Lab 01 — EDR Telemetry-Gap Analyzer

Lens: detection-coverage / threat-informed defense. WARMUP: Chapters 1, 2, 8, 9.

The problem

Meridian Freight's EDR did not "miss" FIN-LATTICE by accident — it was blind to a specific behavior because it was not collecting the data source that behavior emits. A red team's most valuable Phase 07 deliverable is not "we evaded the EDR"; it is the detection-gap map: given the sensors the org actually collects, which ATT&CK techniques are detectable, which are only partially covered, which are flat blind — and which single missing sensor, bought first, recovers the most coverage.

This lab builds that map. It models a sensor inventory (process-create, command-line, image-load, kernel callbacks, ETW, ETW-TI, AMSI, network, file events, registry, script-block logging) against a catalog of techniques, each annotated with the data sources required to detect it robustly. It then computes coverage and a prioritized telemetry-improvement plan. The lesson encoded: evasion blinds a sensor; the defense is to know which sensor each technique needs and to close the cheapest, highest- value gap first.

Safety. Authorized-education only. This reasons over synthetic sensor metadata. There is no EDR bypass, no unhooking code, no deployable evasion — only a coverage model that turns "what could blind us" into "what telemetry to invest in first."

What you build (`lab.py`)

classify(technique_id, sensors) — {technique, name, required, present, missing, state}. State is detectable when all required sensors are present, blind when none are, partial otherwise. (Conservative: partial coverage is brittle — one evasion that blinds a single sensor can drop you below the line.)
coverage(techniques, sensors) — {detectable, partial, blind, by_technique, score}.
blind_techniques(techniques, sensors) — the fully-blind technique ids.
best_sensor_to_add(techniques, sensors) — the single missing sensor that flips the most techniques to detectable (the highest-value telemetry investment), with the techniques it recovers.
improvement_plan(techniques, sensors) — the greedy, prioritized plan: add the highest-gain sensor, repeat until nothing more helps.

Attack → detection cases the tests cover

A command-line-only shop detects cmd/LOLBin execution but is blind to process injection (needs ETW-TI + kernel callbacks) and only partially covers LSASS dumping.
best_sensor_to_add returns the sensor that maximizes the number of techniques flipped to detectable — and the test proves no other single sensor beats it.
Adding that sensor actually flips the named techniques from blind/partial to detectable.
The improvement_plan is monotonic (cumulative coverage strictly increases) and terminates (after it, no single sensor still helps).
Full coverage yields no recommendation; unknown techniques and empty inputs are handled; all output is deterministic.

Run

pip install -r requirements.txt
LAB_MODULE=solution pytest -q     # reference passes (11 tests)
pytest -q                          # your implementation after the TODOs
# fallback interpreter:
LAB_MODULE=solution /Users/s0x/src/10xdev/ai-enigneer/.venv/bin/python -m pytest -q

Hardening / detection extensions

Load the real ATT&CK → data-source mapping (ATT&CK data sources / data components, the CTID "Sensor Mappings to ATT&CK" project) and the org's actual Sysmon config + ETW provider list.
Model alternative detection paths (OR-of-AND): real techniques have more than one way to be seen; replace the single AND-of-all required set with a list of sufficient sensor sets.
Weight sensors by cost and noise (AMSI and full command-line are cheap and high-value; raw ETW kernel tracing is expensive) and make the plan cost-aware.
Join with Lab 02: a technique that is "detectable" on paper may still be blinded by a specific user-mode evasion — feed Lab 02's residual-visibility result back in to flag brittle coverage.
Emit an ATT&CK Navigator layer coloring detectable / partial / blind for the executive gap map.

Multi-language extension (own range)

Re-implement the set-cover core in Rust or Go as a CLI that ingests a real sysmonconfig.xml and an ATT&CK data-source export and prints the gap map + plan as JSON for a CI gate ("coverage must not regress").

Interview / resume

"Built an EDR telemetry-gap analyzer that scores an org's ATT&CK detection coverage against its actual sensor inventory, classifies each technique detectable/partial/blind, and computes the single highest- value missing data source plus a greedy telemetry-improvement plan — turning 'the EDR was blind here' into a prioritized, defensible investment roadmap."

Limitations: a representative slice of sensors and techniques, not the full ATT&CK matrix; one AND-of-all required set per technique (real detection logic is OR-of-AND with alternative paths); "detectable" here means the data exists, not that a tuned rule fires without false positives; the greedy plan is a 1-step-lookahead heuristic (set cover is NP-hard) — a defensible prioritization, not a proven optimum.

Red Team Engineer