MITRE ATT&CK Coverage
AlphaSOC provides comprehensive detection coverage across the MITRE ATT&CK Enterprise framework. The coverage map below shows which techniques are detected by AlphaSOC, along with the number of distinct detections for each technique.
Using the ATT&CK Navigator
You can download the coverage data as an ATT&CK Navigator layer file for detailed analysis and integration with your security workflows:
- Download the layer file using the button below
- Open the ATT&CK Navigator
- Click "Open Existing Layer" → "Upload from local"
- Select the downloaded JSON file
The Navigator layer includes color-coded coverage based on detection count, allowing you to visualize detection depth across the framework.
MITRE ATT&CK Coverage Map
AlphaSOC Detection Coverage
Coverage across the MITRE ATT&CK Enterprise framework based on 1027 detections.
Download ATT&CK Navigator Layer87%13 of 15Tactics
Covered
Covered
Reconnaissance
0/12 Covered
T1589
Gather Victim Identity InformationT1590
Gather Victim Network InformationT1591
Gather Victim Org InformationT1592
Gather Victim Host InformationT1593
Search Open Websites/DomainsResource Development
4/9 Covered
T15836
Acquire InfrastructureT15842
Compromise InfrastructureT1585
Establish AccountsT15862
Compromise AccountsT1587
Develop CapabilitiesInitial Access
6/9 Covered
T107875
Valid AccountsT1091N/A
Replication Through Removable MediaT11332
External Remote ServicesT11896
Drive-by CompromiseT11906
Exploit Public-Facing ApplicationExecution
4/10 Covered
T1047N/A
Windows Management InstrumentationT1053N/A
Scheduled Task/JobT105910
Command and Scripting InterpreterT1072
Software Deployment ToolsT1106N/A
Native APIPersistence
9/12 Covered
T1037
Boot or Logon Initialization ScriptsT1053N/A
Scheduled Task/JobT107813
Valid AccountsT1098102
Account ManipulationT1112N/A
Modify RegistryPrivilege Escalation
6/9 Covered
T10375
Boot or Logon Initialization ScriptsT1053N/A
Scheduled Task/JobT1055N/A
Process InjectionT1068
Exploitation for Privilege EscalationT107830
Valid AccountsStealth
2/9 Covered
T1006N/A
Direct Volume AccessT1014N/A
RootkitT1027N/A
Obfuscated Files or InformationT1036N/A
MasqueradingT1055N/A
Process InjectionDefense Impairment
0/9 Covered
T1112N/A
Modify RegistryT1207N/A
Rogue Domain ControllerT1222
File and Directory Permissions ModificationT1484
Domain or Tenant Policy ModificationT1553N/A
Subvert Trust ControlsCredential Access
9/14 Covered
T1003N/A
OS Credential DumpingT10402
Network SniffingT1056N/A
Input CaptureT111017
Brute ForceT1111
Multi-Factor Authentication InterceptionDiscovery
8/16 Covered
T1007N/A
System Service DiscoveryT1010N/A
Application Window DiscoveryT1012N/A
Query RegistryT1016N/A
System Network Configuration DiscoveryT1018
Remote System DiscoveryLateral Movement
3/8 Covered
T10216
Remote ServicesT1072
Software Deployment ToolsT1080
Taint Shared ContentT1091N/A
Replication Through Removable MediaT1210
Exploitation of Remote ServicesCollection
3/5 Covered
T1005N/A
Data from Local SystemT1025N/A
Data from Removable MediaT1039N/A
Data from Network Shared DriveT1056N/A
Input CaptureT1074N/A
Data StagedCommand and Control
13/17 Covered
T10013
Data ObfuscationT10081
Fallback ChannelsT107145
Application Layer ProtocolT10902
ProxyT1092N/A
Communication Through Removable MediaExfiltration
4/8 Covered
T1011
Exfiltration Over Other Network MediumT1020
Automated ExfiltrationT1029
Scheduled TransferT1030
Data Transfer Size LimitsT10412
Exfiltration Over C2 ChannelImpact
8/12 Covered
T148550
Data DestructionT14863
Data Encrypted for ImpactT14895
Service StopT149018
Inhibit System RecoveryT1491
Defacement