MITRE ATT&CK Coverage Gap Analysis¶

Analysis Date: March 2026 | ATT&CK Version: Enterprise v14 | Nexus SecOps Coverage Baseline: 50 Chapters, 16 Sigma Rules, 48 Detection Queries, 15 YARA Rules, 50 Purple Team Exercises

Executive Summary¶

Nexus SecOps currently covers 97 unique ATT&CK techniques across the 14 Enterprise tactics, out of approximately 201 top-level techniques in MITRE ATT&CK Enterprise v14. This yields an overall technique coverage rate of approximately 48%.

Coverage is strongest in the Execution (TA0002), Credential Access (TA0006), Persistence (TA0003), and Impact (TA0040) tactics, where detection rules, hunt hypotheses, and lab exercises provide layered coverage. Coverage is weakest in Reconnaissance (TA0043), Resource Development (TA0042), Collection (TA0009), and Exfiltration (TA0010), where many techniques lack production detection rules.

Coverage by Tactic¶

TA0043 — Reconnaissance¶

Priority: Low. Reconnaissance techniques occur before the organization's detection boundary. Ch19 and Ch42 cover OSINT methodology. Remaining gaps are pre-attack techniques with minimal detection surface.

TA0042 — Resource Development¶

Priority: Low-Medium. Resource Development occurs in adversary infrastructure. T1608 (Stage Capabilities) is relevant for CTI teams analyzing phishing infrastructure. T1650 (Acquire Access via IABs) is highly relevant to the ransomware chapter and should be added to Ch23.

TA0001 — Initial Access¶

Priority: Medium. T1199 (Trusted Relationship) is used by APT groups (Cloud Hopper) and MSP compromises. Recommend adding detection content to Ch24 or Ch33.

TA0002 — Execution¶

Priority: Medium. Container execution techniques (T1609, T1610) are increasingly relevant as organizations adopt Kubernetes. T1559 (IPC/DDE) has a purple team exercise but needs detection rules. T1651 (Cloud Admin Command, e.g., AWS SSM RunCommand) is a growing attack vector.

TA0003 — Persistence¶

Priority: High. T1556 (Modify Authentication Process) covers Skeleton Key, SSP injection, and hybrid identity attacks — critical for AD and cloud environments. T1197 (BITS Jobs) is a common persistence and download mechanism. T1037 (Logon Scripts) is frequently abused in AD environments.

Recommendation: Add T1556 content to Ch33 or Ch45. Add T1197 (BITS Jobs) detection to Ch05 and Sigma Rule Library.

TA0004 — Privilege Escalation¶

Priority: Medium. T1611 (Escape to Host / container escape) is the most critical gap — container escapes are a top cloud security concern. Recommend adding detection content for container escape indicators (e.g., nsenter, chroot, /proc/1/root access) to Ch46 and detection query library.

TA0005 — Defense Evasion¶

This is the largest tactic in ATT&CK and has the lowest coverage percentage. Defense Evasion contains 42 top-level techniques; Nexus SecOps covers only 8.

Priority: HIGH. Defense Evasion is the largest tactic and represents the most significant coverage gap. Top priorities:

1. T1112 (Modify Registry) — foundational Windows persistence/evasion, pairs with existing registry monitoring
2. T1564 (Hide Artifacts) — hidden files, hidden windows, NTFS ADS, hidden users
3. T1553 (Subvert Trust Controls) — code signing abuse, SIP/Trust Provider hijacking
4. T1207 (Rogue Domain Controller / DCShadow) — critical AD attack, complements Ch45
5. T1578 (Modify Cloud Compute Infrastructure) — snapshot, image, and instance modification for evasion

TA0006 — Credential Access¶

Priority: High. T1621 (MFA Fatigue/Bombing) is a critical modern technique used in Uber, Cisco, and Microsoft breaches. T1539 (Steal Web Session Cookie) is increasingly used in AiTM phishing attacks. T1649 (ADCS abuse) is referenced in Ch45 but needs dedicated detection content.

Recommendation: Add T1621 (MFA Fatigue) content to Ch33. Add T1539 and T1528 to Ch33 or a new identity attack detection section.

TA0007 — Discovery¶

Priority: Medium. Many Discovery techniques are high-volume/low-fidelity (process listing, registry queries). Prioritize T1016 (System Network Configuration) and T1049 (Network Connections) as these are commonly seen in early-stage post-exploitation and can be correlated with other suspicious activity. Cloud discovery gaps (T1526, T1619) should be addressed in Ch46.

TA0008 — Lateral Movement¶

Priority: Medium. T1534 (Internal Spearphishing) is used by sophisticated actors post-compromise to move laterally via email within the organization. T1563 (Session Hijacking) has a purple team exercise but needs detection rules for RDP hijacking indicators.

TA0009 — Collection¶

Priority: Medium. T1560 (Archive Collected Data) is a near-universal pre-exfiltration step (rar, 7z, zip of staged data) and is highly detectable. T1115 (Clipboard Data) is used by info stealers. T1185 (Browser Session Hijacking) is relevant to modern AiTM attacks.

Recommendation: Add T1560 detection (archive creation in unusual directories) to Detection Query Library. Add T1115 and T1185 content to Ch26 or Ch33.

TA0010 — Exfiltration¶

Priority: Low-Medium. Most critical exfiltration vectors (C2, DNS, cloud) are well covered. Physical medium and automated exfiltration have purple team exercises but lack production detection rules.

TA0011 — Command and Control¶

Priority: Medium. T1105 (Ingress Tool Transfer) is extremely common — nearly every intrusion involves downloading tools. T1568 (Dynamic Resolution / DGA) is critical for botnet and advanced malware detection. T1219 (Remote Access Software like AnyDesk, TeamViewer) is increasingly abused by ransomware operators and has a YARA rule but needs detection queries.

Recommendation: Add T1568 (DGA detection) and T1219 (unauthorized remote access tools) to Detection Query Library. Add T1105 as a standalone detection (large downloads from suspicious sources).

TA0040 — Impact¶

Priority: Medium-High. T1496 (Resource Hijacking / cryptojacking) already has an IR playbook at Cryptojacking Playbook but lacks detection rules. T1489 (Service Stop) is a ransomware precursor (stopping databases, security tools before encryption). T1531 (Account Access Removal) is common in destructive attacks. T1565 (Data Manipulation / integrity attacks) is increasingly relevant for financial and healthcare sectors.

Top 20 Missing Techniques¶

The following 20 techniques represent the highest-priority coverage gaps, ranked by real-world prevalence, relevance to the Nexus SecOps audience, and feasibility of adding content.

Recommendations¶

Immediate Actions (Next 1-2 Sessions)¶

Medium-Term Actions (Next 3-5 Sessions)¶

Long-Term Vision¶

Coverage Heatmap Summary Table¶

Related Resources¶

• ATT&CK Coverage Heatmap — Interactive visual coverage map
• Detection Query Library — Production KQL and SPL queries
• Sigma Rule Library — SIEM-agnostic detection rules
• YARA Rule Library — File and memory scanning rules
• Threat Hunt Hypotheses — Hypothesis-driven hunting library
• Purple Team Exercise Library — 50 adversary emulation exercises
• ATT&CK Cheat Sheet — Quick reference for ATT&CK framework

97 techniques covered across 14 tactics | 104 techniques identified as gaps | Analysis based on ATT&CK Enterprise v14 | Last updated: March 2026