Our MITRE ATT&CK coverage: what we detect and what we don't

Every EDR vendor claims “full MITRE ATT&CK coverage”. Very few tell you what that actually means. This is our attempt to be honest about it.

MITRE ATT&CK is a knowledge base of adversary tactics and techniques observed in the real world. It is not a certification, not a checklist, and not something you can simply “pass”. Coverage claims are almost meaningless without context: which techniques, which platforms, detected how, with what fidelity?

Here’s where LightEDR stands today.

What we cover well

LightEDR’s agent does continuous behavioural monitoring - process execution, file system events, and network activity - across Linux endpoints. That gives us strong signal across several MITRE tactic categories.

Execution (TA0002). We catch command and scripting interpreter abuse reliably: shells spawning from web servers or containers, interpreter chains, encoded commands. If a technique involves spawning a process, we see it.

Persistence (TA0003). Cron job modification, systemd unit file creation, and init script tampering all leave file system traces. We catch these at write time, not retrospectively.

Discovery (TA0007). Reconnaissance commands - listing accounts, enumerating network interfaces, querying running processes - are high-volume but low-noise when you look at the process tree rather than individual events. We correlate bursts of discovery activity and surface them as behavioural clusters.

Lateral Movement (TA0008). SSH key abuse, pass-the-ticket on Linux (Kerberos-joined hosts), and use of remote admin tools all produce process and network events we can correlate. Not every sub-technique, but the common paths show up clearly.

Command and Control (TA0011) and Exfiltration (TA0010). Unusual outbound connections - DNS tunnelling patterns, beaconing at regular intervals, data staged before a large outbound transfer - are visible in the network telemetry. We flag anomalies; deep packet inspection is not yet in scope.

One practical advantage of the 90-day telemetry window: techniques that only become significant in hindsight - low-and-slow enumeration, staged credential collection - remain queryable when you eventually notice something is wrong. You can run a natural language hunt across the full window: “show me all processes that wrote to /etc in the last 30 days from a non-root parent”.

Where the gaps are

Being honest means saying this clearly.

Memory-only techniques. Process injection sub-techniques (T1055) that live entirely in memory - shellcode injection, reflective loading, Linux equivalents of DLL hollowing - are harder to catch with file system and process events alone. We can observe the host process behaving strangely after injection, but we cannot observe the injection mechanism itself without kernel memory introspection. This is a known gap; kernel-level memory analysis is on the roadmap.

Initial Access (TA0001). By the time our agent can observe anything, the attacker is already on the endpoint. We do not cover phishing, drive-by downloads, or supply chain compromise at the ingress point - that is network security territory (WAF, email gateway, DNS filtering). EDR lives post-execution; anyone claiming otherwise is being loose with the truth.

Cloud and SaaS techniques. If a technique targets AWS IAM, Microsoft 365, or Okta rather than the underlying OS, the endpoint agent has no visibility. Cross-cloud detection is an identity and cloud posture problem, not an endpoint one.

Pre-OS techniques. Firmware, bootkit, and BIOS-level persistence (T1542) are outside the scope of a userland agent. Detecting them requires hardware attestation - TPM-based verification is on our roadmap.

Why we publish this

CrowdStrike, SentinelOne, and Microsoft Defender for Endpoint all have larger engineering teams and longer development histories than us. Their coverage breadth is genuinely wider. If you need a vendor who will tell you they cover every ATT&CK technique on every platform, they can make that case better than we can.

We are building for SOC teams and MSSPs who would rather have honest signal on the techniques that actually matter - Execution, Persistence, Discovery, Lateral Movement - than a spreadsheet that claims “yes” across the board and delivers mediocre fidelity everywhere.

The MITRE ATT&CK Evaluations programme runs vendors through an emulated adversary and publishes technique-by-technique results. We have not yet been through a formal evaluation. When we are, we will publish the results here regardless of what they show.

Until then: our detections map to real-world observed techniques, run in real time, and you can hunt across 90 days of telemetry with a natural language query. That is the honest picture.

If you’re evaluating EDR and want to walk through our coverage against your specific threat model, get in touch.