Basic Detection Rules by MITRE ATT&CK TTP

Unified Atlas: research and illustrated explanations · operational families · model catalog · telemetry contracts · validation boundaries. A taxonomy reference is not proof of a configured sensor or an effective detector.

This catalog provides vendor-neutral algorithmic logic for basic deterministic detection rules mapped to MITRE ATT&CK Enterprise techniques and sub-techniques. Rules use signatures, fixed thresholds, allowlists, denylists, state changes, and bounded-window correlations. They do not depend on learned baselines or statistical anomaly models.

Each rule is a starting point. Exact thresholds, approved lists, paths, ports, identities, and time windows must be adapted to the environment. Inline links point to log-source definitions capable of supplying the required events.

Rule Logic Conventions

• MATCH: exact, substring, regular-expression, category, or field match.
• COUNT: number of matching events grouped by an entity within a fixed time window.
• DISTINCT_COUNT: number of unique values observed within a fixed time window.
• SEQUENCE: ordered events correlated by entity within a fixed time window.
• STATE_CHANGE: a protected setting, object, permission, or resource changes from an approved state.
• NOT_IN: value is absent from an explicit approved list.
• MISSING: an expected heartbeat or event is absent for a fixed duration.
• SUM: aggregate of a numeric field grouped by an entity within a fixed time window.
• FOLLOWED_BY: an ordered two-event correlation where event B occurs after event A within a fixed time window, correlated by entity. Equivalent to a two-step SEQUENCE.
• ALERT: emit a detection with the matched evidence.

Reconnaissance

ATT&CK TTP	Basic algorithmic detection logic	Relevant log sources
T1595 Active Scanning · simulation · detections	COUNT(denied_or_failed_connections BY source_ip, 5m) >= threshold AND DISTINCT_COUNT(destination_port OR destination_host) >= threshold -> ALERT	Network Firewall Logs, Network Flow Logs, Network Intrusion Detection Logs
T1595.002 Vulnerability Scanning · simulation · detections	MATCH(scanner_signature OR known_scanner_user_agent OR vulnerability_probe_path) AND source_ip NOT_IN approved_scanners -> ALERT	Web Application Firewall Logs, Web Server Access Logs, Network Intrusion Detection Logs
T1595.003 Wordlist Scanning · simulation · detections	COUNT(http_status IN [404, 403] BY source_ip, 5m) >= threshold AND DISTINCT_COUNT(uri_path) >= threshold -> ALERT	Web Server Access Logs, Web Application Firewall Logs, API Gateway Logs
T1590 Gather Victim Network Information · simulation · detections	MATCH(dns_zone_transfer_request OR repeated_public_dns_enumeration) AND source_ip NOT_IN approved_dns_admins -> ALERT	Authoritative DNS Logs, Network Intrusion Detection Logs

Resource Development

Most resource-development TTPs occur outside defender-controlled systems and lack reliable deterministic internal detection. Detection generally begins when staged infrastructure or content interacts with the environment.

ATT&CK TTP	Basic algorithmic detection logic	Relevant log sources
T1583 Acquire Infrastructure · simulation · detections	MATCH(domain OR certificate OR address IN threat_intelligence_denylist) -> ALERT	Threat-Intelligence Platform Logs, DNS Resolver Logs, TLS and Certificate Metadata Logs
T1608 Stage Capabilities · simulation · detections	MATCH(download_hash OR url OR sender IN known_malicious_indicators) -> ALERT	Proxy and Secure Web Gateway Logs, Email Gateway Logs, Content Inspection and Malware Scanning Logs

Initial Access

ATT&CK TTP	Basic algorithmic detection logic	Relevant log sources
T1566.001 Spearphishing Attachment · simulation · detections	MATCH(attachment_extension IN blocked_types OR attachment_hash IN denylist OR sandbox_verdict = malicious) -> ALERT	Email Gateway Logs, Content Inspection and Malware Scanning Logs, Sandbox Analysis Logs
T1566.002 Spearphishing Link · simulation · detections	MATCH(message_url IN denylist OR url_category = malicious) -> ALERT	Email Gateway Logs, Proxy and Secure Web Gateway Logs
T1566.003 Spearphishing via Service · simulation · detections	MATCH(external_message_contains_url_or_attachment) AND sender NOT_IN approved_external_senders -> ALERT	Collaboration Platform Audit Logs, Mailbox Audit Logs
T1190 Exploit Public-Facing Application · simulation · detections	MATCH(waf_exploit_signature OR ids_exploit_signature OR known_exploit_request_pattern) -> ALERT	Web Application Firewall Logs, Network Intrusion Detection Logs, Web Server Access Logs
T1078 Valid Accounts · simulation · detections	MATCH(successful_login) AND source_country IN blocked_countries -> ALERT; COUNT(failed_login BY account, 10m) >= threshold FOLLOWED_BY successful_login WITHIN 10m -> ALERT	Identity Provider Sign-In Logs, Directory-Service Authentication Logs, Remote Access and VPN Authentication Logs
T1133 External Remote Services · simulation · detections	MATCH(successful_remote_access) AND source_ip NOT_IN approved_networks -> ALERT	Remote Access and VPN Authentication Logs, Remote Desktop and Remote Support Logs, Network Firewall Logs
T1195 Supply Chain Compromise · simulation · detections	MATCH(installed_package_hash NOT_IN approved_manifest OR signature_invalid OR publisher NOT_IN approved_publishers) -> ALERT	Package and Software Installation Logs, Application-Control Logs, Artifact Repository Logs

Execution

ATT&CK TTP	Basic algorithmic detection logic	Relevant log sources
T1059 Command and Scripting Interpreter · simulation · detections	MATCH(process_name IN command_interpreters) AND command_line MATCHES suspicious_argument_patterns -> ALERT	Process Execution Logs, Command-Line and Shell History Logs, Script-Execution Logs
T1059.001 PowerShell · simulation · detections	MATCH(powershell_execution) AND command_or_script MATCHES [encoded_command, download_expression, hidden_window, execution_policy_bypass] -> ALERT	Windows PowerShell Logs, Process Execution Logs
T1059.003 Windows Command Shell · simulation · detections	MATCH(process_name IN [cmd.exe, command.com]) AND command_line MATCHES suspicious_command_patterns -> ALERT	Process Execution Logs, Windows Security Event Logs
T1059.004 Unix Shell · simulation · detections	MATCH(shell_execution) AND command_line MATCHES suspicious_command_patterns -> ALERT	Linux Audit Logs, Linux Shell History, Process Execution Logs
T1059.005 Visual Basic · simulation · detections	MATCH(process_name IN [cscript.exe, wscript.exe]) AND script_path NOT_IN approved_script_paths -> ALERT	Process Execution Logs, Script-Execution Logs
T1059.006 Python · simulation · detections	MATCH(python_execution) AND script_path OR parent_process NOT_IN approved_list -> ALERT	Process Execution Logs, Linux Audit Logs
T1059.007 JavaScript · simulation · detections	MATCH(script_host_execution) AND script_path IN temporary_or_user_writable_paths -> ALERT	Process Execution Logs, Script-Execution Logs
T1204 User Execution · simulation · detections	SEQUENCE(file_download_or_attachment_open, process_execution FROM downloaded_file) WITHIN 5m -> ALERT	File-System Activity Logs, Process Execution Logs, Email Gateway Logs
T1203 Exploitation for Client Execution · simulation · detections	MATCH(exploit_mitigation_block OR application_crash_signature) FOLLOWED_BY child_process_creation WITHIN 2m -> ALERT	Memory-Protection and Exploit-Mitigation Logs, Operating-System Crash and Diagnostic Logs, Process Execution Logs
T1218 System Binary Proxy Execution · simulation · detections	MATCH(process_name IN proxy_execution_binaries) AND command_line MATCHES known_abuse_patterns -> ALERT	Process Execution Logs, Application-Control Logs
T1047 Windows Management Instrumentation · simulation · detections	MATCH(wmi_process_or_remote_operation) AND caller_or_command NOT_IN approved_wmi_activity -> ALERT	Windows Remote Management Logs, Process Execution Logs, Windows Security Event Logs
T1053 Scheduled Task/Job · simulation · detections	MATCH(task_created_or_modified) AND task_action NOT_IN approved_task_actions -> ALERT	Scheduled Task and Job Logs, Windows Task Scheduler Logs
T1609 Container Administration Command · simulation · detections	MATCH(orchestrator_request_subresource = exec) AND actor NOT_IN approved_container_admins -> ALERT	Orchestrator Audit Logs, Container Runtime Logs

Persistence

ATT&CK TTP	Basic algorithmic detection logic	Relevant log sources
T1136 Create Account · simulation · detections	MATCH(account_created) AND creator NOT_IN approved_account_provisioners -> ALERT	Windows Security Event Logs, Directory-Service Audit Logs, Identity Provider Audit Logs
T1098 Account Manipulation · simulation · detections	MATCH(credential_added OR role_added OR group_membership_changed) AND actor NOT_IN approved_identity_admins -> ALERT	Directory-Service Audit Logs, Identity Provider Audit Logs, Cloud Identity and Access Management Logs
T1547.001 Registry Run Keys / Startup Folder · simulation · detections	MATCH(registry_or_startup_path IN autostart_locations) AND executable NOT_IN approved_autostart_programs -> ALERT	Registry and Configuration-Store Logs, File-System Activity Logs
T1543 Create or Modify System Process · simulation · detections	MATCH(service_created_or_modified) AND service_binary NOT_IN approved_service_binaries -> ALERT	Service and Daemon Management Logs, Windows System Event Logs, Linux System Logs
T1053 Scheduled Task/Job · simulation · detections	MATCH(task_created_or_modified) AND creator NOT_IN approved_schedulers -> ALERT	Scheduled Task and Job Logs, Windows Task Scheduler Logs, Linux Service-Manager Logs
T1505.003 Web Shell · simulation · detections	MATCH(new_or_modified_file IN web_root) AND extension IN executable_server_extensions -> ALERT; SEQUENCE(web_request, web_server_child_process) WITHIN 1m -> ALERT	File-Integrity Monitoring Logs, Web Server Access Logs, Process Execution Logs
T1114.003 Email Forwarding Rule · simulation · detections	MATCH(forwarding_rule_created) AND destination_domain NOT_IN approved_domains -> ALERT	Mailbox Audit Logs, Application Audit Logs
T1610 Deploy Container · simulation · detections	MATCH(workload_created) AND (image NOT_IN approved_images OR privileged = true OR host_mount = true) -> ALERT	Orchestrator Audit Logs, Container Image Registry Logs, Container Admission-Control Logs

Privilege Escalation

ATT&CK TTP	Basic algorithmic detection logic	Relevant log sources
T1548 Abuse Elevation Control Mechanism · simulation · detections	MATCH(privilege_elevation) AND user_or_binary NOT_IN approved_elevation_list -> ALERT	Windows Security Event Logs, Linux Authentication Logs, Process Execution Logs
T1548.001 Setuid and Setgid · simulation · detections	MATCH(file_permission_change_sets_setuid_or_setgid) AND file NOT_IN approved_setuid_files -> ALERT	Linux Audit Logs, File-Integrity Monitoring Logs
T1548.002 Bypass User Account Control · simulation · detections	MATCH(process_or_registry_pattern IN known_uac_bypass_patterns) -> ALERT	Process Execution Logs, Registry and Configuration-Store Logs, Endpoint Detection and Response Telemetry
T1068 Exploitation for Privilege Escalation · simulation · detections	MATCH(exploit_mitigation_alert OR known_local_exploit_signature) -> ALERT; SEQUENCE(unprivileged_process, privileged_child_process) WITHIN 1m -> ALERT	Memory-Protection and Exploit-Mitigation Logs, Endpoint Detection and Response Telemetry
T1134 Access Token Manipulation · simulation · detections	MATCH(token_duplication_or_impersonation_event) AND process NOT_IN approved_impersonation_processes -> ALERT	Windows Security Event Logs, Endpoint Detection and Response Telemetry
T1611 Escape to Host · simulation · detections	MATCH(container_process_accesses_host_namespace_or_protected_host_path) -> ALERT	Container Runtime Security Logs, System-Call Telemetry, Container Runtime Logs

Defense Evasion

Historical grouping retained: the maintained research edition uses Enterprise ATT&CK v19.2 and explains the April 2026 split into Stealth and Defense Impairment. These catalog rows and old identifiers are preserved for compatibility, not asserted as current taxonomy. Version context.

ATT&CK TTP	Basic algorithmic detection logic	Relevant log sources
T1036 Masquerading · simulation · detections	MATCH(filename_or_service_name IN trusted_names) AND hash_or_path_or_publisher NOT_IN approved_values -> ALERT	Process Execution Logs, File-System Activity Logs, Application-Control Logs
T1027 Obfuscated Files or Information · simulation · detections	MATCH(command_line_contains_encoding_flags OR script_matches_obfuscation_signature OR file_packer_signature) -> ALERT	Script-Execution Logs, Content Inspection and Malware Scanning Logs, Sandbox Analysis Logs
T1055 Process Injection · simulation · detections	MATCH(remote_thread_creation OR cross_process_memory_write OR suspicious_process_access) AND source_process NOT_IN approved_injectors -> ALERT	Endpoint Detection and Response Telemetry, Memory-Protection and Exploit-Mitigation Logs, System-Call Telemetry
T1070.001 Clear Windows Event Logs	MATCH(event_log_cleared OR process_command_matches_log_clear_command) -> ALERT	Windows Security Event Logs, Process Execution Logs, Central Log Collector Logs
T1070.004 File Deletion · simulation · detections	MATCH(deletion_of_executable_script_or_log_file) AND actor_or_path NOT_IN approved_deletion_activity -> ALERT	File-System Activity Logs, File-Integrity Monitoring Logs
T1070.006 Timestomp · simulation · detections	MATCH(file_timestamp_change) AND timestamp_precedes_creation_or_differs_from_known_metadata -> ALERT	File-System Activity Logs, File-Integrity Monitoring Logs
T1218 System Binary Proxy Execution · simulation · detections	MATCH(proxy_execution_binary) AND command_line MATCHES known_abuse_signature -> ALERT	Process Execution Logs, Application-Control Logs
T1562.001 Disable or Modify Tools	MATCH(security_service_stopped OR security_setting_disabled OR exclusion_added) AND actor NOT_IN approved_security_admins -> ALERT	Endpoint Sensor Health Logs, Antivirus and Antimalware Logs, Service and Daemon Management Logs
T1562.002 Disable Windows Event Logging	MATCH(event_logging_service_stopped_or_disabled) OR MISSING(expected_windows_events, fixed_duration) -> ALERT	Windows System Event Logs, Central Log Collector Logs, Security Information and Event Management Logs
T1562.004 Disable or Modify System Firewall	STATE_CHANGE(firewall_enabled = false OR allow_rule_added) AND actor NOT_IN approved_firewall_admins -> ALERT	Local Firewall Logs, Network Firewall Logs, Cloud Firewall and Security-Group Logs
T1562.010 Downgrade Attack	MATCH(installed_or_selected_version < approved_minimum_version) -> ALERT	Package and Software Installation Logs, Configuration and Compliance Scanner Logs
T1222 File and Directory Permissions Modification · simulation · detections	MATCH(permission_or_owner_change_on_protected_path) AND actor NOT_IN approved_admins -> ALERT	File-System Activity Logs, Linux Audit Logs, File-Integrity Monitoring Logs

Credential Access

ATT&CK TTP	Basic algorithmic detection logic	Relevant log sources
T1110.001 Password Guessing · simulation · detections	COUNT(failed_authentication BY source_ip AND account, 5m) >= threshold -> ALERT	Identity Provider Sign-In Logs, Directory-Service Authentication Logs, Application Authentication Logs
T1110.003 Password Spraying · simulation · detections	DISTINCT_COUNT(account BY source_ip, 10m WHERE authentication_failed) >= threshold AND failures_per_account <= small_threshold -> ALERT	Identity Provider Sign-In Logs, Directory-Service Authentication Logs
T1110.004 Credential Stuffing · simulation · detections	COUNT(authentication_failed BY source_ip, 10m) >= threshold AND DISTINCT_COUNT(account) >= threshold -> ALERT	Application Authentication Logs, Identity Provider Sign-In Logs, Web Application Firewall Logs
T1621 Multi-Factor Authentication Request Generation · simulation · detections	COUNT(mfa_challenge BY account, 10m) >= threshold OR COUNT(mfa_denied BY account, 10m) >= threshold -> ALERT	Multi-Factor Authentication Logs, Identity Provider Sign-In Logs
T1003 OS Credential Dumping · simulation · detections	MATCH(process_access_to_credential_process OR known_dump_tool_signature OR dump_file_pattern) -> ALERT	Endpoint Detection and Response Telemetry, Process Execution Logs, Memory-Protection and Exploit-Mitigation Logs
T1555 Credentials from Password Stores · simulation · detections	MATCH(access_to_password_store_path_or_api) AND process NOT_IN approved_password_clients -> ALERT	File-System Activity Logs, Endpoint Detection and Response Telemetry, Password-Management and Credential-Vault Logs
T1558.003 Kerberoasting · simulation · detections	COUNT(service_ticket_request BY account, 10m) >= threshold AND DISTINCT_COUNT(service_name) >= threshold -> ALERT; MATCH(weak_ticket_encryption_type) -> ALERT	Directory-Service Authentication Logs, Windows Security Event Logs
T1003.006 DCSync · simulation · detections	MATCH(directory_replication_request) AND source_host NOT_IN approved_domain_controllers -> ALERT	Directory-Service Audit Logs, Windows Security Event Logs, Network Intrusion Detection Logs
T1552 Unsecured Credentials · simulation · detections	MATCH(file_content_or_path_matches_credential_pattern) OR MATCH(secret_retrieval BY unauthorized_identity) -> ALERT	File-System Activity Logs, Secrets-Management Logs, Cloud Secrets-Manager Logs

Discovery

ATT&CK TTP	Basic algorithmic detection logic	Relevant log sources
T1087 Account Discovery · simulation · detections	MATCH(process_or_api_operation IN account_enumeration_operations) AND actor NOT_IN approved_admin_tools -> ALERT	Process Execution Logs, Directory-Service Audit Logs, Cloud Identity and Access Management Logs
T1069 Permission Groups Discovery · simulation · detections	MATCH(process_or_api_operation IN group_enumeration_operations) AND actor NOT_IN approved_admin_tools -> ALERT	Process Execution Logs, Directory-Service Audit Logs
T1083 File and Directory Discovery · simulation · detections	COUNT(directory_listing_or_object_list BY actor, 5m) >= threshold -> ALERT	File-System Activity Logs, Cloud Object-Storage Access Logs, Process Execution Logs
T1046 Network Service Discovery · simulation · detections	DISTINCT_COUNT(destination_port OR destination_host BY source_host, 5m) >= threshold -> ALERT	Network Flow Logs, Network Firewall Logs, Network Detection and Response Telemetry
T1057 Process Discovery · simulation · detections	MATCH(command_or_api IN process_enumeration_operations) AND caller NOT_IN approved_tools -> ALERT	Process Execution Logs, Endpoint Detection and Response Telemetry
T1518 Software Discovery · simulation · detections	MATCH(command_or_api IN software_inventory_operations) AND caller NOT_IN approved_inventory_tools -> ALERT	Process Execution Logs, Asset Inventory and Discovery Logs
T1518.001 Security Software Discovery · simulation · detections	MATCH(command_queries_security_products_or_services) -> ALERT	Process Execution Logs, Endpoint Detection and Response Telemetry
T1580 Cloud Infrastructure Discovery · simulation · detections	COUNT(cloud_list_or_describe_operations BY identity, 10m) >= threshold AND identity NOT_IN approved_inventory_roles -> ALERT	Cloud Control-Plane Audit Logs, Cloud Resource-Configuration Inventory
T1613 Container and Resource Discovery · simulation · detections	COUNT(orchestrator_list_or_get_requests BY identity, 5m) >= threshold AND identity NOT_IN approved_cluster_admins -> ALERT	Orchestrator Audit Logs, Orchestrator Control-Plane Component Logs

Lateral Movement

ATT&CK TTP	Basic algorithmic detection logic	Relevant log sources
T1021.001 Remote Desktop Protocol · simulation · detections	MATCH(successful_rdp_session) AND source_host NOT_IN approved_rdp_sources -> ALERT	Remote Desktop and Remote Support Logs, Windows Security Event Logs, Network Flow Logs
T1021.002 SMB/Windows Admin Shares · simulation · detections	MATCH(admin_share_access OR remote_service_creation) AND source_host NOT_IN approved_admin_hosts -> ALERT	Windows Security Event Logs, File-System Activity Logs, Network Flow Logs
T1021.004 SSH · simulation · detections	MATCH(successful_ssh_login) AND source_host NOT_IN approved_ssh_sources -> ALERT	Linux Authentication Logs, Network Flow Logs
T1021.006 Windows Remote Management · simulation · detections	MATCH(remote_management_session_or_command) AND source_host NOT_IN approved_management_hosts -> ALERT	Windows Remote Management Logs, Windows Security Event Logs
T1550.002 Pass the Hash · simulation · detections	MATCH(ntlm_network_logon_pattern_without_expected_interactive_context) AND source_host NOT_IN approved_admin_hosts -> ALERT	Windows Security Event Logs, Directory-Service Authentication Logs
T1570 Lateral Tool Transfer · simulation · detections	MATCH(file_written_to_remote_share_or_host) AND file_hash_or_extension IN monitored_types -> ALERT	File-System Activity Logs, File Transfer Service Logs, Network Flow Logs

Collection

ATT&CK TTP	Basic algorithmic detection logic	Relevant log sources
T1005 Data from Local System · simulation · detections	COUNT(reads_of_protected_files BY process_or_user, 10m) >= threshold -> ALERT	File-System Activity Logs, Storage-System Audit Logs
T1039 Data from Network Shared Drive · simulation · detections	COUNT(network_share_file_reads BY user, 10m) >= threshold -> ALERT	File-System Activity Logs, Storage-System Audit Logs, Network Flow Logs
T1114 Email Collection · simulation · detections	COUNT(message_read_or_export BY actor, 10m) >= threshold OR MATCH(mailbox_export_operation) -> ALERT	Mailbox Audit Logs, Application Audit Logs
T1213 Data from Information Repositories · simulation · detections	COUNT(repository_reads_or_exports BY actor, 10m) >= threshold OR MATCH(bulk_export_operation) -> ALERT	Database Audit Logs, Data Warehouse Audit Logs, Application Audit Logs
T1530 Data from Cloud Storage · simulation · detections	COUNT(object_read_or_list BY identity, 10m) >= threshold OR MATCH(snapshot_or_bucket_export) -> ALERT	Cloud Object-Storage Access Logs, Cloud Data-Plane Access Logs
T1119 Automated Collection · simulation · detections	COUNT(data_access_event BY actor, fixed_window) >= threshold AND process_or_identity NOT_IN approved_collectors -> ALERT	File-System Activity Logs, Database Audit Logs, Cloud Data-Plane Access Logs
T1074 Data Staged · simulation · detections	MATCH(archive_or_compression_process) AND output_path IN staging_paths -> ALERT; COUNT(files_created_in_staging_path, 10m) >= threshold -> ALERT	Process Execution Logs, File-System Activity Logs
T1113 Screen Capture · simulation · detections	MATCH(screen_capture_api_or_known_capture_tool) AND process NOT_IN approved_capture_apps -> ALERT	Endpoint Detection and Response Telemetry, Process Execution Logs

Command and Control

ATT&CK TTP	Basic algorithmic detection logic	Relevant log sources
T1071.001 Web Protocols · simulation · detections	MATCH(destination_or_url IN denylist OR http_signature IN known_c2_patterns) -> ALERT	Proxy and Secure Web Gateway Logs, Network Intrusion Detection Logs, Network Metadata Logs
T1071.004 DNS · simulation · detections	MATCH(dns_query_signature IN known_c2_patterns) OR COUNT(long_or_txt_queries BY source_host, 5m) >= threshold -> ALERT	DNS Resolver Logs, Packet-Capture Data, Network Detection and Response Telemetry
T1573 Encrypted Channel · simulation · detections	MATCH(certificate_fingerprint OR tls_fingerprint IN denylist) OR MATCH(disallowed_tls_version_or_cipher) -> ALERT	TLS and Certificate Metadata Logs, Network Metadata Logs
T1102 Web Service · simulation · detections	MATCH(connection_to_disallowed_web_service_category OR known_c2_account_or_url) -> ALERT	Proxy and Secure Web Gateway Logs, Collaboration Platform Audit Logs
T1105 Ingress Tool Transfer · simulation · detections	MATCH(download_hash_or_url IN denylist) OR SEQUENCE(network_download, executable_file_creation) WITHIN 2m -> ALERT	Proxy and Secure Web Gateway Logs, File-System Activity Logs, Content Inspection and Malware Scanning Logs
T1090 Proxy · simulation · detections	MATCH(proxy_or_tunnel_process_or_configuration) AND actor_or_binary NOT_IN approved_proxy_tools -> ALERT	Process Execution Logs, Network Configuration Change Logs, Network Flow Logs
T1572 Protocol Tunneling · simulation · detections	MATCH(tunneling_protocol_signature OR disallowed_protocol_over_allowed_port) -> ALERT	Packet-Capture Data, Network Intrusion Detection Logs, Network Metadata Logs

Exfiltration

ATT&CK TTP	Basic algorithmic detection logic	Relevant log sources
T1041 Exfiltration Over C2 Channel · simulation · detections	SUM(outbound_bytes BY source_host AND destination, 15m) >= threshold AND destination NOT_IN approved_destinations -> ALERT	Network Flow Logs, Network Firewall Logs, Data Loss Prevention Logs
T1048 Exfiltration Over Alternative Protocol · simulation · detections	MATCH(outbound_protocol NOT_IN approved_protocols) AND outbound_bytes >= threshold -> ALERT	Network Flow Logs, DNS Resolver Logs, Network Metadata Logs
T1567 Exfiltration Over Web Service · simulation · detections	MATCH(upload_to_disallowed_web_service) OR SUM(upload_bytes BY user, 15m) >= threshold -> ALERT	Proxy and Secure Web Gateway Logs, Data Loss Prevention Logs, Cloud Data-Plane Access Logs
T1052 Exfiltration Over Physical Medium · simulation · detections	SEQUENCE(removable_media_connected, protected_file_written_to_media) WITHIN session -> ALERT	Removable-Media and Peripheral Device Logs, File-System Activity Logs, Data Loss Prevention Logs
T1020 Automated Exfiltration · simulation · detections	MATCH(scheduled_or_automated_transfer_job) AND destination NOT_IN approved_destinations -> ALERT	Scheduled Task and Job Logs, Network Flow Logs, File Transfer Service Logs
T1030 Data Transfer Size Limits · simulation · detections	COUNT(outbound_transfers_with_similar_small_size BY source AND destination, 30m) >= threshold -> ALERT	Network Flow Logs, Proxy and Secure Web Gateway Logs

Impact

ATT&CK TTP	Basic algorithmic detection logic	Relevant log sources
T1485 Data Destruction · simulation · detections	COUNT(delete_operation BY actor_or_process, 5m) >= threshold OR MATCH(delete_on_protected_resource) -> ALERT	File-System Activity Logs, Database Audit Logs, Cloud Object-Storage Access Logs
T1486 Data Encrypted for Impact · simulation · detections	COUNT(file_write_or_rename BY process, 5m) >= threshold AND DISTINCT_COUNT(file_extension BY process, 5m) >= threshold -> ALERT MATCH(known_ransomware_signature) -> ALERT	File-System Activity Logs, Endpoint Detection and Response Telemetry, Antivirus and Antimalware Logs
T1490 Inhibit System Recovery · simulation · detections	MATCH(backup_deleted OR snapshot_deleted OR recovery_setting_disabled OR known_recovery_disable_command) -> ALERT	Backup and Recovery Logs, Process Execution Logs, Cloud Control-Plane Audit Logs
T1531 Account Access Removal · simulation · detections	MATCH(account_disabled_or_deleted OR credential_reset OR role_removed) AND actor NOT_IN approved_identity_admins -> ALERT	Identity Provider Audit Logs, Directory-Service Audit Logs, Cloud Identity and Access Management Logs
T1499 Endpoint Denial of Service · simulation · detections	COUNT(request_or_connection BY source, 1m) >= threshold AND service_error_or_unavailable = true -> ALERT	Network Firewall Logs, Web Server Access Logs, Metrics and Monitoring-System Logs
T1496 Resource Hijacking · simulation · detections	MATCH(known_mining_process_or_pool_destination) OR resource_usage >= fixed_threshold FOR fixed_duration -> ALERT	Process Execution Logs, Network Flow Logs, Metrics and Monitoring-System Logs, Cloud Billing and Usage Logs
T1565 Data Manipulation · simulation · detections	MATCH(update_or_delete_on_protected_record) AND actor NOT_IN approved_writers -> ALERT	Database Audit Logs, Application Audit Logs, File-Integrity Monitoring Logs

Deterministic Detection Limitations

1. Fixed thresholds require environment-specific tuning and can be evaded by reducing activity rate.
2. Signatures and denylists detect known patterns but do not reliably detect novel implementations.
3. Allowlists reduce noise but become unsafe when they are broad, stale, or poorly governed.
4. Deterministic correlations require reliable timestamps and stable entity identifiers.
5. Some ATT&CK TTPs occur outside the monitored environment or produce no reliable deterministic event.
6. A matched rule indicates observable behavior, not confirmed malicious intent.

MITRE ATT&CK References

• Enterprise Tactics
• Enterprise Techniques
• Enterprise Matrix

Connected attack and detection workspaces

Attack Tools · Attack Simulations · Detection Rules · Telemetry Library · Linked Tags

These links follow exact active technique IDs or the published model's taxonomy references. They are navigation context, not proof of live simulation, sensor equivalence or detection effectiveness. Retired IDs are not silently migrated.

• T1003 OS Credential Dumping detections — Exact published Atlas technique ID
• T1003.006 DCSync detections — Exact published Atlas technique ID
• T1005 Data from Local System detections — Exact published Atlas technique ID
• T1020 Automated Exfiltration detections — Exact published Atlas technique ID
• T1021.001 Remote Desktop Protocol detections — Exact published Atlas technique ID
• T1021.002 SMB/Windows Admin Shares detections — Exact published Atlas technique ID
• T1021.004 SSH detections — Exact published Atlas technique ID
• T1021.006 Windows Remote Management detections — Exact published Atlas technique ID
• T1027 Obfuscated Files or Information detections — Exact published Atlas technique ID
• T1030 Data Transfer Size Limits detections — Exact published Atlas technique ID
• T1036 Masquerading detections — Exact published Atlas technique ID
• T1039 Data from Network Shared Drive detections — Exact published Atlas technique ID
• T1041 Exfiltration Over C2 Channel detections — Exact published Atlas technique ID
• T1046 Network Service Discovery detections — Exact published Atlas technique ID
• T1047 Windows Management Instrumentation detections — Exact published Atlas technique ID
• T1048 Exfiltration Over Alternative Protocol detections — Exact published Atlas technique ID
• T1052 Exfiltration Over Physical Medium detections — Exact published Atlas technique ID
• T1053 Scheduled Task/Job detections — Exact published Atlas technique ID
• T1055 Process Injection detections — Exact published Atlas technique ID
• T1057 Process Discovery detections — Exact published Atlas technique ID
• T1059 Command and Scripting Interpreter detections — Exact published Atlas technique ID
• T1059.001 PowerShell detections — Exact published Atlas technique ID
• T1059.003 Windows Command Shell detections — Exact published Atlas technique ID
• T1059.004 Unix Shell detections — Exact published Atlas technique ID
• T1059.005 Visual Basic detections — Exact published Atlas technique ID
• T1059.006 Python detections — Exact published Atlas technique ID
• T1059.007 JavaScript detections — Exact published Atlas technique ID
• T1068 Exploitation for Privilege Escalation detections — Exact published Atlas technique ID
• T1069 Permission Groups Discovery detections — Exact published Atlas technique ID
• T1070.004 File Deletion detections — Exact published Atlas technique ID
• T1070.006 Timestomp detections — Exact published Atlas technique ID
• T1071.001 Web Protocols detections — Exact published Atlas technique ID
• T1071.004 DNS detections — Exact published Atlas technique ID
• T1074 Data Staged detections — Exact published Atlas technique ID
• T1078 Valid Accounts detections — Exact published Atlas technique ID
• T1083 File and Directory Discovery detections — Exact published Atlas technique ID
• T1087 Account Discovery detections — Exact published Atlas technique ID
• T1090 Proxy detections — Exact published Atlas technique ID
• T1098 Account Manipulation detections — Exact published Atlas technique ID
• T1102 Web Service detections — Exact published Atlas technique ID
• T1105 Ingress Tool Transfer detections — Exact published Atlas technique ID
• T1110.001 Password Guessing detections — Exact published Atlas technique ID
• T1110.003 Password Spraying detections — Exact published Atlas technique ID
• T1110.004 Credential Stuffing detections — Exact published Atlas technique ID
• T1113 Screen Capture detections — Exact published Atlas technique ID
• T1114 Email Collection detections — Exact published Atlas technique ID
• T1114.003 Email Forwarding Rule detections — Exact published Atlas technique ID
• T1119 Automated Collection detections — Exact published Atlas technique ID
• T1133 External Remote Services detections — Exact published Atlas technique ID
• T1134 Access Token Manipulation detections — Exact published Atlas technique ID
• T1136 Create Account detections — Exact published Atlas technique ID
• T1190 Exploit Public-Facing Application detections — Exact published Atlas technique ID
• T1195 Supply Chain Compromise detections — Exact published Atlas technique ID
• T1203 Exploitation for Client Execution detections — Exact published Atlas technique ID
• T1204 User Execution detections — Exact published Atlas technique ID
• T1213 Data from Information Repositories detections — Exact published Atlas technique ID
• T1218 System Binary Proxy Execution detections — Exact published Atlas technique ID
• T1222 File and Directory Permissions Modification detections — Exact published Atlas technique ID
• T1485 Data Destruction detections — Exact published Atlas technique ID
• T1486 Data Encrypted for Impact detections — Exact published Atlas technique ID
• T1490 Inhibit System Recovery detections — Exact published Atlas technique ID
• T1496 Resource Hijacking detections — Exact published Atlas technique ID
• T1499 Endpoint Denial of Service detections — Exact published Atlas technique ID
• T1505.003 Web Shell detections — Exact published Atlas technique ID
• T1518 Software Discovery detections — Exact published Atlas technique ID
• T1518.001 Security Software Discovery detections — Exact published Atlas technique ID
• T1530 Data from Cloud Storage detections — Exact published Atlas technique ID
• T1531 Account Access Removal detections — Exact published Atlas technique ID
• T1543 Create or Modify System Process detections — Exact published Atlas technique ID
• T1547.001 Registry Run Keys / Startup Folder detections — Exact published Atlas technique ID
• T1548 Abuse Elevation Control Mechanism detections — Exact published Atlas technique ID
• T1548.001 Setuid and Setgid detections — Exact published Atlas technique ID
• T1548.002 Bypass User Account Control detections — Exact published Atlas technique ID
• T1550.002 Pass the Hash detections — Exact published Atlas technique ID
• T1552 Unsecured Credentials detections — Exact published Atlas technique ID
• T1555 Credentials from Password Stores detections — Exact published Atlas technique ID
• T1558.003 Kerberoasting detections — Exact published Atlas technique ID
• T1565 Data Manipulation detections — Exact published Atlas technique ID
• T1566.001 Spearphishing Attachment detections — Exact published Atlas technique ID
• T1566.002 Spearphishing Link detections — Exact published Atlas technique ID
• T1566.003 Spearphishing via Service detections — Exact published Atlas technique ID
• T1567 Exfiltration Over Web Service detections — Exact published Atlas technique ID
• T1570 Lateral Tool Transfer detections — Exact published Atlas technique ID
• T1572 Protocol Tunneling detections — Exact published Atlas technique ID
• T1573 Encrypted Channel detections — Exact published Atlas technique ID
• T1580 Cloud Infrastructure Discovery detections — Exact published Atlas technique ID
• T1583 Acquire Infrastructure detections — Exact published Atlas technique ID
• T1590 Gather Victim Network Information detections — Exact published Atlas technique ID
• T1595 Active Scanning detections — Exact published Atlas technique ID
• T1595.002 Vulnerability Scanning detections — Exact published Atlas technique ID
• T1595.003 Wordlist Scanning detections — Exact published Atlas technique ID
• T1608 Stage Capabilities detections — Exact published Atlas technique ID
• T1609 Container Administration Command detections — Exact published Atlas technique ID
• T1610 Deploy Container detections — Exact published Atlas technique ID
• T1611 Escape to Host detections — Exact published Atlas technique ID
• T1613 Container and Resource Discovery detections — Exact published Atlas technique ID
• T1621 Multi-Factor Authentication Request Generation detections — Exact published Atlas technique ID