ProjectAchilles·blog

2026-06-01 · 1 min read · James Pichardo

Measuring Detection Coverage with MITRE ATT&CK

How we map every test result to ATT&CK techniques and turn raw executions into a coverage heatmap.

detectionmitre-attck

Every test in ProjectAchilles carries ATT&CK technique metadata, so each execution becomes a data point about a specific adversary behavior.

Tagging tests

A test declares its techniques in metadata:

// TechniqueTags maps a test binary to the ATT&CK techniques it exercises.
type TechniqueTags struct {
    Techniques []string `json:"techniques"` // e.g. ["T1059.001"]
    Tactics    []string `json:"tactics"`    // e.g. ["execution"]
}

Aggregating results

On the analytics side, an Elasticsearch aggregation groups executions by technique:

const coverage = await client.search({
  index: 'achilles-results-*',
  size: 0,
  aggs: {
    by_technique: {
      terms: { field: 'achilles.techniques', size: 500 },
      aggs: { protected: { filter: { term: { 'achilles.exit_code': 0 } } } },
    },
  },
});

Each technique bucket becomes a cell in the coverage heatmap: green where detections fired, red where the technique executed unnoticed. That red is your work queue.