◎

ATT&CK Coverage View

Free Runs entirely in your browser

Paste your Sigma detection rules and see where you can — and can’t — catch an attacker across the MITRE ATT&CK matrix. We count a technique as covered only when a mapped rule can actually fire; tagged-but-broken rules show as fake coverage. Nothing you paste leaves your browser.

We extract MITRE technique IDs from attack.tXXXX tags (or bare IDs). A technique with 2+ rules shows as solid, 1 rule as partial, none as a gap.
ATT&CK Navigator layer

Copied to your clipboard. Paste into MITRE ATT&CK Navigator → “Open Existing Layer”. (Or copy from here.)