A check that never ran is not a check that found nothing.

This page carries a per-technique evidence record across 84 MITRE ATT&CK techniques in a working detection library. It was published this morning with two columns; it is republished now with a different structure, because a public exchange changed what the right structure is. The change is described below rather than quietly applied.

What an evidence reference is, and whose idea it is

The framing here is Reza Adineh's, author of TID-CMM. His position, posted publicly: an evidence reference is an audit record, not a detection artefact — it can exist even when no detection artefact was produced. For a completed check the record has to state five things: what ran, whether execution succeeded, what evidence was expected, where it looked and in which time window, and what was observed. And three states must stay distinguishable rather than collapse into one: checked and not observed, not tested, and execution inconclusive.

The boundary applies to the positive column too

Everything here holds within the assessed configuration and tested conditions — and that qualifier binds the three observed rows exactly as hard as it binds the rest. A rule that fired on this bench is evidence about this bench. It is not a claim that the same technique is caught in an estate we have not measured.

The before-state, as a dated record rather than a memory

An earlier version of this page reported 66 techniques as unobservable. That version is a report, not a configuration record, and it should not be treated as one. What follows is the closest thing to a dated configuration artefact we actually hold, with its source and its limits.

Source. Container creation timestamps from the container runtime's own metadata. It is a machine record, not a reconstruction, and anyone with access to the host can reproduce it.

Limits, and they are real. Three of them. Creation time is not the same as the time a sensor began producing usable data — an earlier Zeek container existed roughly an hour before the one listed and was discarding packets on checksum offload, so it wrote connection records while every protocol analyser stayed silent. The record shows which components exist, not the configuration they ran with. And it can only speak for what runs in containers on this host; it cannot prove the absence of a sensor somewhere else.

The blind hour is unestablished, and this page now says so rather than asserting it. The sentence above states that an earlier Zeek container wrote connection records while every protocol analyser stayed silent. On 10 September 2026 we went to re-derive that from the bench and could not. The container was discarded, and the log volume now holds nothing earlier than conn.2026-09-09-03-56-05.log, which belongs to the replacement. The pin is still checkable: container creation timestamps come from the runtime and anyone with host access can read them. The scope is not: the artefact that would show the blindness no longer exists, so neither we nor a reader can recompute it.

We are keeping the sentence and labelling it rather than deleting it, because deleting it would remove the reason seven rows moved while leaving the movement. What it is now is a stated recollection with a stated reason it cannot be checked, which is a weaker thing than a measurement and should be read as one. Any figure on this page carrying our name is recomputable from data we ship. That sentence is not a figure, and it is not recomputable, and both facts belong next to it.

What it does establish. That no network sensor existed on this bench before 2026-09-09 02:54 UTC. That is the claim the seven-row change rests on, and it is the only claim we make from this table.

What changed since this morning, and why

The first version of this page reported 66 techniques as unknown. Since then we stood up a network sensor on the lab bridge — Zeek, feeding a Wazuh agent — and wrote detection rules against it. That moved seven techniques out of the unobservable column — into not tested, not into observed — and produced the first three evidence records on this page.

The sensor did not work on the first attempt, and the reason is worth stating: Zeek was discarding packets on checksum offload, so conn.log filled normally while every protocol analyser stayed silent. A sensor that is running, writing logs and reporting no errors can still be blind to every protocol on the wire. It took the -C flag and a measurement of the data side to tell the two apart.

Current sensor inventory: one Ubuntu host with a Wazuh agent (auth, process) and a Zeek instance on the lab bridge (conn, ssl, http). No Sysmon. No commercial EDR. No DNS — container queries resolve against the Docker internal resolver and never cross the bridge. No cloud, no Kubernetes, no OT.

The full list

84 rows. Technique links go to attack.mitre.org. Sigma column shows the first two rule names the library attaches, where it attaches any.

Raw data

Published rather than available on request, so every number above is recomputable:

• detection-evidence-map-84-techniques.json — per technique: data sources, both verdicts, Sigma rule names
• detection-evidence-map-84-techniques.csv — the same as a flat table