1. Coverage matrix

Tactics are listed in roughly the order they appear in an intrusion. ● = a
shipped detection directly covers the technique; ◐ = partial / heuristic.

Tactic	Technique (ID)	Cov	Detection	Source file
Initial Access	Exploit Public-Facing Application (T1190)	●	Web Server Spawned A Shell Or Recon Binary	`sigma/rules/webshell_spawned_process.yml`
Initial Access	Valid Accounts (T1078)	●	SSH Brute Force Followed by Successful Login	`sigma/rules/ssh_bruteforce.yml`
Initial Access	Valid Accounts: Cloud (T1078.004)	●	AWS Root Account Console Login	`sigma/rules/aws_root_console_login.yml`
Execution	Command/Scripting: Unix Shell (T1059.004)	●	Remote Payload Piped Directly Into a Shell	`sigma/rules/suspicious_shell_pipe.yml`
Execution	Command and Scripting Interpreter (T1059)	◐	Package Management Inside Container	`falco/falco_rules.local.yaml`
Persistence	Server Software Component: Web Shell (T1505.003)	●	Web Server Spawned A Shell; Shell Spawned By Web Server	`sigma/…/webshell_spawned_process.yml`, `falco/…`
Persistence	Account Manipulation (T1098)	●	Sudoers Or Privileged Group Modification	`sigma/rules/sudoers_modification.yml`
Persistence	Create/Modify System Process: systemd (T1543.002)	●	Persistence Via Systemd Or Cron	`falco/falco_rules.local.yaml`
Persistence	Scheduled Task/Job: Cron (T1053.003)	●	Persistence Via Systemd Or Cron	`falco/falco_rules.local.yaml`

Included with Security Monitoring Setup