How to Perform an EDR Coverage Gap Analysis with Red Team Testing

Setup requirements:
- Isolated test environment (separate from production) with representative endpoint configuration
  - Domain-joined Windows 10/11 workstation with production GPOs applied
  - Same EDR policy as production endpoints
  - Same AV exclusions as production
  - Internet access (for realistic C2 simulation, or use redirectors)

- ATT&CK framework scope: select relevant technique subsets:
  Option A: Test all techniques in the matrix (~800+ in ATT&CK v15)
  Option B: Test techniques used by specific threat groups that target your industry
    Example for financial sector: FIN7, Lazarus Group, Scattered Spider
    MITRE ATT&CK Groups page lists techniques per group
  Option C: Test your most-feared techniques first:
    - Credential access (T1003 OS Credential Dumping)
    - Lateral movement (T1021 Remote Services)
    - Defense evasion (T1562 Impair Defenses)
    - Persistence (T1053 Scheduled Task, T1543 Create or Modify System Process)

# Install Invoke-AtomicRedTeam (the Atomic Red Team PowerShell framework):
# Run on the test machine (isolated environment):

# Install from PowerShell Gallery:
Install-Module -Name invoke-atomicredteam -Scope CurrentUser -Force
Install-Module -Name powershell-yaml -Scope CurrentUser -Force

# Clone the Atomic Red Team test library:
$atomicPath = 'C:\AtomicRedTeam'
Invoke-Expression (Invoke-WebRequest 'https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/install-atomicredteam.ps1' -UseBasicParsing)
Install-AtomicRedTeam -getAtomics -Force
# Downloads ~500MB of test cases and payloads

# Verify installation:
Get-Help Invoke-AtomicTest -Full

# Run a specific ATT&CK technique test:
# T1003.001 = OS Credential Dumping: LSASS Memory
Invoke-AtomicTest T1003.001

# Run with verbose output to see what the test does:
Invoke-AtomicTest T1003.001 -ShowDetailsBrief

# Show test details before running (recommended for new tests):
Invoke-AtomicTest T1003.001 -ShowDetails

# Run prerequisite checks first:
Invoke-AtomicTest T1003.001 -CheckPrereqs

# Run and log results:
Invoke-AtomicTest T1003.001 -LogPath C:\AtomicResults\ -TimeoutSeconds 120

# Cleanup after test:
Invoke-AtomicTest T1003.001 -Cleanup

Run a batch of techniques for a specific threat group:

# Run all Lazarus Group techniques (mapped in ATT&CK):
$LazarusTechniques = @(
    'T1059.001',  # PowerShell
    'T1059.003',  # Windows Command Shell
    'T1003.001',  # LSASS Credential Dumping
    'T1021.002',  # SMB/Windows Admin Shares
    'T1055',      # Process Injection
    'T1562.001',  # Disable/Modify Tools
    'T1070.001',  # Clear Windows Event Logs
    'T1105',      # Ingress Tool Transfer
    'T1486'       # Data Encrypted for Impact
)

$results = @()
foreach ($technique in $LazarusTechniques) {
    Write-Host "Testing: $technique"
    try {
        $result = Invoke-AtomicTest $technique -ReturnOutput -TimeoutSeconds 60
        $results += [PSCustomObject]@{
            Technique = $technique
            Status = 'Executed'
            Output = $result
        }
    } catch {
        $results += [PSCustomObject]@{
            Technique = $technique
            Status = "Error: $($_.Exception.Message)"
            Output = ''
        }
    }
    Start-Sleep -Seconds 30  # Gap between tests for alert correlation
    Invoke-AtomicTest $technique -Cleanup 2>$null
}

$results | Export-Csv -Path C:\AtomicResults\LazarusGroup-$(Get-Date -Format yyyyMMdd).csv -NoTypeInformation

Critical tests to run for any enterprise EDR:

# These are the techniques most commonly missed or misconfigured:

# Credential Access:
Invoke-AtomicTest T1003.001  # LSASS memory dump (mimikatz-style)
Invoke-AtomicTest T1003.003  # NTDS.dit dump
Invoke-AtomicTest T1552.001  # Credentials in files

# Defense Evasion:
Invoke-AtomicTest T1562.001  # Disable security tools
Invoke-AtomicTest T1070.001  # Clear event logs
Invoke-AtomicTest T1027.002  # Software packing (obfuscated code)
Invoke-AtomicTest T1218.010  # regsvr32 Squiblydoo

# Persistence:
Invoke-AtomicTest T1053.005  # Scheduled task
Invoke-AtomicTest T1543.003  # Windows service
Invoke-AtomicTest T1547.001  # Registry run keys

# Discovery:
Invoke-AtomicTest T1087.001  # Local account enumeration
Invoke-AtomicTest T1082     # System information discovery
Invoke-AtomicTest T1016     # Network discovery

After running each test, check the EDR console to determine detection status:

For each technique tested, classify the result into one of four categories:

1. ALERTED: EDR generated an alert with the correct technique/tactic attribution
   - Color: Green in ATT&CK Navigator
   - Action: No immediate action needed; verify alert quality and response playbook

2. TELEMETRY ONLY: EDR logged the event but did not generate an alert
   - Color: Yellow in ATT&CK Navigator
   - Action: Create a detection rule using the available telemetry
   - This is the highest-priority gap: the data exists, just no detection rule

3. NO DETECTION: EDR has no log or alert for the technique
   - Color: Red in ATT&CK Navigator
   - Action: Check EDR policy (telemetry collection setting), check if the technique
     requires specific EDR module (e.g., memory scanning, script inspection)

4. FALSE NEGATIVE: Test confirmed malicious behavior, EDR had the telemetry,
   but did not alert: indicating a detection rule gap

Query CrowdStrike Falcon for test artifacts:

# In Falcon Event Search (FES): Humio query language:
# Find process creation events for the test machine during test window:
ComputerName="TEST-WORKSTATION01"
| EventType="ProcessRollup2"
| where timestamp > startOf1HoursAgo
| select timestamp, FileName, CommandLine, ParentBaseFileName
| sort timestamp

# Find if LSASS access was detected:
ComputerName="TEST-WORKSTATION01"
| EventType="ProcessRollup2" OR EventType="SyntheticProcessRollup2"
| FileName = "mimikatz.exe" OR CommandLine = "*sekurlsa*"

Query Microsoft Defender for Endpoint:

// Check MDE for technique artifacts from test machine:
DeviceProcessEvents
| where DeviceName == "test-workstation01"
| where Timestamp > ago(2h)
| project Timestamp, FileName, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc

// Check if LSASS access was detected:
DeviceEvents
| where DeviceName == "test-workstation01"
| where ActionType == "LsassProcessAccess"
| where Timestamp > ago(2h)

Build your coverage heatmap in ATT&CK Navigator:

1. Go to https://mitre-attack.github.io/attack-navigator/
2. Create new layer > Select ATT&CK version matching your testing
3. For each tested technique:
   - ALERTED → color: green (#00ff00), score: 3
   - TELEMETRY ONLY → color: yellow (#ffff00), score: 2
   - NO DETECTION → color: red (#ff0000), score: 1
   - NOT TESTED → no color (leave blank)
4. Export the layer as JSON for documentation
5. Generate the heatmap image for reporting

The resulting heatmap shows:
- Your current detection coverage across the ATT&CK matrix
- Techniques requiring new detection rules (yellow)
- Techniques requiring telemetry/policy changes (red)
- Gaps in high-priority tactic areas (credential access, lateral movement)

Build detection rules for telemetry-only gaps:

// Example: LSASS access was logged but not alerted
// Build a Sentinel detection rule from MDE telemetry:
DeviceEvents
| where ActionType == "LsassProcessAccess"
// Exclude legitimate processes that access LSASS:
| where InitiatingProcessFileName !in~ (
    "MsMpEng.exe",     // Windows Defender
    "csrss.exe",       // Windows system process
    "wininit.exe",     // Windows initialization
    "SecurityHealthService.exe"
)
| where InitiatingProcessFolderPath !startswith @"C:\Windows\System32\\"
// Alert on:
| project Timestamp, DeviceName, InitiatingProcessFileName,
    InitiatingProcessCommandLine, InitiatingProcessFolderPath
| order by Timestamp desc

Track coverage improvement over time:

After each gap remediation sprint:
1. Re-run the failed tests from the previous round
2. Update the ATT&CK Navigator layer
3. Calculate coverage score:
   Coverage % = (Alerted + Telemetry) / Total Tested × 100
   Target: >80% alert coverage for high-priority techniques

4. Track by tactic:
   - Credential Access coverage: X%
   - Lateral Movement coverage: Y%
   - Defense Evasion coverage: Z%  ← Usually the lowest; DET techniques are hardest