This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

Detection Coverage Matrix

Maps each observable behavior to the detections that cover it, the telemetry required, the ATT&CK technique, and a confidence rating.

Behavior	ATT&CK	Detection(s)	Telemetry required	Confidence
Tool executed by name	T1555.003	Sigma 9.1, Hunt 1	Process creation (Sysmon 1 / 4688 / EDR)	High
Tool executed by flag	T1555.003	Sigma 9.1, Hunt 1	Process creation w/ command line	Med–High*
Non-browser reads credential store	T1555.003 / T1552.001	Sigma 9.2, Hunt 2	File access (Sysmon 11/23, 4663, EDR file events)	Med–High
Session cookie theft	T1539	Sigma 9.2, IOCs	File access to Cookies store	Med
Stealer DB / copied store in odd path	T1074.001	Sigma 9.3, Hunt 3	File create (Sysmon 11)	Med
C:\Users\Public\NTUSER.dat drop	T1074.001	Sigma 9.4, Hunt 4	File create (Sysmon 11)	Very High
Masquerade as browser binary	T1036.005	Sigma 9.5, Hunt 5	Process creation w/ signature fields	Very High
Scheduled-task persistence (shaddy43)	T1053.005	Sigma 9.6, Hunt 6	Security 4698/4699, TaskScheduler 106/141	Very High
Binary on disk / in memory	T1555.003	YARA	File or memory scanning	High
DPAPI / AES-GCM decryption	T1140	Behavioral	API telemetry / EDR	Low–Med
Exfiltration of stealer DB	T1041	IOCs — Network	Network (Sysmon 3, proxy, NetFlow)	Low (variant-dependent)

* Confidence depends on tuning, see the flag tuning note.

---

Telemetry prerequisites

To get full coverage, ensure the following are enabled:

• Process creation with command line — Sysmon Event ID 1, or Windows Security 4688 with command-line auditing enabled (Include command line in process creation events GPO), or EDR process telemetry.
• File create / file access — Sysmon Event ID 11 (create) and 23/26 (delete); Windows 4663 requires SACLs on the target files.
• Process image signature fields — Sysmon config with <HashAlgorithms> and signature capture, or EDR that records signer/signature status (paired with 9.5, high confidence).
• Scheduled task auditing — Windows Security 4698/4699 (enable "Audit Other Object Access Events"), plus the TaskScheduler Operational log (106/141).
• Network connection — Sysmon Event ID 3 and/or proxy/DNS logs for the exfil hunts.

---

Deployment priority

If you can only deploy a few detections first, start with the Very High confidence items, they have near-zero false positives:

1. Sigma 9.4 — Public NTUSER.dat
2. Sigma 9.6 — Scheduled task author shaddy43
3. Sigma 9.5 — Browser masquerade
4. YARA rule + Sigma 9.1 execution

Continue to → Validation & Lab Testing