Why ATT&CK Technique Coverage Is Not Detection Coverage

A technique is larger than any one detection

An ATT&CK technique groups related adversary behavior. It can span operating systems, identity types, procedures, and evidence paths. A rule that recognizes one command pattern on Windows therefore cannot inherit the full scope of the technique label attached to it.

The mapping is still useful. It says the analytic is relevant to behavior described by the framework and helps reviewers find related knowledge. The error begins when relevance is displayed as local capability without the scope that connects them.

Think of coverage as a sentence, not a colored square. Name the behavior variation, environment, population, observation point, analytic version, test evidence, dependency state, consumer, and known gap. A smaller statement that can be defended is more useful than a broad statement nobody can verify.

Separate mapping, implementation, validation, and health

A mapping connects content to threat knowledge. An implementation expresses logic in a local system. Validation supplies evidence that representative behavior reached the intended result. Health shows whether the dependencies that supported that result are working now.

These states can diverge. A repository may contain a mapped rule that is not deployed. A deployed rule may never have been tested against local telemetry. A validated rule may later lose a required field while continuing to execute successfully. A dashboard that compresses all four states into covered hides the difference the consumer most needs.

The current ATT&CK model of Detection Strategies and Analytics can sharpen the threat side of this reasoning. It cannot supply the local implementation and assurance evidence for you.

Use coverage states that admit uncertainty

A practical model distinguishes tested, partial, unknown, degraded, and absent capability. Tested means named variations produced the expected result under recorded conditions. Partial means a useful part of the behavior is supported while named paths remain outside scope. Unknown means content or telemetry exists without enough assurance. Degraded means a required dependency no longer supports the previous claim.

These words require evidence. “Tested” should point to the scenario, source, version, expected result, actual result, and date. “Partial” should name the boundary. “Degraded” should identify the failed dependency and affected population.

Do not convert absence of alerts into evidence of absence. Quiet can mean no adversary behavior, effective prevention, broken observation, overly narrow logic, or failed delivery. Coverage state must be informed by health rather than alert volume alone.

Represent variation and overlap without double counting

Several analytics may map to one technique because they observe different platforms or paths. One analytic may map to several techniques because the evidence is relevant to multiple behaviors. Counting mappings rewards fragmentation and creates the appearance that quantity equals defense.

Describe coverage by behavior and decision. Two rules that both detect the same PowerShell string do not provide two independent capabilities. An endpoint event and an identity audit event that observe different parts of a takeover path may be complementary even if they share a technique mapping.

Track dependency overlap as well. Ten analytics relying on one audit feed can lose confidence together. A portfolio view should show common observation points, parsers, entity services, and delivery routes so a single failure does not leave ten green squares.

Make the claim useful to a decision maker

A coverage statement should help someone decide whether to invest, accept risk, investigate, or respond. State what can currently be observed, how soon, with which evidence, and what action the result can support. Then state what remains outside scope.

For example: “Version 3 detects tested interactive consent grants followed by mail access for production users in the primary tenant when identity and mail audit feeds meet their latency thresholds. Administrator bulk grants and workload identities are outside scope. The result supports analyst review, not automatic revocation.”

That sentence can survive honest change. A failed feed moves it to degraded. A test for administrator grants expands it. A new tenant requires separate assurance. Coverage becomes a maintained intelligence judgment about capability, not permanent paint on a framework matrix.