Detection engineering portfolio with proof boundaries attached.
This page shows the public detection-engineering surface: detection IDs, validation status, ATT&CK mapping where represented, proof ceilings, and runtime/public signal boundaries.
Public inspection layer
Portfolio
Each card keeps validation, proof ceiling, and runtime/signal boundary visible so detection work cannot be over-promoted.
Endpoint / PowerShell
T1059.001 · Command and Scripting Interpreter: PowerShell
Endpoint / Persistence
Persistence: service creation — ATT&CK mapping in source artifact
Endpoint / Persistence
Scheduled Task/Job: Scheduled Task — ATT&CK mapping in source artifact
Cloud / IAM
Cloud / IAM denial — mapping in source/proof artifacts
Identity / Access Behavior
ATT&CK-aligned identity behavior (mapping per detection)
Telemetry / Defense Evasion
Defense evasion / telemetry tamper — mapping in source artifact
Network / Visibility Contract
Boundary / corroboration contract — not a coverage claim
Pipeline / Telemetry Contract
Pipeline route contract — not an ATT&CK detection proof
Mapping
Cyber Kill Chain and ATT&CK mapping help reviewers understand lifecycle stage, detection intent, and coverage. They do not prove live telemetry, runtime deployment, signal observation, or customer use.
Reconnaissance
Use this stage to inspect visibility planning, identity-context validation, and gap tracking without inferring live coverage.
Strongest reviewer artifact: ID-DET validation reports and HO-NDR-001 / HO-PIPE-001 boundary contracts.
Weaponization
Use this stage to see how behaviors become testable detection artifacts and where proof records do or do not exist.
Strongest reviewer artifact: Proof records for HO-DET-001, HO-DET-011, HO-DET-012, and AWS-DET-001 where present.
Delivery
Use this stage for cloud-access fixture review only; it does not assert a live AWS deployment.
Strongest reviewer artifact: AWS-DET-001 proof record and proof card.
Exploitation
Use this stage to trace PowerShell execution detection from ATT&CK mapping through source, validation, and proof boundary.
Strongest reviewer artifact: HO-DET-001 proof record, proof card, Proof Pack 001, and validation report.
Routes
