Lab 01 — Injection Technique Detection Mapper

Map injection techniques to their required sensors, API sequences, Sysmon event IDs, and detection rules. Compute technique coverage against a given sensor inventory.

What it builds

A detection-engineering catalog for process-injection techniques. Given a technique name, returns its API call sequence, required data sources, observable Sysmon event IDs, the detection key, and a description of the behavioral IOC. Given a sensor inventory, computes which techniques are fully covered, partially covered, or blind — and the best sensor to add.

Running

LAB_MODULE=solution python3 -m pytest -q   # 13 tests
python3 -m pytest -q

API

technique_info(name: str) -> dict | None
    # Returns {name, api_sequence, required_sensors, sysmon_eids, detection_key, description}
    # None if unknown technique

coverage(techniques: list[str], sensors: set[str]) -> dict[str, str]
    # Returns {technique: "covered" | "partial" | "blind"}
    # covered: all required_sensors present
    # partial: at least one required_sensor present
    # blind: no required_sensor present

blind_techniques(techniques: list[str], sensors: set[str]) -> list[str]

best_sensor_to_add(techniques: list[str], sensors: set[str]) -> str | None
    # Greedy: the sensor that converts the most blind/partial techniques toward covered

all_technique_names() -> list[str]