Build a coverage map you would defend in a review

applied · 90 min · Objective 3.1

Task

Produce a technique coverage map for your lab where every green cell is backed by a test that actually fired, and every gap is weighted by whether it matters here. Objective 3.1 is attack methodology frameworks, and the map is what they are for.

Steps

  1. Choose fifteen techniques plausible in an estate like your lab, spread across at least five tactics -- initial access, execution, persistence, credential access, discovery, lateral movement, collection, exfiltration.
  2. For each, record what you believe the coverage is before testing. Keep that column; the comparison at the end is the most instructive part.
  3. Emulate each one, once, with built-in tooling. Revert to the clean snapshot between rounds so the estate does not accumulate.
  4. For each, record the real outcome in three states: a rule alerted, the evidence is in the logs but nothing alerted, or there is no trace at all.
  5. Compare the believed column against the tested column and count the disagreements. Note their direction -- believed-covered-but-not is the dangerous one.
  6. Weight the gaps: for each invisible technique, how likely is it against an estate like this, and what would it cost to see it?
  7. Write the three deliverables: the map, the prioritised gap list, and the list of rules that fired on test with the date.

Verify

awk -F'\t' '$3=="alerted"' /tmp/coverage.tsv | wc -l
awk -F'\t' '$3=="logged"' /tmp/coverage.tsv | wc -l
awk -F'\t' '$3=="invisible"' /tmp/coverage.tsv | wc -l
awk -F'\t' '$2!=$3' /tmp/coverage.tsv | wc -l
awk -F'\t' '$2=="alerted" && $3!="alerted"' /tmp/coverage.tsv | wc -l

The three state counts must sum to fifteen. The fourth is how often your belief was wrong, and the fifth is the subset that was wrong in the dangerous direction -- you thought you would detect it and you would not. That last number is the reason this exercise is done by testing rather than by discussion.

Notes

Colour only what fired. A cell green because the log source could support a detection is the single error that produces most of the impressively green matrices in circulation, and it is invisible to everyone reading the map.

The "logged but not alerted" column is your cheapest improvement list: the telemetry already exists and a rule is the only missing part.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.