Image 7 rules T1543 Create or Modify System Process 76 rules T1543.001 Launch Agent 5 rules T1543.002 Systemd Service 11 rules T1543.003 Windows Service 58 rules T1543.004 Launch Daemon 3 rules T1543.005 Container Service 3 rules T1546.017 Udev Rules 2 rules T1546.018 Python Startup Hooks 1 rule T1547 Boot or Logon Autostart Execution 116 rules T1547.001 Registry Run Keys / Startup Folder 91 rules T1547.002 Authentication Package 2 rules T1547.003 Time Providers 3 rules T1547.004 Winlogon Helper DLL 11 rules T1547.005 Security Support Provider 2 rules T1547.006 Kernel Modules and Extensions 5 rules T1547.007 Re-opened Applications 3 rules T1547.008 LSASS Driver 4 rules T1547.009 Shortcut Modification 14 rules T1547.010 Port Monitors 2 rules T1547.012 Print Processors 3 rules T1547.013 XDG Autostart Entries 5 rules T1547.014 Active Setup 1 rule T1547.015 Login Items 2 rules T1554 Compromise Host Software Binary 57 rules T1653 Power Settings 3 rules T1668 Exclusive Control 1 rule T1671 Cloud Application Integration 63 rules

T1068 Exploitation for Privilege Escalation 86 rules T1546 Event Triggered Execution 35 rules T1546.001 Change Default File Association 4 rules T1546.002 Screensaver 3 rules T1546.003 Windows Management Instrumentation Event Subscription 17 rules T1546.004 Unix Shell Configuration Modification 3 rules T1546.005 Trap 2 rules T1546.006 LC_LOAD_DYLIB Addition 5 rules T1546.007 Netsh Helper DLL 2 rules T1546.008 Accessibility Features 12 rules T1546.009 AppCert DLLs 2 rules T1546.010 AppInit DLLs 5 rules T1546.011 Application Shimming 4 rules T1546.012 Image File Execution Options Injection 2 rules T1546.013 PowerShell Profile 5 rules T1546.014 Emond 2 rules T1546.015 Component Object Model Hijacking 2 rules T1546.016 Installer Packages 3 rules T1548 Abuse Elevation Control Mechanism 103 rules T1548.001 Setuid and Setgid 2 rules T1548.002 Bypass User Account Control 35 rules T1548.003 Sudo and Sudo Caching 7 rules T1548.004 Elevated Execution with Prompt 2 rules T1548.005 Temporary Elevated Cloud Access 3 rules T1548.006 TCC Manipulation 4 rules T1611 Escape to Host 9 rules

T1003 OS Credential Dumping 69 rules T1003.001 LSASS Memory 78 rules T1003.002 Security Account Manager 33 rules T1003.003 NTDS 26 rules T1003.004 LSA Secrets 17 rules T1003.005 Cached Domain Credentials 11 rules T1003.006 DCSync 10 rules T1003.007 Proc Filesystem 3 rules T1003.008 /etc/passwd and /etc/shadow 4 rules T1040 Network Sniffing 24 rules T1110 Brute Force 113 rules T1110.001 Password Guessing 18 rules T1110.002 Password Cracking 10 rules T1110.003 Password Spraying 24 rules T1110.004 Credential Stuffing 12 rules T1111 Multi-Factor Authentication Interception 13 rules T1187 Forced Authentication 8 rules T1212 Exploitation for Credential Access 12 rules T1528 Steal Application Access Token 18 rules T1539 Steal Web Session Cookie 24 rules T1552 Unsecured Credentials 25 rules T1552.001 Credentials In Files 31 rules T1552.002 Credentials in Registry 8 rules T1552.003 Shell History 4 rules T1552.004 Private Keys 18 rules T1552.005 Cloud Instance Metadata API 6 rules T1552.006 Group Policy Preferences 7 rules T1552.007 Container API 6 rules T1552.008 Chat Messages 4 rules T1555 Credentials from Password Stores 83 rules T1555.001 Keychain 5 rules T1555.002 Securityd Memory 3 rules T1555.003 Credentials from Web Browsers 44 rules T1555.004 Windows Credential Manager 7 rules T1555.005 Password Managers 16 rules T1555.006 Cloud Secrets Management Stores 6 rules T1557 Adversary-in-the-Middle 86 rules T1557.001 Name Resolution Poisoning and SMB Relay 10 rules T1557.002 ARP Cache Poisoning 13 rules T1557.003 DHCP Spoofing 4 rules T1557.004 Evil Twin 5 rules T1558 Steal or Forge Kerberos Tickets 13 rules T1558.001 Golden Ticket 11 rules T1558.002 Silver Ticket 8 rules T1558.003 Kerberoasting 10 rules T1558.004 AS-REP Roasting 16 rules T1558.005 Ccache Files 5 rules T1606 Forge Web Credentials 7 rules T1606.001 Web Cookies 3 rules T1606.002 SAML Tokens 6 rules T1621 Multi-Factor Authentication Request Generation 10 rules T1649 Steal or Forge Authentication Certificates 12 rules

T1007 System Service Discovery 25 rules T1010 Application Window Discovery 65 rules T1012 Query Registry 41 rules T1016 System Network Configuration Discovery 73 rules T1016.001 Internet Connection Discovery 19 rules T1016.002 Wi-Fi Discovery 6 rules T1018 Remote System Discovery 72 rules T1033 System Owner/User Discovery 71 rules T1046 Network Service Discovery 68 rules T1049 System Network Connections Discovery 48 rules T1057 Process Discovery 91 rules T1069 Permission Groups Discovery 15 rules T1069.001 Local Groups 12 rules T1069.002 Domain Groups 20 rules T1069.003 Cloud Groups 4 rules T1082 System Information Discovery 130 rules T1083 File and Directory Discovery 129 rules T1087 Account Discovery 105 rules T1087.001 Local Account 32 rules T1087.002 Domain Account 45 rules T1087.003 Email Account 5 rules T1087.004 Cloud Account 7 rules T1120 Peripheral Device Discovery 21 rules T1124 System Time Discovery 27 rules T1135 Network Share Discovery 44 rules T1201 Password Policy Discovery 6 rules T1217 Browser Information Discovery 76 rules T1482 Domain Trust Discovery 28 rules T1518 Software Discovery 29 rules T1518.001 Security Software Discovery 35 rules T1518.002 Backup Software Discovery 12 rules T1526 Cloud Service Discovery 55 rules T1538 Cloud Service Dashboard 58 rules T1580 Cloud Infrastructure Discovery 65 rules T1613 Container and Resource Discovery 47 rules T1614 System Location Discovery 7 rules T1614.001 System Language Discovery 7 rules T1615 Group Policy Discovery 3 rules T1619 Cloud Storage Object Discovery 55 rules T1652 Device Driver Discovery 2 rules T1654 Log Enumeration 9 rules T1673 Virtual Machine Discovery 2 rules T1680 Local Storage Discovery 13 rules

T1021 Remote Services 59 rules T1021.001 Remote Desktop Protocol 67 rules T1021.002 SMB/Windows Admin Shares 44 rules T1021.003 Distributed Component Object Model 7 rules T1021.004 SSH 42 rules T1021.005 VNC 10 rules T1021.006 Windows Remote Management 10 rules T1021.007 Cloud Services 8 rules T1021.008 Direct Cloud VM Connections 3 rules T1080 Taint Shared Content 12 rules T1091 Replication Through Removable Media 19 rules T1210 Exploitation of Remote Services 33 rules T1534 Internal Spearphishing 18 rules T1550 Use Alternate Authentication Material 24 rules T1550.001 Application Access Token 24 rules T1550.002 Pass the Hash 24 rules T1550.003 Pass the Ticket 10 rules T1550.004 Web Session Cookie 3 rules T1563 Remote Service Session Hijacking 9 rules T1563.001 SSH Hijacking 6 rules T1563.002 RDP Hijacking 9 rules T1570 Lateral Tool Transfer 33 rules

T1005 Data from Local System 121 rules T1025 Data from Removable Media 14 rules T1039 Data from Network Shared Drive 18 rules T1056 Input Capture 26 rules T1056.001 Keylogging 45 rules T1056.002 GUI Input Capture 6 rules T1056.003 Web Portal Capture 8 rules T1056.004 Credential API Hooking 5 rules T1074 Data Staged 52 rules T1074.001 Local Data Staging 39 rules T1074.002 Remote Data Staging 14 rules T1113 Screen Capture 50 rules T1114 Email Collection 33 rules T1114.001 Local Email Collection 13 rules T1114.002 Remote Email Collection 20 rules T1114.003 Email Forwarding Rule 17 rules T1115 Clipboard Data 72 rules T1119 Automated Collection 105 rules T1123 Audio Capture 80 rules T1125 Video Capture 17 rules T1185 Browser Session Hijacking 65 rules T1213 Data from Information Repositories 43 rules T1213.001 Confluence 7 rules T1213.002 Sharepoint 14 rules T1213.003 Code Repositories 12 rules T1213.004 Customer Relationship Management Software 7 rules T1213.005 Messaging Applications 9 rules T1213.006 Databases 13 rules T1530 Data from Cloud Storage 34 rules T1560 Archive Collected Data 127 rules T1560.001 Archive via Utility 57 rules T1560.002 Archive via Library 13 rules T1560.003 Archive via Custom Method 15 rules T1602 Data from Configuration Repository 12 rules T1602.001 SNMP (MIB Dump) 8 rules T1602.002 Network Device Configuration Dump 9 rules

T1001 Data Obfuscation 25 rules T1001.001 Junk Data 4 rules T1001.002 Steganography 3 rules T1001.003 Protocol or Service Impersonation 5 rules T1008 Fallback Channels 19 rules T1071 Application Layer Protocol 176 rules T1071.001 Web Protocols 146 rules T1071.002 File Transfer Protocols 16 rules T1071.003 Mail Protocols 19 rules T1071.004 DNS 36 rules T1071.005 Publish/Subscribe Protocols 6 rules T1090 Proxy 59 rules T1090.001 Internal Proxy 19 rules T1090.002 External Proxy 22 rules T1090.003 Multi-hop Proxy 25 rules T1090.004 Domain Fronting 6 rules T1092 Communication Through Removable Media 54 rules T1095 Non-Application Layer Protocol 35 rules T1102 Web Service 45 rules T1102.001 Dead Drop Resolver 12 rules T1102.002 Bidirectional Communication 23 rules T1102.003 One-Way Communication 6 rules T1104 Multi-Stage Channels 13 rules T1105 Ingress Tool Transfer 219 rules T1132 Data Encoding 19 rules T1132.001 Standard Encoding 30 rules T1132.002 Non-Standard Encoding 14 rules T1219 Remote Access Tools 50 rules T1219.001 IDE Tunneling 3 rules T1219.002 Remote Desktop Software 17 rules T1219.003 Remote Access Hardware 2 rules T1568 Dynamic Resolution 31 rules T1568.001 Fast Flux DNS 4 rules T1568.002 Domain Generation Algorithms 7 rules T1568.003 DNS Calculation 2 rules T1571 Non-Standard Port 37 rules T1572 Protocol Tunneling 33 rules T1573 Encrypted Channel 44 rules T1573.001 Symmetric Cryptography 31 rules T1573.002 Asymmetric Cryptography 26 rules T1665 Hide Infrastructure 6 rules

T1011 Exfiltration Over Other Network Medium 3 rules T1011.001 Exfiltration Over Bluetooth 3 rules T1020 Automated Exfiltration 79 rules T1020.001 Traffic Duplication 5 rules T1029 Scheduled Transfer 3 rules T1030 Data Transfer Size Limits 18 rules T1041 Exfiltration Over C2 Channel 124 rules T1048 Exfiltration Over Alternative Protocol 67 rules T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol 6 rules T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol 9 rules T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol 16 rules T1052 Exfiltration Over Physical Medium 7 rules T1052.001 Exfiltration over USB 8 rules T1537 Transfer Data to Cloud Account 10 rules T1567 Exfiltration Over Web Service 78 rules T1567.001 Exfiltration to Code Repository 5 rules T1567.002 Exfiltration to Cloud Storage 42 rules T1567.003 Exfiltration to Text Storage Sites 2 rules T1567.004 Exfiltration Over Webhook 2 rules

T1485 Data Destruction 46 rules T1485.001 Lifecycle-Triggered Deletion 3 rules T1486 Data Encrypted for Impact 131 rules T1489 Service Stop 28 rules T1490 Inhibit System Recovery 44 rules T1491 Defacement 11 rules T1491.001 Internal Defacement 9 rules T1491.002 External Defacement 6 rules T1495 Firmware Corruption 4 rules T1496 Resource Hijacking 9 rules T1496.001 Compute Hijacking 5 rules T1496.002 Bandwidth Hijacking 1 rule T1496.003 SMS Pumping 2 rules T1496.004 Cloud Service Hijacking 2 rules T1498 Network Denial of Service 18 rules T1498.001 Direct Network Flood 5 rules T1498.002 Reflection Amplification 3 rules T1499 Endpoint Denial of Service 21 rules T1499.001 OS Exhaustion Flood 3 rules T1499.002 Service Exhaustion Flood 2 rules T1499.003 Application Exhaustion Flood 2 rules T1499.004 Application or System Exploitation 4 rules T1529 System Shutdown/Reboot 16 rules T1531 Account Access Removal 65 rules T1561 Disk Wipe 23 rules T1561.001 Disk Content Wipe 6 rules T1561.002 Disk Structure Wipe 8 rules T1565 Data Manipulation 11 rules T1565.001 Stored Data Manipulation 5 rules T1565.002 Transmitted Data Manipulation 4 rules T1565.003 Runtime Data Manipulation 4 rules T1657 Financial Theft 59 rules T1667 Email Bombing 4 rules