ATT&CK coverage

Observed means at least one step in an incident in this library carries the technique. Not observed means no incident in this library carries a step under this tactic — a fact about what was written, not a claim about what would be detected. The library is 5 written scenarios carrying 16 technique-mapped steps; the 5 tactics with nothing under them — Resource Development, Execution, Privilege Escalation, Discovery, Exfiltration — are tactics no scenario was written to show, and this page will not say anything else about them.

A technique identifier is a citation, not a finding: it says what a step resembles, not that the step is proven. The steps are on the incidents themselves.