AIDetectLab

Coverage Framework

Detection Coverage Map

Structured visibility across 8 detection layers with MITRE mapping and maturity tracking.

20
Total Detections
10
Production
5
Stable
3
AI Security
1
Coverage Gaps

Coverage by Layer

Host OS
4
Host Application
2
Host Network
2
Middle Network
2
Large Application
2
Identity
3
Perimeter
2
AI Security Extension
3
Production
Stable
Experimental
Planned
DetectionLayerData SourcePlatformMITRECoverage TypeMaturityAI

Process Creation Anomaly

Process Execution

Host OSWindows Event Log 4688 / SysmonWindowsT1059hybridproduction—

Scheduled Task Creation

Persistence

Host OSWindows Event Log 4698WindowsT1053.005rule-basedproduction—

Registry Run Key Modification

Persistence

Host OSSysmon Event 13WindowsT1547.001rule-basedstable—

LSASS Memory Access

Credential Access

Host OSSysmon Event 10WindowsT1003.001rule-basedproduction—

Browser Data Access

Credential Theft

Host ApplicationSysmon File AccessWindows / macOST1555.003rule-basedstable—

Office Macro Execution

Initial Access

Host ApplicationWindows Event Log / EDRWindowsT1566.001hybridproduction—

DNS Tunneling Detection

C2 Communication

Host NetworkDNS Query LogsWindows / LinuxT1071.004ml-basedexperimental—

Unusual Outbound Connections

Exfiltration

Host NetworkSysmon Event 3 / EDR NetworkWindows / LinuxT1041hybridstable—

East-West Lateral Movement

Lateral Movement

Middle NetworkVPC Flow Logs / FirewallCloud / On-premT1021ml-basedstable—

Network Scanning Detection

Discovery

Middle NetworkIDS / Firewall LogsOn-prem / CloudT1046rule-basedproduction—

Salesforce Bulk Data Export

Data Exfiltration

Large ApplicationSalesforce Event MonitoringSalesforceT1530rule-basedstable—

M365 Mass Email Forwarding

Exfiltration

Large ApplicationM365 Audit LogsMicrosoft 365T1114.003rule-basedproduction—

Impossible Travel Login

Account Compromise

IdentityAuthentication Logs / IdPAllT1078rule-basedproduction—

MFA Fatigue Attack

Account Compromise

IdentityIdP / MFA Provider LogsAllT1621rule-basedproduction—

Privileged Account Behavior Anomaly

Privilege Abuse

IdentityPAM / AD LogsWindows / CloudT1078.002ml-basedexperimental—

WAF Bypass Attempt

Initial Access

PerimeterWAF / CDN LogsWeb ApplicationsT1190rule-basedproduction—

VPN Brute Force

Initial Access

PerimeterVPN Appliance LogsAllT1110rule-basedproduction—

LLM Prompt Injection

Input Manipulation

AI Security ExtensionAPI Gateway / LLM Platform LogsAI/ML PlatformT1190hybridexperimental

AI Agent Tool Misuse

Tool Abuse

AI Security ExtensionAgent Execution LogsAI/ML PlatformT1059rule-basedexperimental

Model Data Exfiltration

Data Exfiltration

AI Security ExtensionAPI Gateway / Network LogsAI/ML PlatformT1530plannedplanned

Coverage Gaps

macOS Endpoint Coverage

Limited detection coverage for macOS-specific threats. Priority area for expansion.

Container / Kubernetes Layer

No dedicated container runtime or Kubernetes audit log detections in current framework.

LLM Output Monitoring

DLP integration for monitoring LLM response content not yet implemented.