hard20 pts · first answer countsmitre-attackdetection-engineering
Trusting a green ATT&CK heatmap
A vendor report shows your ATT&CK heatmap "covers" T1059.001 PowerShell because you have one rule for -EncodedCommand. What is the main risk in this claim?
Discussion 0
Join free to post in the discussion.
Related questions
- False positive or false negative?Cybersecurity Analyst
- Tactic vs technique in MITRE ATT&CKCybersecurity Analyst
- Security log cleared on a serverCybersecurity Analyst
- A suspicious scheduled taskCybersecurity Analyst
- Why write detections in Sigma?Cybersecurity Analyst
- The Pyramid of PainCybersecurity Analyst
- A good threat hunting hypothesisCybersecurity Analyst
- Why a 99% accurate rule floods the SOCCybersecurity Analyst