DeTT&CT — ATT&CK Coverage Heatmap and Gap Analysis

Coverage is not binary. Having a rule is not the same as having detection. DeTT&CT makes the distinction measurable and visible.

The DeTT&CT Data Model

DeTT&CT uses two YAML files to represent your detection program:

data-sources.yaml — documents your telemetry:

- data_source_name: process_creation
  available_for_data_analytics: true
  date_registered: 2026-01-15
  date_connected: 2026-01-20
  products:
    - Sysmon
  data_quality:
    device_completeness: 4      # 80%+ of assets covered
    data_field_completeness: 4  # Most relevant fields present
    timeliness: 5               # Near-real-time ingestion
    consistency: 4              # Consistent across assets
    retention: 4                # 1 year retention

techniques.yaml — documents your detection coverage:

- technique_id: T1003.001
  technique_name: OS Credential Dumping: LSASS Memory
  detection:
    - applicable_to:
        - windows
      date_implemented: 2026-03-10
      score_logbook:
        - date: 2026-03-10
          score: 2
          comment: Initial rule, not tested
        - date: 2026-04-15
          score: 4
          comment: Emulation-validated with Atomic Red Team T1003.001
      visibility:
        applicable_to:
          - windows
        score: 5
        comment: Sysmon Event 10 (ProcessAccess) covers LSASS access

Running DeTT&CT

# Install
pip install dettect

# Generate data source heatmap
python dettect.py ds -fd data-sources.yaml -l -t sysmon

# Generate visibility heatmap
python dettect.py v -fd data-sources.yaml -t sysmon

# Generate detection coverage heatmap
python dettect.py d -fd techniques.yaml

# Generate ATT&CK Navigator layer for all three
python dettect.py edr -fd data-sources.yaml techniques.yaml

Output: JSON files compatible with ATT&CK Navigator for visualization.

Reading a Coverage Heatmap

ATT&CK Navigator — Detection Coverage Layer
Color interpretation:
  ■ Dark green (score 4–5): emulation-validated, well-tuned
  ■ Light green (score 3): tested with fixture, not emulation-validated
  ■ Yellow (score 1–2): rule exists, low quality or untested
  ■ Gray: no rule (visibility exists — opportunity)
  ■ Red: no rule, no visibility (telemetry gap)

Example output for Credential Access tactic:
  T1003.001 LSASS Memory:        Dark green (score 4)
  T1003.002 Security Account Manager: Yellow (score 2 — untested rule)
  T1003.004 LSA Secrets:         Gray (logged but no rule)
  T1558.003 Kerberoasting:       Light green (score 3)
  T1110.003 Password Spraying:   Dark green (score 4)
  T1555.003 Browser Credentials: Red (no telemetry — Sysmon doesn't log browser storage reads)

Gap Prioritization Workflow

Not all gaps are equal. Prioritize using this matrix:

For each gap (undetected technique):

  Impact score (1–5):
    1 = rare technique, low blast radius
    3 = moderately common, medium data risk
    5 = frequently used by APTs targeting your sector, high business impact

  Effort score (1–5):
    1 = existing telemetry, 1 day to write rule
    3 = telemetry exists but needs tuning, 1 week
    5 = requires new log source deployment, 1 month+

  Gap score = Impact / Effort  (prioritize highest first)

Example:
  T1003.004 LSA Secrets: Impact 4, Effort 2 → score 2.0 → HIGH PRIORITY
  T1555.003 Browser creds: Impact 3, Effort 5 → score 0.6 → LOW PRIORITY (needs new telemetry)
  T1547.001 Registry Run key: Impact 3, Effort 1 → score 3.0 → IMMEDIATE

Quarterly Coverage Review Process

Month 1: Emulation cycle
  - Run Atomic Red Team for 5 priority techniques
  - Update DeTT&CT YAML with emulation results
  - Close discovered gaps

Month 2: Gap analysis
  - Run DeTT&CT heatmap vs. previous quarter
  - Calculate delta: coverage % before vs. after
  - Identify top 10 gaps by impact/effort score

Month 3: Roadmap planning
  - Present heatmap delta to CISO/leadership
  - Commit to closing top 5 gaps next quarter
  - Update threat model with new CTI inputs

Communicating Coverage to Leadership

The ATT&CK heatmap is the most effective visual for communicating detection program status to non-technical leadership:

## Detection Coverage Q2 2026 Report

**Overall coverage:** 52% of relevant techniques (up from 41% in Q1)
**Techniques added this quarter:** 14 new detections
**Quality improvements:** 8 rules upgraded from score 2 → score 4 via emulation

### Critical gaps (impact 4–5, effort 1–2):
1. T1547.001 Registry Run Keys: rule exists but untested (score 2 → target score 4 by July)
2. T1059.005 Visual Basic: no rule, telemetry available (score 0 → target score 3 by August)

### Blind spots (telemetry gaps requiring investment):
1. T1555.003 Browser credential theft: requires endpoint telemetry not currently deployed
   → Estimated effort: 3 weeks, 1 engineer. Recommendation: prioritize for Q3.