Putting Detection Coverage to the Test: A Windows Security Case Study
A case study of 144 Sigma analytics using Windows Security log sources shows why ATT&CK mappings alone do not reveal the depth or quality of detection coverage.
Beyond the Heatmap: A New Way to Measure Detection Coverage
Summiting the Pyramid introduces implementation coverage and detection quality to help defenders measure the depth and effectiveness of detection coverage beyond an ATT&CK heatmap.
Context to Confidence: The Next Phase of Ambiguous Techniques Research
MITRE CTID’s latest ambiguous techniques research turns context into confidence with minimum telemetry requirements and a confidence scoring model that helps detection engineers pick the right log sources for robust, low-noise detections.
Ambiguous Techniques: Determine Malice through Context
An ambiguous technique is a MITRE ATT&CK® technique whose observable characteristics are insufficient to determine intent. This means that the observable data does not allow us to confidently ascertain whether the intent…