ATT&CK Coverage Matrix

Every attack in the $0 pentest stack, mapped to the MITRE ATT&CK technique it uses, the EHWS tool that drives it, the Windows Security event it generates, and whether your free Wazuh + Sigma stack actually catches it. Click any row for the detection logic and how to close a gap. Honest coverage — not every technique is caught by event logs alone.

Coverage reflects a $0 stack = native Windows Security auditing forwarded to Wazuh (free) + Sigma rules (free). PARTIAL usually means "needs a directory-service SACL or a tuned threshold rule"; GAP means it needs telemetry beyond event logs (Sysmon / network). Event IDs and ATT&CK IDs verified against Microsoft and attack.mitre.org.