Bradford Health Services

MITRE

Sample data

ATT&CK

MITRE comparison

Prevention is counted only when a product can stop the technique. Expel is the investigation layer, so it scores as detection, not as a block.

Techniques mapped

24

Enterprise subset, not the full matrix

Observed in window

15

From Expel investigations, false positives excluded

Seen, not prevented

6

Observed, and no product blocks them

Blind spots

0

Observed with no detection either

Prevention rank

Share of mapped techniques each product can block.

1. EDR6/24

25% prevent · Endpoint

2. Identity5/24

21% prevent · MFA

3. Email2/24

8% prevent · Mail

4. DNS Filtering1/24

4% prevent · DNS

5. SOC0/24

0% prevent · Investigations

Visibility rank

Block or detect. This is where Expel belongs.

1. SOC24/24

0 block · 24 detect · 0 none

2. EDR15/24

6 block · 9 detect · 9 none

3. DNS Filtering6/24

1 block · 5 detect · 18 none

4. Identity5/24

5 block · 0 detect · 19 none

5. Email2/24

2 block · 0 detect · 22 none

By tactic

Block and detect counts inside each tactic. Reconnaissance and resource development are outside this control set.

Coverage by tactic and product
TacticSOCEDRDNS FilteringEmailIdentity
Initial Access40 block · 4 detect0 block · 2 detect0 block · 1 detect2 block · 0 detect1 block · 0 detect
Execution20 block · 2 detect1 block · 1 detect0 block · 0 detect0 block · 0 detect0 block · 0 detect
Persistence10 block · 1 detect0 block · 1 detect0 block · 0 detect0 block · 0 detect0 block · 0 detect
Privilege Escalation10 block · 1 detect0 block · 1 detect0 block · 0 detect0 block · 0 detect1 block · 0 detect
Defense Evasion20 block · 2 detect1 block · 1 detect0 block · 0 detect0 block · 0 detect0 block · 0 detect
Credential Access40 block · 4 detect1 block · 0 detect0 block · 0 detect0 block · 0 detect2 block · 0 detect
Discovery10 block · 1 detect0 block · 1 detect0 block · 1 detect0 block · 0 detect0 block · 0 detect
Lateral Movement10 block · 1 detect0 block · 0 detect0 block · 0 detect0 block · 0 detect1 block · 0 detect
Collection10 block · 1 detect0 block · 0 detect0 block · 0 detect0 block · 0 detect0 block · 0 detect
Command and Control30 block · 3 detect1 block · 2 detect1 block · 2 detect0 block · 0 detect0 block · 0 detect
Exfiltration20 block · 2 detect0 block · 0 detect0 block · 1 detect0 block · 0 detect0 block · 0 detect
Impact20 block · 2 detect2 block · 0 detect0 block · 0 detect0 block · 0 detect0 block · 0 detect

Techniques

B is block, D is detect, a dash is no coverage. Observed counts investigations opened in the window.

MITRE techniques compared across controls
TechniqueTacticSeenSOCEDRDNS FilteringEmailIdentity

T1566.001

Spearphishing attachment

Initial Access2DD—B—

T1566.002

Spearphishing link

Initial Access4D—DB—

T1190

Exploit public-facing application

Initial Access0DD———

T1078

Valid accounts

Initial Access4D———B

T1059.001

PowerShell

No prevention		Execution3DD———

T1204.002

Malicious file

Execution3DB———

T1547.001

Registry run keys

Persistence0DD———

T1078.002

Domain accounts

Privilege Escalation0DD——B

T1562.001

Disable security tools

Defense Evasion0DB———

T1027

Obfuscated files or information

No prevention		Defense Evasion1DD———

T1110.001

Password guessing

Credential Access0D———B

T1110.003

Password spraying

Credential Access2D———B

T1003.001

LSASS memory

Credential Access0DB———

T1557.001

LLMNR/NBT-NS poisoning

Credential Access0D————

T1046

Network service discovery

Discovery0DDD——

T1021.001

Remote desktop protocol

Lateral Movement0D———B

T1005

Data from local system

No prevention		Collection3D————

T1071.001

Web protocols

Command and Control4DDB——

T1573.002

Encrypted channel

No prevention		Command and Control1DDD——

T1105

Ingress tool transfer

Command and Control2DBD——

T1048.003

Exfiltration over unencrypted protocol

No prevention		Exfiltration1D—D——

T1567.002

Exfiltration to cloud storage

No prevention		Exfiltration2D————

T1486

Data encrypted for impact

Impact3DB———

T1490

Inhibit system recovery

Impact2DB———