Mapped but uncovered
Techniques where the chain is complete except for the last link: a KEV CVE maps here, MITRE publishes a detection strategy, and SigmaHQ has no rule tagged with it.
20 of the 152 techniques referenced by CTID mappings. Across all of ATT&CK, 297 of 697 live techniques with a strategy have no Sigma rule. Sigma at commit da9bb07d64; coverage is by exact attack.tXXXX tag, parent-level tags do not count for sub-techniques.
Techniques with KEV CVEs mapped and no Sigma rule
| Technique | Tactics | Platforms | KEV CVEs | MITRE analytics | Log sources named |
|---|---|---|---|---|---|
| T1608.001 Upload Malware | resource development | PRE | 11 | 1 | Internet Scan |
| T1011 Exfiltration Over Other Network Medium | exfiltration | Linux, macOS, Windows | 4 | 3 | WinEventLog:Sysmon, WinEventLog:System, auditd:SYSCALL, NSM:Flow, macos:unifiedlog, macos:osquery |
| T1497 Virtualization/Sandbox Evasion | stealth, discovery | Linux, macOS, Windows | 4 | 3 | WinEventLog:Sysmon, auditd:SYSCALL, macos:unifiedlog |
| T1037 Boot or Logon Initialization Scripts | persistence, privilege escalation | ESXi, Linux, macOS, Network Devices, Windows | 3 | 5 | WinEventLog:Security, WinEventLog:TaskScheduler, auditd:SYSCALL, auditd:PATH, linux:osquery, macos:unifiedlog, fs:fsusage, macos:osquery, esxi:vmkernel, esxi:hostd, networkdevice:syslog |
| T1573.001 Symmetric Cryptography | command and control | ESXi, Linux, macOS, Network Devices, Windows | 3 | 5 | WinEventLog:Sysmon, auditd:SYSCALL, linux:syslog, linux:osquery, macos:unifiedlog, esxi:vpxd, esxcli:network, NSM:Flow, NSM:Connections |
| T1001 Data Obfuscation | command and control | ESXi, Linux, macOS, Windows | 2 | 3 | NSM:Flow, auditd:SYSCALL, macos:unifiedlog |
| T1499.002 Service Exhaustion Flood | impact | Windows, IaaS, Linux, macOS | 2 | 4 | WinEventLog:Application, WinEventLog:Sysmon, Windows:perfmon, auditd:SYSCALL, NSM:Flow, linux:syslog, macos:unifiedlog, AWS:CloudTrail, AWS:VPCFlowLogs, AWS:CloudWatch |
| T1530 Data from Cloud Storage | collection | IaaS, Office Suite, SaaS | 2 | 3 | AWS:CloudTrail, AWS:VPCFlowLogs, m365:unified, m365:sharepoint, azure:signinlogs |
| T1584.005 Botnet | resource development | PRE | 2 | 1 | |
| T1592 Gather Victim Host Information | reconnaissance | PRE | 2 | 1 | Internet Scan |
| T1003.008 /etc/passwd and /etc/shadow | credential access | Linux | 1 | 1 | auditd:SYSCALL |
| T1071.002 File Transfer Protocols | command and control | ESXi, Linux, macOS, Network Devices, Windows | 1 | 5 | WinEventLog:Sysmon, NSM:Flow, auditd:SYSCALL, macos:osquery, macos:unifiedlog, esxi:shell |
| T1098.004 SSH Authorized Keys | persistence, privilege escalation | ESXi, IaaS, Linux, macOS, Network Devices | 1 | 5 | auditd:SYSCALL, macos:unifiedlog, macos:auth, gcp:audit, esxi:shell, networkdevice:cli |
| T1114.002 Remote Email Collection | collection | Office Suite, Windows | 1 | 2 | azure:signinlogs, m365:purview, WinEventLog:PowerShell, WinEventLog:Sysmon, m365:unified |
| T1491.002 External Defacement | impact | Windows, IaaS, Linux, macOS | 1 | 4 | WinEventLog:Security, NSM:Connections, WinEventLog:Sysmon, auditd:SYSCALL, NSM:Flow, macos:unifiedlog, AWS:CloudTrail |
| T1498.001 Direct Network Flood | impact | Windows, IaaS, Linux, macOS | 1 | 4 | WinEventLog:Sysmon, WinEventLog:Security, auditd:SYSCALL, macos:unifiedlog, AWS:VPCFlowLogs, AWS:CloudWatch |
| T1542.005 TFTP Boot | stealth, persistence | Network Devices | 1 | 1 | networkdevice:config, networkdevice:syslog, NSM:Flow |
| T1588.006 Vulnerabilities | resource development | PRE | 1 | 1 | |
| T1601 Modify System Image | defense impairment | Network Devices | 1 | 1 | networkdevice:cli, networkdevice:config |
| T1602 Data from Configuration Repository | collection | Network Devices | 1 | 1 | NSM:Flow, networkdevice:syslog |
All live techniques with a MITRE strategy and no Sigma rule
297 techniques. No KEV relevance implied; this is the Sigma-side gap on its own.
T1001 · T1001.001 · T1001.002 · T1003.007 · T1003.008 · T1011 · T1011.001 · T1016.001 · T1016.002 · T1020.001 · T1021.008 · T1025 · T1027.006 · T1027.007 · T1027.008 · T1027.012 · T1027.013 · T1027.014 · T1027.015 · T1027.016 · T1027.017 · T1027.018 · T1029 · T1036.001 · T1036.009 · T1036.010 · T1036.011 · T1036.012 · T1037 · T1037.002 · T1037.003 · T1037.004 · T1048.002 · T1052 · T1052.001 · T1053.006 · T1053.007 · T1055.002 · T1055.004 · T1055.005 · T1055.008 · T1055.013 · T1055.014 · T1055.015 · T1056.003 · T1056.004 · T1059.008 · T1059.010 · T1059.011 · T1059.013 · T1070.007 · T1070.009 · T1070.010 · T1071.002 · T1071.003 · T1071.005 · T1074.002 · T1080 · T1087.003 · T1092 · T1098.002 · T1098.004 · T1098.006 · T1098.007 · T1104 · T1110.003 · T1110.004 · T1111 · T1114.002 · T1127.002 · T1127.003 · T1132 · T1132.002 · T1137.001 · T1137.004 · T1137.005 · T1176.002 · T1195.003 · T1204.003 · T1204.005 · T1205 · T1205.001 · T1205.002 · T1213.001 · T1213.002 · T1213.004 · T1213.005 · T1213.006 · T1216.002 · T1218.004 · T1218.012 · T1218.015 · T1219.001 · T1219.003 · T1480 · T1480.001 · T1480.002 · T1485.001 · T1491 · T1491.002 · T1496.001 · T1496.002 · T1496.003 · T1496.004 · T1497 · T1497.002 · T1497.003 · T1498.001 · T1498.002 · T1499.002 · T1499.003 · T1505.006 · T1518.002 · T1530 · T1534 · T1535 · T1538 · T1542 · T1542.002 · T1542.004 · T1542.005 · T1543.005 · T1546.005 · T1546.006 · T1546.016 · T1546.017 · T1546.018 · T1547.007 · T1547.012 · T1547.013 · T1548.004 · T1548.005 · T1548.006 · T1550.004 · T1552.005 · T1552.008 · T1553.006 · T1555.002 · T1555.006 · T1556.001 · T1556.003 · T1556.005 · T1556.007 · T1556.008 · T1556.009 · T1557.002 · T1557.004 · T1558.004 · T1558.005 · T1559.003 · T1560.002 · T1560.003 · T1561 · T1563 · T1563.001 · T1564.005 · T1564.007 · T1564.009 · T1564.010 · T1564.011 · T1564.012 · T1564.013 · T1564.014 · T1565.003 · T1566.003 · T1566.004 · T1567.003 · T1567.004 · T1568.001 · T1568.003 · T1569.003 · T1573.001 · T1573.002 · T1574.004 · T1574.009 · T1574.010 · T1574.013 · T1574.014 · T1578.001 · T1578.002 · T1578.004 · T1578.005 · T1583 · T1583.001 · T1583.002 · T1583.003 · T1583.004 · T1583.005 · T1583.006 · T1583.007 · T1583.008 · T1584.001 · T1584.002 · T1584.003 · T1584.004 · T1584.005 · T1584.006 · T1584.007 · T1584.008 · T1585 · T1585.001 · T1585.002 · T1585.003 · T1586.001 · T1586.002 · T1587.002 · T1587.003 · T1587.004 · T1588.003 · T1588.004 · T1588.005 · T1588.006 · T1588.007 · T1589.001 · T1589.003 · T1590.003 · T1590.004 · T1590.005 · T1590.006 · T1591 · T1591.001 · T1591.002 · T1591.003 · T1592 · T1592.001 · T1592.002 · T1592.003 · T1593 · T1593.001 · T1593.002 · T1594 · T1595.003 · T1596 · T1596.001 · T1596.002 · T1596.003 · T1596.004 · T1596.005 · T1597 · T1597.001 · T1597.002 · T1598 · T1598.001 · T1598.003 · T1598.004 · T1599 · T1600 · T1600.001 · T1600.002 · T1601 · T1601.001 · T1601.002 · T1602 · T1602.001 · T1602.002 · T1606.001 · T1606.002 · T1608.001 · T1608.002 · T1608.004 · T1608.005 · T1608.006 · T1610 · T1612 · T1614 · T1647 · T1648 · T1650 · T1651 · T1652 · T1654 · T1657 · T1659 · T1665 · T1666 · T1667 · T1668 · T1669 · T1671 · T1673 · T1674 · T1675 · T1677 · T1678 · T1679 · T1680 · T1681 · T1682 · T1683 · T1683.001 · T1683.002 · T1684 · T1684.001 · T1684.002 · T1685.003 · T1687 · T1688