Skip to content

Reference library

Every technique, answered.

All 918 techniques in ATT&CK, each with one of three answers. Not every technique can be detected from logs, and saying so plainly is more useful than shipping a rule that never fires — so “we deliberately did not write this, and here is why” counts as covered ground here, not as a gap.

404Detection writtenA Sigma rule exists. Unverified, like everything here.
125No distinct observableA reviewer read the telemetry and found nothing a sibling technique does not already cover. The reason is on the page.
389Not expressible in SigmaMobile, ICS, abstract data sources and API-hook telemetry. Sigma has no logsource for these.

Initial Access

14 written · 7 declined · 24 out of reach

Execution

43 written · 11 declined · 25 out of reach

Persistence

76 written · 24 declined · 33 out of reach

Privilege Escalation

64 written · 25 declined · 14 out of reach

Stealth

109 written · 34 declined · 5 out of reach

Defense Impairment

30 written · 6 declined · 20 out of reach

Credential Access

41 written · 18 declined · 18 out of reach

Discovery

41 written · 2 declined · 27 out of reach

Lateral Movement

16 written · 4 declined · 16 out of reach

Collection

28 written · 3 declined · 45 out of reach

Command and Control

27 written · 18 declined · 20 out of reach

Exfiltration

10 written · 7 declined · 5 out of reach

Impact

20 written · 10 declined · 26 out of reach

Structurally out of reach

Nothing written for these 6, and why.

Not a backlog. Two different reasons, and neither is fixed by writing more rules.

  • Reconnaissance and Resource Development happen before the attacker touches you, on infrastructure they own. There is no event on your estate to write a rule against.
  • Mobile and ICS — the remaining four — have no Sigma logsource taxonomy at all, so there is no field name a rule could reference. That is why the authorable ceiling here is 529 techniques and not 918.

Reconnaissance

0 written · 0 declined · 46 out of reach

Resource Development

0 written · 0 declined · 50 out of reach

Defense Evasion

0 written · 0 declined · 33 out of reach

Evasion

0 written · 0 declined · 9 out of reach

Inhibit Response Function

0 written · 0 declined · 20 out of reach

Impair Process Control

0 written · 0 declined · 8 out of reach

Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.