===============================================================================
  DETECTION COVERAGE ASSESSMENT — GLOBEX CORPORATION
  Assessment Date: 2026-03-01
  Assessed By: SOC Engineering Team
  Framework: MITRE ATT&CK Enterprise v14
  Tooling: Splunk SIEM, Suricata IDS, CrowdStrike Falcon, Sysmon, OSSEC
===============================================================================

COVERAGE LEGEND:
  DETECTED  = Reliable detection rule in production, tested and tuned, <10% FP
  PARTIAL   = Rule exists but high false positive rate, limited log sources,
              or covers only some sub-techniques
  BLIND     = No detection rule, insufficient log data, or no visibility

===============================================================================

#   TECHNIQUE ID   TECHNIQUE NAME                          TACTIC              STATUS     DETAILS
--- -------------- --------------------------------------- ------------------- ---------- ----------------------------------------
01  T1566.001      Phishing: Spearphishing Attachment      Initial Access      PARTIAL    Exchange transport rules flag known-bad
                                                                                          extensions (.exe, .scr, .js). HTML smuggling
                                                                                          and .html attachments NOT blocked. No
                                                                                          sandbox detonation for URL payloads.
                                                                                          Gap: credential harvesting via HTML lure
                                                                                          pages is undetected at the gateway.

02  T1566.002      Phishing: Spearphishing Link            Initial Access      BLIND      Proxy logs capture URL clicks but no
                                                                                          automated correlation between email
                                                                                          receipt and URL click. No real-time
                                                                                          alerting on user visiting newly-registered
                                                                                          domains from email links. Reputation
                                                                                          checking is post-hoc only.

03  T1059.001      Command & Scripting: PowerShell         Execution           DETECTED   Sysmon Event ID 1 + CrowdStrike detect
                                                                                          encoded PowerShell commands reliably.
                                                                                          Script block logging (Event ID 4104)
                                                                                          enabled on all workstations. Tuned with
                                                                                          known-good admin script whitelist.

04  T1071.001      Application Layer Protocol: Web         Command & Control   PARTIAL    Suricata has JA3/JA3S signatures for known
                                                                                          C2 frameworks (CobaltStrike, Metasploit).
                                                                                          However, no SSL decryption means encrypted
                                                                                          C2 channels with custom profiles evade
                                                                                          detection. Beacon timing analysis not
                                                                                          implemented.

05  T1046          Network Service Scanning                Discovery           DETECTED   Suricata threshold rule fires on >50
                                                                                          connection attempts in 60 seconds from
                                                                                          single source. Also detected by firewall
                                                                                          deny log correlation in Splunk. Low FP
                                                                                          rate after excluding vulnerability scanners.

06  T1003.001      OS Credential Dumping: LSASS Memory     Credential Access   PARTIAL    Sysmon process access events (Event ID 10)
                                                                                          targeting lsass.exe are logged. Detection
                                                                                          rule exists but has high FP from legitimate
                                                                                          tools (wmiprvse.exe, antivirus). comsvcs.dll
                                                                                          MiniDump technique IS detected. Mimikatz
                                                                                          hash-based detection relies on known hashes
                                                                                          only — recompiled variants are missed.

07  T1003.003      OS Credential Dumping: NTDS             Credential Access   BLIND      No detection rule for ntdsutil.exe or
                                                                                          volume shadow copy abuse to extract
                                                                                          NTDS.dit. No file integrity monitoring on
                                                                                          the NTDS.dit file. Sysmon file create
                                                                                          events not monitored for .dit extensions
                                                                                          in temp directories.

08  T1021.002      Remote Services: SMB/Windows Admin      Lateral Movement    BLIND      Intra-VLAN SMB traffic is allowed without
                   Shares                                                                 restriction (FW rule I02). No Splunk
                                                                                          correlation rule for workstation-to-
                                                                                          workstation SMB sessions. Lateral movement
                                                                                          via SMB is invisible unless EDR catches
                                                                                          the payload post-execution.

09  T1021.001      Remote Services: Remote Desktop         Lateral Movement    PARTIAL    Event ID 4624 Type 10 (RDP) is logged but
                   Protocol                                                               not alerted on for intra-VLAN connections.
                                                                                          Alerting only triggers for RDP from
                                                                                          unexpected VLANs. Workstation-to-workstation
                                                                                          RDP within VLAN 20 generates no alert.

10  T1068          Exploitation for Privilege Escalation    Privilege Esc.      BLIND      No detection for exploitation of known
                                                                                          vulnerabilities (e.g., EternalBlue, PrintNightmare,
                                                                                          local privilege escalation CVEs). Reliance
                                                                                          is entirely on patching. If a host misses
                                                                                          a patch cycle, exploitation goes undetected
                                                                                          until post-compromise activity is observed.

11  T1078.002      Valid Accounts: Domain Accounts         Persistence /       PARTIAL    Impossible travel detection via Azure AD
                                                           Priv. Escalation               works for cloud auth. On-prem AD logon
                                                                                          anomaly detection (unusual source IP for
                                                                                          user) exists but has 45% FP rate — currently
                                                                                          disabled pending tuning. Service account
                                                                                          usage from unexpected hosts is not monitored.

12  T1560.001      Archive Collected Data: Archive via     Collection          BLIND      No detection rule for archival tools
                   Utility                                                                (7z.exe, rar.exe, zip.exe) creating large
                                                                                          archives in temp directories. Sysmon
                                                                                          process create events are logged but no
                                                                                          correlation rule triggers on archival +
                                                                                          large file size + sensitive path combination.

13  T1041          Exfiltration Over C2 Channel            Exfiltration        PARTIAL    Suricata detects large outbound transfers
                                                                                          (>100 MB threshold). However, slow-and-low
                                                                                          exfiltration under the threshold goes
                                                                                          unnoticed. No DLP on endpoints — only
                                                                                          email DLP is deployed. Cloud storage
                                                                                          uploads not blocked or monitored.

14  T1071.004      Application Layer Protocol: DNS         Command & Control   PARTIAL    Suricata has a DNS tunneling signature
                                                                                          (high query volume + large TXT responses).
                                                                                          Triggers at >200 queries in 15 minutes.
                                                                                          Low-and-slow DNS exfil (1 query/min) would
                                                                                          evade this threshold. No DNS query length
                                                                                          anomaly detection or entropy analysis.

15  T1070.001      Indicator Removal: Clear Windows        Defense Evasion     DETECTED   Event ID 1102 (security log cleared) is
                   Event Logs                                                             forwarded to SIEM and generates immediate
                                                                                          HIGH alert. Cannot be suppressed locally
                                                                                          because WEF forwards in near-real-time.
                                                                                          Tested and confirmed reliable.


===============================================================================
  COVERAGE SUMMARY
===============================================================================

  DETECTED:   3 / 15  (20.0%)
  PARTIAL:    7 / 15  (46.7%)
  BLIND:      5 / 15  (33.3%)

  CRITICAL GAPS (BLIND) requiring immediate attention:
    - T1566.002  Phishing link click correlation
    - T1003.003  NTDS.dit credential extraction
    - T1021.002  Lateral movement via SMB
    - T1068     Exploitation of unpatched vulnerabilities
    - T1560.001  Data staging via archive utilities

  HIGH-PRIORITY TUNING (PARTIAL) requiring improvement:
    - T1566.001  Add sandbox detonation for HTML/URL payloads
    - T1078.002  Tune and re-enable on-prem logon anomaly detection
    - T1003.001  Reduce FP rate for LSASS access monitoring
    - T1041     Lower exfiltration threshold, add endpoint DLP

===============================================================================
  STUDENT TASKS:
  1. Write Sigma or Splunk detection rules for at least 3 BLIND techniques
  2. Propose tuning improvements for at least 2 PARTIAL detections
  3. Map each gap to the attack observed in soc-alert-feed.txt — which
     gaps did the attacker exploit?
  4. Prioritize remediation: which 3 detection gaps, if closed, would have
     stopped this attack earliest in the kill chain?
===============================================================================
