Mitre-Attack on Taha's/tags/mitre-attack/Recent content in Mitre-Attack on Taha'sHugo -- gohugo.ioentaha.marouani@etudiant-enit.utm.tn (Taha)taha.marouani@etudiant-enit.utm.tn (Taha)© 2026 TahaMon, 07 Sep 2026 14:28:07 +0100An Honest Coverage Map (and a Console That Never Makes Up a Number)/blog/6-ibm-wts-coverage/Mon, 07 Sep 2026 14:28:07 +0100taha.marouani@etudiant-enit.utm.tn (Taha)/blog/6-ibm-wts-coverage/Folding conversion, deployment and validation into one ATT&CK Navigator layer with two status rules that keep it from lying, plus a Carbon console over the same files.Proving a Detection Actually Fires/blog/5-ibm-wts-validation/Fri, 04 Sep 2026 14:28:07 +0100taha.marouani@etudiant-enit.utm.tn (Taha)/blog/5-ibm-wts-validation/Simulate the attack with Atomic Red Team, then re-run the rule’s own converted query over the attack window and ask it directly whether it matched. not_triggered is the honest answer.The ATT&CK v18 Renumbering Trap That Fakes Coverage Gaps/blog/3-ibm-wts-trap/Sat, 29 Aug 2026 14:28:07 +0100taha.marouani@etudiant-enit.utm.tn (Taha)/blog/3-ibm-wts-trap/ATT&CK v18 split defense-evasion and renumbered techniques. Any coverage tool with the old IDs baked in now reports gaps that don’t exist. Here’s the fix.Two Pipelines, One Choice: Converting Sigma to QRadar AQL/blog/2-ibm-wts-pipelines/Wed, 26 Aug 2026 14:28:07 +0100taha.marouani@etudiant-enit.utm.tn (Taha)/blog/2-ibm-wts-pipelines/IBM’s pySigma backend ships two conversion pipelines with very different trade-offs, and one of them fails open. Here’s how the converter picks, and what it records.What The Sigma: Translating Detections Is Solved, Trusting Them Isn't/blog/0-ibm-wts-overview/Thu, 20 Aug 2026 14:28:07 +0100taha.marouani@etudiant-enit.utm.tn (Taha)/blog/0-ibm-wts-overview/Why I built a detection-as-code pipeline around IBM’s own Sigma-to-QRadar backend, and why the interesting part isn’t the translation.