Kill-Chain Detection Coverage

Purpose

Operational coverage map for the ransomware kill-chain detection workstream. Shows which stages are covered, which agents handle them, what evidence is collected, and current gaps. Updated as agents ship.

For the full threat model context see security/threat-model/controls-mapping.md. For agent implementation specs see architecture/security-monitoring-architecture.md.

---

Coverage Map

Stage 1 — Initial Access

Status: COVERED

Detection	Source	Agent	Fires On
External auth anomaly	SignInLogs	entra_agent	MFA bypass, impossible travel, new country
Twingate access	Twingate_CL (LAW)	network_agent	New device, unknown connector
Firewall inbound hits	Palo Alto Threat logs	network_agent	Exploit/C2 signatures on inbound

---

Stage 2 — Execution

Status: COVERED

Detection	Source	Agent	Fires On
Suspicious process spawn	LAW EventID 4688	execution_agent	mimikatz, cobalt strike, mshta, wscript, rundll32 from unexpected parents
PowerShell script block	LAW EventID 4103/4104	execution_agent	Encoded commands, download-and-exec patterns
Process from user profile	LAW EventID 4688	execution_agent	Execution from %TEMP%, %APPDATA%, user home paths

Log dependency: Requires EventID 4688 (process creation) and 4104 (PowerShell script block) flowing to LAW. Enabled via Intune (home) and GPO (domain-joined). Verify with: SecurityEvent | where EventID == 4688 | count.

---

Stage 3 — Persistence

Status: COVERED

Detection	Source	Agent	Fires On
New Windows service	LAW EventID 7045	persistence_agent	Any new service install outside CM window
New scheduled task	LAW EventID 4698	persistence_agent	Task created outside CM window
Registry run key	MDCFileIntegrityMonitoringEvents	fim_agent	Changes to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and variants

---

Stage 4 — Credential Dumping

Status: COVERED

Detection	Source	Agent	Fires On
LSASS access	LAW EventID 4688	credential_dumping_agent	Process accessing lsass.exe — CRITICAL immediately
Multi-target auth spray	LAW EventID 4625, 4648	credential_dumping_agent	Failed then successful auth across multiple targets
Cortex behavioral	Cortex XDR REST API	cortex_agent	Credential dumping behavioral alert

---

Stage 5 — Lateral Movement

Status: COVERED

Detection	Source	Agent	Fires On
Account hitting 3+ machines	LAW EventID 4624	lateral_movement_agent	Same account on 3+ hosts in 30 minutes
Explicit credential use	LAW EventID 4648	lateral_movement_agent	Workstation-to-server explicit credential logon
Admin share access	LAW EventID 5140	lateral_movement_agent	C$, ADMIN$, IPC$ access

---

Stage 6 — Exfiltration

Status: COVERED

Detection	Source	Agent	Fires On
Large outbound transfer	Palo Alto traffic logs	exfiltration_agent	Bytes vs baseline, outside business hours
New external destination	Palo Alto App-ID	exfiltration_agent	Destination not seen in 30 days
Known exfil tools	Palo Alto App-ID	exfiltration_agent	RClone, WinSCP, Mega.nz App-IDs
DNS tunneling	DNS Security logs	exfiltration_agent	High-entropy subdomains, long TXT queries

---

Stage 7 — Defense Evasion

Status: COVERED

Detection	Source	Agent	Fires On
Security log cleared	LAW EventID 1102	defense_evasion_agent	Any clear = CRITICAL immediately
EDR silence	Cortex XDR REST API	defense_evasion_agent	0 findings while other agents elevated = HIGH
Security tool termination	LAW EventID 4688, Cortex	defense_evasion_agent	Known EDR process killed

---

Stage 8 — Encryption

Status: COVERED

Detection	Source	Agent	Fires On
Mass file modification	MDCFileIntegrityMonitoringEvents	fim_agent	High-rate changes to monitored paths
Cortex behavioral	Cortex XDR REST API	cortex_agent	Ransomware behavioral signature
Shadow copy deletion	LAW EventID 4688	execution_agent	vssadmin delete shadows, wmic shadowcopy delete

---

FIM Monitored Paths

File Integrity Monitoring via MDCFileIntegrityMonitoringEvents (7-day staleness threshold). Key monitored locations:

Windows:

• C:\Windows\System32\ (binary replacements)
• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run (persistence)
• C:\Program Files\ subdirectories (software installation)
• PHI data directories (encryption indicator)

Linux:

• /etc/ (config tampering)
• /bin/, /sbin/, /usr/bin/ (binary replacement)
• /etc/crontab, /etc/cron.d/ (persistence)

---

Log Dependency Map

EventID	Description	Enabled Via	Volume/Day (PROD)
4688	Process creation	GPO (servers) + Intune (home)	~645K
4104	PowerShell script block	GPO + Intune	~92K
4624	Successful logon	Default Windows auditing	~11K
4648	Explicit credential logon	GPO	~412
4698	Scheduled task created	GPO	~3/day
1102	Security log cleared	Default Windows auditing	0 (healthy)
7045	New service installed	Default Windows auditing	0 (healthy)
5140	Network share accessed	GPO	0 (healthy, no admin share activity)

Volume data from LAW queries, April 2026. Zero counts for 1102/7045/5140 indicate healthy environment, not missing logs — auditpol confirms audit policies are active.

---

Response Thresholds

Stage	Severity	Response Time Target
Initial Access	HIGH	Analyst pickup within 1 hour
Execution (suspicious)	CRITICAL	Immediate Telegram; analyst within 15 min
Persistence (outside CM)	HIGH	Analyst pickup within 1 hour
Credential Dumping	CRITICAL	Immediate Telegram; analyst within 15 min
Lateral Movement	CRITICAL	Immediate Telegram; analyst within 15 min
Exfiltration (large)	HIGH	Analyst pickup within 1 hour
Defense Evasion (log clear)	CRITICAL	Immediate Telegram; analyst within 15 min
Encryption (behavioral)	CRITICAL	Immediate; activate IR runbook

See runbooks/incident-response.md for the full response procedure.

---

Last updated: May 2026 — all 8 stages covered. Kill-chain Phase 2 agents live.