◇ OpenCyber Academy
Technical · Chapter 14 · English

Chapter 14 — Coverage with ATT&CK and D3FEND

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 14 — Coverage with ATT&CK and D3FEND

Lesson map

Lesson 14 published. Map, example, EX053.

flowchart TD
  N0["Learning outcomes"]
  N1["14.1 Mapping"]
  N2["14.2 Gaps"]
  N3["14.3 Prioritising"]
  N4["14.4 D3FEND"]
  N5["14.5 Coverage is not quality"]
  N6["14.6 Data first"]
  N7["Presenting coverage"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX053"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["14.1 Mapping"]
  N2["14.2 Gaps"]
  N3["14.3 Prioritising"]
  N4["14.4 D3FEND"]
  N5["14.5 Coverage is not quality"]
  N6["14.6 Data first"]
  N7["Presenting coverage"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX053"]

[Learning outcomes]
    |
    v
[14.1 Mapping]
    |
    v
[14.2 Gaps]
    |
    v
[14.3 Prioritising]
    |
    v
[14.4 D3FEND]
    |
    v
[14.5 Coverage is not quality]
    |
    v
[14.6 Data first]
    |
    v
[Presenting coverage]
    |
    v
[Worked example] --> [Exercise EX053]

Learning outcomes

You will (1) map detections to ATT&CK techniques; (2) identify gaps in coverage; (3) use D3FEND to describe defensive techniques; (4) prioritise new detection work.

14.1 Mapping

Each rule is tagged with the ATT&CK techniques it detects. A coverage map shows which techniques have rules and which do not. For Carlos's new rule, the tag is the brute-force technique, matching the parks01 case. Each tag lets the map show that this technique now has a tested rule. Tags also help when intelligence warns about a technique, since the SOC can quickly see whether any rule covers it. Rules without a tag are listed separately so they are not forgotten.

14.2 Gaps

Northgate's map shows good coverage of initial access by phishing and credential guessing, but little for data moved to cloud storage. Good coverage of phishing and guessing reflects the cases Northgate has handled, including the finance phishing and parks01. The gap around cloud storage means data could be copied out without any alert. Seeing the gap on a map makes it easier to explain to managers why new data sources are needed. The map is updated whenever a rule is added, changed or retired. Gaps are listed with the data source each one would need.

14.3 Prioritising

Gaps are ranked by how likely the technique is against councils (from intelligence) and how damaging. Data exfiltration from file shares ranks high. Exfiltration from file shares ranks high partly because the parks01 outsider spent six minutes listing share folders. Had they downloaded files, no rule would have flagged the volume. Ranking by likelihood and damage helps a four-analyst team choose which gaps to close first. The ranking is reviewed each quarter, when new intelligence from the sharing group may move a technique up or down.

14.4 D3FEND

MITRE D3FEND (Kaloroumakis and Smith, 2021) is a knowledge graph of defensive techniques, linked to ATT&CK. It helps describe what a control does, such as "user behaviour analysis" or "network traffic analysis". Using D3FEND terms lets Carlos describe the new detections consistently, for example mass file reads as user behaviour analysis. Managers and other councils can then compare controls without reading each rule's logic. D3FEND describes what a control does in general, not whether it actually works at Northgate.

14.5 Coverage is not quality

A tagged rule may be noisy, untested or blind on some systems. Northgate marks each mapping as tested or untested. A technique tag shows what a rule is meant to catch, not proof that it does. Marking each mapping as tested shows which rules have been checked against data, as Carlos's rule was with the Monday log. An untested rule may never fire, and a coverage map that hides this would give false comfort to the risk committee. Untested mappings are scheduled for testing in the quarterly rule review. Until then they are shown in a different colour on the table.

14.6 Data first

Some gaps exist because data is missing; the cloud storage gap needs proxy logs with upload sizes. Without upload sizes, no rule can tell a large upload to personal cloud storage from ordinary browsing. Collecting that data comes before writing the rule, so the first approved detection depends on a proxy change. Carlos records this data dependency on the coverage table beside the cloud storage gap. IT owns the proxy change, and Carlos tracks it as a dependency for the new rule. Until it is done, the cloud storage gap stays open on the map.

Presenting coverage

Carlos shows the map as a table rather than a colourful heat map, listing for each technique the rule names, whether they were tested, and the data sources used. Managers find the table harder to misread: a green cell on a heat map can suggest full protection when the only rule is untested. The table also makes clear which gaps are due to missing data and which need new rules.

Worked example

Carlos proposes three new detections: large uploads to personal cloud storage, mass file reads on the file share by one account, and new mail forwarding rules. Aisha approves the first two for this quarter.

Synthetic case. Coverage values are invented.

Errors and limits

ATT&CK coverage maps can look reassuring while hiding untested rules.

Exercises

Synthesis

Map coverage honestly, find gaps, and fix data before rules.

Continue studying — chapter 14 of 18

← Chapter 13 (draft) · Course chapter index · Chapter 15 (draft) →