The MITRE ATT&CK techniques LightEDR covers out of the box

When a vendor says their EDR covers “hundreds of MITRE ATT&CK techniques”, they usually mean two different things are mixed together: detections they ship by default, and detections you can build yourself if you buy the right tier and have a dedicated engineer spare. That distinction matters enormously for a lean SOC team.

This post describes what LightEDR actually detects out of the box, what coverage honestly looks like across the ATT&CK matrix, and where we know the gaps are.

How we map coverage to ATT&CK

The ATT&CK Enterprise matrix has over 200 techniques and around 450 sub-techniques. No EDR covers all of them, and any vendor claiming otherwise is either counting differently or selling you an untuned rule set that will bury your team in noise.

Our approach: coverage is counted when a behavioural detection rule fires reliably on a real execution path with an acceptable false-positive rate. Rules in development or only available via custom Sigma import are not counted.

We group our out-of-the-box coverage across five tactical areas that an endpoint agent with 90-day telemetry is genuinely well-placed to detect:

ATT&CK Tactic	Coverage status
Execution	Strong - command-line, scripting, and binary execution paths
Persistence	Strong - autostart entries, scheduled tasks, service installs
Privilege Escalation	Moderate - common OS-level abuses; some container escapes limited
Defense Evasion	Moderate - process injection, log clearing, binary padding
Credential Access	Moderate - LSASS access patterns, credential file reads
Discovery	Limited - high-volume process noise; we fire on abnormal rates, not individual calls
Lateral Movement	Limited - we see the source endpoint; blind past the network hop
Command and Control	Indirect - via network connection behaviour and DNS, not content inspection
Exfiltration	Indirect - volume and destination anomalies only

The honest takeaway: LightEDR is strongest at the technique categories where endpoint telemetry is the primary evidence. For lateral movement detection you want network context alongside endpoint data; for exfiltration you want DLP or CASB. We are not a substitute for those tools.

The techniques we cover - some specifics

Within the “strong” and “moderate” categories, a few techniques are worth calling out directly because they appear in a majority of real-world intrusions.

T1059 - Command and Scripting Interpreter. This is the workhorse of post-exploitation. We detect malicious use across bash, sh, Python, and PowerShell (on endpoints where PowerShell is installed). Command-line argument inspection is baked into the agent; you get rule hits on living-off-the-land binaries (LOLBins) without any tuning.

T1055 - Process Injection. We covered this in detail recently, but in summary: we detect the OS-level calls that injection techniques depend on - ptrace, /proc/[pid]/mem writes, and LD_PRELOAD abuse on Linux. Classic DLL injection and process hollowing on Windows are also covered.

T1547 - Boot or Logon Autostart Execution. Persistence via systemd units, cron, .bashrc/.profile modification, and Windows Run keys all trigger alerts. This is one of the highest-signal technique categories because legitimate software rarely modifies autostart entries at runtime.

T1003 - OS Credential Dumping. Direct LSASS memory reads and common tool signatures (mimikatz-style access patterns) fire at the critical severity level. We do not claim to catch every novel variant - but the core access patterns are covered.

T1070 - Indicator Removal. Log clearing, history file deletion, and timestamp manipulation are detected as behavioural anomalies. The 90-day immutable telemetry store means that even if an attacker clears the host logs, we retain the event stream.

What the gaps mean in practice

The honest framing for the “limited” categories is not “we don’t care about lateral movement” - it’s that endpoint telemetry alone gives you incomplete information for those techniques. A connection from host A to host B over SMB shows up as a network event. Whether that’s lateral movement depends on context that spans two endpoints, not one.

In practice, our customers close these gaps in one of two ways. Some feed LightEDR events into a SIEM (Splunk, Elastic, Loki) where cross-host correlation can run. Others use our natural language threat hunting feature to query across the fleet: asking “which endpoints made authenticated SMB connections to hosts they’ve never contacted before in the last 30 days” returns a results set that the detection layer alone would not surface.

Our published MITRE ATT&CK navigator layer is available on request - get in touch and we’ll share the current coverage JSON alongside the release notes for your version.