IDLE

Build Detection Coverage

INSTANCE: hl-attackdetectio · IP: 10.10.21.31 · us-west-2

TIME02:00:00

Ubuntu

Lab not running

Click Launch above to provision a fresh Ubuntu VM. Takes ~30s.

Submit flag

0/4 objectives

Scenario

Audit SIEM telemetry against ATT&CK techniques and produce a coverage dashboard.

Objectives — click to toggle

Step-by-step walkthrough

1
Inventory data sources
Open Splunk → Settings → Data inputs. List indexes: wineventlog, sysmon, zeek, o365, edr_xdr.
2
Pull the technique list
Query the bundled ATT&CK STIX for the 12 techniques in scope (see Files tab → techniques.json).
3
Score each technique
For each ATT&CK ID mark covered (rule fires + telemetry present), partial (telemetry only) or missing.
4
Render the dashboard
Use the Coverage Dashboard panel (right side) to validate your scoring against the reference.
5
Export the gap report
Save coverage.csv + a 1-page exec summary highlighting the top 3 missing techniques.
```
splunk export coverage --format csv > /tmp/coverage.csv
```

Submission requirements

coverage.csv with 12 ATT&CK technique IDs scored covered/partial/missing
Screenshot of the rendered ATT&CK Coverage Dashboard
1-page executive gap report (PDF) naming top 3 missing techniques and recommended data sources

Upload deliverables via the Files tab before claiming points.

ATT&CK coverage dashboard

58% weighted

Covered

5/ 12

Partial

4/ 12

Missing

3/ 12

Heatmap by tactic

Execution

Discovery

Lateral Movement

Credential Access

Command and Control

Exfiltration

Techniques

T1059.001PowerShell
covered
Execution · Sysmon EID 1, PowerShell 4104
✓ splunk: powershell_suspicious_keywords
T1059.003Windows Command Shell
covered
Execution · Sysmon EID 1, 4688
✓ splunk: cmd_invocation_baseline
T1087.001Account Discovery: Local
partial
Discovery · Sysmon EID 1
✓ rule exists but no baseline tuning
⚠ Tune against helpdesk false positives
T1087.002Account Discovery: Domain
partial
Discovery · 4662, Sysmon EID 1
⚠ Missing AD audit policy for SAM-R queries
T1021.001Remote Services: RDP
covered
Lateral Movement · 4624 type 10, Zeek RDP
✓ rba: rdp_unusual_source
T1021.002Remote Services: SMB Admin Shares
missing
Lateral Movement · 5145
⚠ File share auditing disabled on member servers
T1021.006Remote Services: WinRM
missing
Lateral Movement · WinRM operational
⚠ WinRM logs not forwarded to SIEM
T1003.001OS Credential Dumping: LSASS
covered
Credential Access · Sysmon EID 10, EDR
✓ edr: lsass_handle_access
T1003.002OS Credential Dumping: SAM
partial
Credential Access · Sysmon EID 11
⚠ Sysmon config missing SAM file write rule
T1003.006OS Credential Dumping: DCSync
missing
Credential Access · 4662 with replication GUIDs
⚠ Directory Service auditing not enabled
T1071.001Application Layer Protocol: Web
covered
Command and Control · Zeek http, Proxy
✓ zeek: beaconing_jitter
T1041Exfiltration Over C2 Channel
partial
Exfiltration · Zeek conn, Proxy
⚠ No volumetric threshold rule yet