Threat-informed report

csa-ccm-4 - threat & detection coverage

Generated 2026-06-04 13:37 UTC from TTPI engine data
This report maps csa-ccm-4 controls to the MITRE ATT&CK techniques they address, then checks each technique against our detection corpus (Sigma, CAR, IDS, YARA, Falco). It shows, control by control, what attacks each control is meant to stop and whether those attacks are actually detectable today. Use it as the threat-informed backbone of an audit response or pentest report.

Coverage Summary

57
threat-mapped controls
213
ATT&CK techniques addressed
140
techniques we can detect
65%
detection coverage
Coverage = of the distinct techniques mapped to this framework, the share for which we hold at least one detection rule. Gaps below list controls with zero detection coverage - the priority remediation set.

AIS

49/64 techniques covered

DCS

22/43 techniques covered

DSP

62/77 techniques covered

I&S

105/130 techniques covered
I&S-09 Network Defense 31/40 detectable

IAM

171/249 techniques covered
IAM-16 Authorization Mechanisms 36/62 detectable
T1021.007 · Cloud Services ✓T1021.008 · Direct Cloud VM ConnectionsT1059 · Command and Scripting Interpreter ✓T1059.009 · Cloud API ✓T1070 · Indicator Removal ✓T1070.008 · Clear Mailbox DataT1074.002 · Remote Data StagingT1080 · Taint Shared ContentT1098 · Account Manipulation ✓T1098.001 · Additional Cloud Credentials ✓T1098.002 · Additional Email Delegate PermissionsT1098.003 · Additional Cloud Roles ✓T1098.004 · SSH Authorized Keys ✓T1098.005 · Device Registration ✓T1098.006 · Additional Container Cluster RolesT1136 · Create Account ✓T1136.003 · Cloud Account ✓T1204.003 · Malicious ImageT1213 · Data from Information Repositories ✓T1484 · Domain or Tenant Policy Modification ✓T1484.002 · Trust Modification ✓T1485 · Data Destruction ✓T1485.001 · Lifecycle-Triggered DeletionT1486 · Data Encrypted for Impact ✓T1490 · Inhibit System Recovery ✓T1491.002 · External DefacementT1496 · Resource Hijacking ✓T1496.001 · Compute HijackingT1496.002 · Bandwidth HijackingT1496.004 · Cloud Service HijackingT1530 · Data from Cloud StorageT1531 · Account Access Removal ✓T1535 · Unused/Unsupported Cloud RegionsT1537 · Transfer Data to Cloud Account ✓T1546 · Event Triggered Execution ✓T1548 · Abuse Elevation Control Mechanism ✓T1550 · Use Alternate Authentication Material ✓T1552.005 · Cloud Instance Metadata API ✓T1552.007 · Container API ✓T1555 · Credentials from Password Stores ✓T1556 · Modify Authentication Process ✓T1556.009 · Conditional Access PoliciesT1562 · Impair Defenses ✓T1562.001 · Disable or Modify Tools ✓T1562.007 · Disable or Modify Cloud FirewallT1562.008 · Disable or Modify Cloud LogsT1564 · Hide Artifacts ✓T1567 · Exfiltration Over Web Service ✓T1567.002 · Exfiltration to Cloud Storage ✓T1578 · Modify Cloud Compute Infrastructure ✓T1578.001 · Create SnapshotT1578.002 · Create Cloud InstanceT1578.003 · Delete Cloud Instance ✓T1578.004 · Revert Cloud InstanceT1578.005 · Modify Cloud Compute ConfigurationsT1602 · Data from Configuration RepositoryT1606 · Forge Web Credentials ✓T1610 · Deploy Container ✓T1648 · Serverless ExecutionT1651 · Cloud Administration CommandT1666 · Modify Cloud Resource HierarchyT1671 · Cloud Application Integration

LOG

18/33 techniques covered

UEM

71/102 techniques covered
Switch framework: NIST 800-53 · NIST CSF · CIS v8.1 · OWASP Web
Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities
Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs
Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures
Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1
About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service
threatengine.sh  ·  Open-source threat intelligence platform  ·  100+ authoritative sources  ·  Every fact traces to its origin