Generated by attack-coverage-map on 2026-10-28 09:47
| Detection | Source | Level | Techniques |
|---|---|---|---|
| Modified or deleted file in a monitored tree | file-integrity-monitor | medium | T1070 |
| New file appearing in a monitored tree | file-integrity-monitor | medium | T1105 |
| Brute force that ended in a successful login | log-analyzer | high | T1078, T1110 |
| Brute force: repeated failed logins from one source | log-analyzer | high | T1110, T1110.001 |
| Kerberoasting: RC4 service ticket request | log-analyzer | high | T1558.003 |
| Kerberoasting: SPN fan-out by one account | log-analyzer | medium | T1558.003 |
| Hidden systemd unit file | persistwatch | medium | T1564.001 |
| Systemd timer firing fast enough to be a re-infection loop | persistwatch | medium | T1053.006 |
| Systemd unit name imitating a real system unit | persistwatch | high | T1036.005 |
| Systemd unit running a binary from a writable path | persistwatch | high | T1543.002 |
| Systemd unit setting LD_PRELOAD | persistwatch | high | T1574.006 |
| Systemd unit that downloads its own payload | persistwatch | high | T1105, T1543.002 |
| Systemd unit that is really a shell one-liner | persistwatch | high | T1059.004 |
| Systemd unit with an encoded or evaluated payload | persistwatch | high | T1027 |
| World-writable systemd unit or target binary | persistwatch | high | T1222, T1543.002 |
| Attachment hash and type triage | phishing-email-analyzer | medium | T1204.002, T1566.001 |
| Email authentication failure and spoofed sender | phishing-email-analyzer | medium | T1566 |
| Lookalike sender or link domain | phishing-email-analyzer | medium | T1036, T1566.002 |
| Defender exclusion added before a tool was staged | purple-team-journey | medium | T1562.001 |
| Kerberoasting confirmed in my AD lab | purple-team-journey | high | T1558.003 |
| LLMNR and NBT-NS poisoning confirmed in my AD lab | purple-team-journey | medium | T1557.001 |
| Kerberoasting via RC4 Service Ticket Request | sigma | high | T1558.003 |
| LLMNR and NBT-NS Responder Traffic | sigma | medium | T1557.001 |
| Suspicious Scheduled Task Creation | sigma | medium | T1053.005 |
| Windows Defender Exclusion Added | sigma | medium | T1562.001 |
Coverage here means a detection exists and claims the technique. It does not mean the detection was tested against a live attack, and it does not mean the technique is fully covered. Depth is the number of independent detections behind a technique, which is the number worth growing. Built by ruxchipher · attack-coverage-map.