Map your own logs to techniques, then colour the gaps

short · 50 min · Objective 3.1

Task

Take the intrusion you staged in the Domain 1 applied lab, map every action to a technique, and then build the coverage picture -- which of those techniques you detect, which you merely log, and which left no trace at all.

Steps

  1. Open the timeline from your staged intrusion. For each row, write the tactic (what the attacker was trying to achieve) and the technique (how).
  2. Where a row maps to more than one technique, record both rather than picking one. Where it maps to none cleanly, write "unclear" -- a legitimate entry, and better than false precision.
  3. Now go the other way. For each technique you listed, ask what usually accompanies it, and search your logs for those. This is the framework earning its keep: it turns one observation into a list of things to look for.
  4. For any technique you expected and did not find, emulate it once with a built-in command, then search again. This separates "it did not happen" from "I cannot see it".
  5. Build the three-state coverage table: detected (a rule fires), logged only (the evidence exists, nothing alerts), invisible (no trace at all).
  6. Count the rows in each state, and weight them: which invisible techniques would actually matter in an estate like yours?

Verify

grep -icE "useradd|net user .* /add" /var/log/collected/*.log
grep -icE "schtasks|New-ScheduledTask|crontab -" /var/log/collected/*.log
grep -icE "whoami|net group|systeminfo" /var/log/collected/*.log
grep -icE "encodedcommand|[[:space:]]-enc[[:space:]]" /var/log/collected/*.log

Four techniques, four counts: account creation, scheduled task persistence, discovery, and encoded execution. After step 4 every one of these must be non-zero. A zero here after you have deliberately run the technique is not a clean estate -- it is a telemetry gap, and that is the finding.

Notes

The table's "logged only" rows are the cheapest security improvement available: the evidence is already being collected and a rule is the only thing missing.

Do not colour the matrix from your log sources. Having the telemetry that could detect something is not detecting it, and that single error produces most of the impressively green coverage matrices in circulation.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.