MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T1200 Hardware Additions |
Event coverage
Stages and Predicates
Stage 1: selection
Neighbors
Often fire together
Rules that target events appearing in the same incident timelines. They pattern-match on adjacent steps of the same TTP, so an alert from one is often paired with alerts from these. Useful for triage context and for assembling chained-detection rules.