=============================================================================== DETECTION COVERAGE ASSESSMENT — GLOBEX CORPORATION Assessment Date: 2026-03-01 Assessed By: SOC Engineering Team Framework: MITRE ATT&CK Enterprise v14 Tooling: Splunk SIEM, Suricata IDS, CrowdStrike Falcon, Sysmon, OSSEC =============================================================================== COVERAGE LEGEND: DETECTED = Reliable detection rule in production, tested and tuned, <10% FP PARTIAL = Rule exists but high false positive rate, limited log sources, or covers only some sub-techniques BLIND = No detection rule, insufficient log data, or no visibility =============================================================================== # TECHNIQUE ID TECHNIQUE NAME TACTIC STATUS DETAILS --- -------------- --------------------------------------- ------------------- ---------- ---------------------------------------- 01 T1566.001 Phishing: Spearphishing Attachment Initial Access PARTIAL Exchange transport rules flag known-bad extensions (.exe, .scr, .js). HTML smuggling and .html attachments NOT blocked. No sandbox detonation for URL payloads. Gap: credential harvesting via HTML lure pages is undetected at the gateway. 02 T1566.002 Phishing: Spearphishing Link Initial Access BLIND Proxy logs capture URL clicks but no automated correlation between email receipt and URL click. No real-time alerting on user visiting newly-registered domains from email links. Reputation checking is post-hoc only. 03 T1059.001 Command & Scripting: PowerShell Execution DETECTED Sysmon Event ID 1 + CrowdStrike detect encoded PowerShell commands reliably. Script block logging (Event ID 4104) enabled on all workstations. Tuned with known-good admin script whitelist. 04 T1071.001 Application Layer Protocol: Web Command & Control PARTIAL Suricata has JA3/JA3S signatures for known C2 frameworks (CobaltStrike, Metasploit). However, no SSL decryption means encrypted C2 channels with custom profiles evade detection. Beacon timing analysis not implemented. 05 T1046 Network Service Scanning Discovery DETECTED Suricata threshold rule fires on >50 connection attempts in 60 seconds from single source. Also detected by firewall deny log correlation in Splunk. Low FP rate after excluding vulnerability scanners. 06 T1003.001 OS Credential Dumping: LSASS Memory Credential Access PARTIAL Sysmon process access events (Event ID 10) targeting lsass.exe are logged. Detection rule exists but has high FP from legitimate tools (wmiprvse.exe, antivirus). comsvcs.dll MiniDump technique IS detected. Mimikatz hash-based detection relies on known hashes only — recompiled variants are missed. 07 T1003.003 OS Credential Dumping: NTDS Credential Access BLIND No detection rule for ntdsutil.exe or volume shadow copy abuse to extract NTDS.dit. No file integrity monitoring on the NTDS.dit file. Sysmon file create events not monitored for .dit extensions in temp directories. 08 T1021.002 Remote Services: SMB/Windows Admin Lateral Movement BLIND Intra-VLAN SMB traffic is allowed without Shares restriction (FW rule I02). No Splunk correlation rule for workstation-to- workstation SMB sessions. Lateral movement via SMB is invisible unless EDR catches the payload post-execution. 09 T1021.001 Remote Services: Remote Desktop Lateral Movement PARTIAL Event ID 4624 Type 10 (RDP) is logged but Protocol not alerted on for intra-VLAN connections. Alerting only triggers for RDP from unexpected VLANs. Workstation-to-workstation RDP within VLAN 20 generates no alert. 10 T1068 Exploitation for Privilege Escalation Privilege Esc. BLIND No detection for exploitation of known vulnerabilities (e.g., EternalBlue, PrintNightmare, local privilege escalation CVEs). Reliance is entirely on patching. If a host misses a patch cycle, exploitation goes undetected until post-compromise activity is observed. 11 T1078.002 Valid Accounts: Domain Accounts Persistence / PARTIAL Impossible travel detection via Azure AD Priv. Escalation works for cloud auth. On-prem AD logon anomaly detection (unusual source IP for user) exists but has 45% FP rate — currently disabled pending tuning. Service account usage from unexpected hosts is not monitored. 12 T1560.001 Archive Collected Data: Archive via Collection BLIND No detection rule for archival tools Utility (7z.exe, rar.exe, zip.exe) creating large archives in temp directories. Sysmon process create events are logged but no correlation rule triggers on archival + large file size + sensitive path combination. 13 T1041 Exfiltration Over C2 Channel Exfiltration PARTIAL Suricata detects large outbound transfers (>100 MB threshold). However, slow-and-low exfiltration under the threshold goes unnoticed. No DLP on endpoints — only email DLP is deployed. Cloud storage uploads not blocked or monitored. 14 T1071.004 Application Layer Protocol: DNS Command & Control PARTIAL Suricata has a DNS tunneling signature (high query volume + large TXT responses). Triggers at >200 queries in 15 minutes. Low-and-slow DNS exfil (1 query/min) would evade this threshold. No DNS query length anomaly detection or entropy analysis. 15 T1070.001 Indicator Removal: Clear Windows Defense Evasion DETECTED Event ID 1102 (security log cleared) is Event Logs forwarded to SIEM and generates immediate HIGH alert. Cannot be suppressed locally because WEF forwards in near-real-time. Tested and confirmed reliable. =============================================================================== COVERAGE SUMMARY =============================================================================== DETECTED: 3 / 15 (20.0%) PARTIAL: 7 / 15 (46.7%) BLIND: 5 / 15 (33.3%) CRITICAL GAPS (BLIND) requiring immediate attention: - T1566.002 Phishing link click correlation - T1003.003 NTDS.dit credential extraction - T1021.002 Lateral movement via SMB - T1068 Exploitation of unpatched vulnerabilities - T1560.001 Data staging via archive utilities HIGH-PRIORITY TUNING (PARTIAL) requiring improvement: - T1566.001 Add sandbox detonation for HTML/URL payloads - T1078.002 Tune and re-enable on-prem logon anomaly detection - T1003.001 Reduce FP rate for LSASS access monitoring - T1041 Lower exfiltration threshold, add endpoint DLP =============================================================================== STUDENT TASKS: 1. Write Sigma or Splunk detection rules for at least 3 BLIND techniques 2. Propose tuning improvements for at least 2 PARTIAL detections 3. Map each gap to the attack observed in soc-alert-feed.txt — which gaps did the attacker exploit? 4. Prioritize remediation: which 3 detection gaps, if closed, would have stopped this attack earliest in the kill chain? ===============================================================================