Original framework · Measured on synthetic data · 3/5
Where mapped and fired disagree.
The D3FEND Wall drew where defenses are mapped, every defensive technique against every attacker technique joined through the artifact they share, with the empty cells left visible. The wall's central claim was that much of what a program counts as coverage would not, in practice, catch the attack, and it deferred the test of that claim to a case study. This is the case study. I planted eight ATT&CK techniques into synthetic telemetry, projected it to OCSF, ran Sigma rules over it, and measured what actually fired, then set the measured result against what the wall would have promised. The contribution is the join: a measured firing result tied to the wall's own gaps, every gap-to-defense edge carrying its trust tier, with the priors that own each separate move standing behind it.
What the wall established
A map of possible coverage, not measured detection.
I will not re-derive the wall here, only carry forward what it settled. Defense and offense meet at the digital artifact, the shared vocabulary of the things that exist on a system, and the join works because a control can only catch what leaves evidence it can see. The matching rule that makes the join honest is a subclass walk: an attack artifact matches a defense artifact when it equals it or descends from it. Naive string matching reproduced only 562 of D3FEND's own 1,904 inferred connections, dropping about seventy percent of the real coverage, while the subclass walk reproduces all 1,904 with zero missed and extends them through the contains and identifies links the published view never showed.
Built against D3FEND v1.4.0, the raw join is 200 atomic defensive techniques against the 462 ATT&CK techniques that carry artifacts. Two filters clean it. Identifier Activity Analysis shares an artifact with every attack, a coverage that fires for everyone and discriminates no one, so it comes off as noise. With it gone, 27 attacks are left with no artifact any remaining defense watches, and they drop off the grid. What remains is 435 attacks against the 120 defenses that cover any of them, 5,616 connections. I re-ran the extraction on 2026-06-22 to confirm those figures against the source: 120 columns split 42 broad and 78 laser, 435 rows split 51 hard-to-defend and 384 broad-covered, 5,616 cells, with the 27 zero-defense set falling out exactly as the wall reported.
The hinge for everything that follows is what that structure is and is not. An artifact-sharing edge says a defense could observe what an attack produces, not that any deployment tuned a rule to catch it. The wall measures the structure of coverage, not its quality, so a green cell is a possibility of coverage rather than a guarantee of detection. That distinction is easy to state and easy to lose, and the rest of this essay is an attempt to measure it instead of asserting it.
Running real detections against the gaps
Three fired, one drowned the analyst, four missed.
The bench is small and I want it described honestly before any result rides on it. I planted eight ATT&CK techniques into a synthetic telemetry store, projected the rows to OCSF classes (process 1007, network 4001, DNS 4003, authentication 3002, API 6003), and ran Sigma rules over the projection. The run is deterministic and fingerprinted: the ground-truth set hashes to a stable value and a rerun reproduces the per-technique scores identically. This is evidence tier B, a synthetic single-machine testbed, which sizes a method rather than certifying a deployment. Eight techniques is a probe, not a survey.
The headline is three of eight detected. PowerShell execution (T1059.001) caught on encoded-command analysis in the process class, application-layer C2 (T1071) caught on a malicious-domain rule against DNS, and no-MFA privilege escalation through account manipulation (T1098) caught on an API-class rule. Each of the three fired against its planted needle at precision 1.0, one true positive and zero false positives, which is what a clean detection looks like when the rule, the field, and the OCSF class all line up.
One technique is the other half of the lesson. RDP-based lateral movement (T1021) compiled a rule, fired against the network class, and was useless: 2,960 matches, of which 2,959 were false positives and exactly one was the planted true positive, a precision of 0.0003. It fires and buries the analyst. This is the base-rate problem from Axelsson in 2000 and Sommer and Paxson in 2010 made concrete on real rows: a control present in the coverage count, firing, and at that precision indistinguishable from noise. On the wall, T1021 would read as covered. In the run, it is worse than a gap, because a gap is silent while this one generates three thousand alerts a competent analyst has to learn to ignore.
Four techniques missed outright, with no rule compiled and no needle caught: LSASS-memory credential access (T1003.001), exfiltration over an alternative protocol (T1048), brute force (T1110), and inhibit system recovery (T1490). Their miss reason is recorded plainly as no rule or no needle. This is measured runtime firing against planted ground truth, the thing a coverage count cannot tell you, because the coverage count records that a defense and an attack share an artifact and stops there.
The disagreement, measured
Seventy-four leads, none surviving a trust filter.
For each of the four missed techniques, I asked what the wall and the graph behind it would have offered, and I tiered the trust on every edge it returned. The graph resolved leads for all four: ten D3FEND defenses that may counter LSASS credential access, twenty-six for the alternative-protocol exfiltration, twenty-five for brute force, and thirteen for inhibit recovery. That is seventy-four gap-to-defense edges across the four techniques where the measured run found nothing.
Every one of those seventy-four edges is the same kind. Each carries a proxy quality of artifact_cooccurrence, a trust of 0.25, and a weak flag, joined through the inferred matrix rather than a curated mapping. When I apply a minimum-trust filter at 0.6, the number that survives across all four techniques is zero, and the curated-mitigation count on each of the four is also zero. So the design-time map would have drawn green where the measured run found nothing, and the moment you tier the trust on each edge, the entire offered coverage resolves to leads with none established. The disagreement is not rhetorical. It is seventy-four edges on one side and zero firings on the other, and the bench records both.
The matrix those edges come from is itself worth naming precisely, because the inference is doing more work than the word "mapping" admits. D3FEND's official inferred matrix is 14,004 rows of artifact co-occurrence, not direct d3f:counters edges. A row says a defense and a technique touch the same artifact, which is why the bench labels each lead intent-blind: the join does not know the attacker meant to produce the artifact, only that the artifact is shared. The coverage record states the rule it follows directly, that an intent-blind artifact-cooccurrence lead at trust 0.25 is a possibility of coverage and not a measured detection, that counters is not the same as detects, and that a may-counter lead is never collapsed into the detected count. Three of eight is the detected count, and it stays three of eight no matter how many leads the graph offers for the four it missed.
T1021 is the same lesson read from the other direction. Where the four missed techniques are mapped-but-not- firing, RDP lateral movement is mapped, firing, and at precision 0.0003 still not a working detection. Both failures are invisible to a coverage count and both are visible in a measured run, which is the whole reason to run one.
The 27 zero-defense techniques
Artifacts that exist with no control watching them.
The four the bench missed are thinly covered on the wall, but they are on it. There is a sharper category, the 27 attacks that fall off the grid entirely. After the subclass, contains, and identifies matching is run, and after the ubiquitous Identifier Activity Analysis is removed as noise, these 27 have digital artifacts that exist but no remaining D3FEND technique watches those artifacts. For the four missed techniques the gap-to-defense edges are all 0.25 leads; for these 27 there is no edge at all. I list all 27 rather than a sample, because the point is the completeness of the hole, not an illustrative few.
They cluster. The inter-process-communication family is the heaviest presence, four techniques: T1559 Inter-Process Communication itself with T1559.001 Component Object Model, T1559.002 Dynamic Data Exchange, and T1559.003 XPC Services. A file-hiding and defense-evasion group runs alongside it: T1564.001 Hidden Files and Directories, T1564.004 NTFS File Attributes, T1564.009 Resource Forking, T1036.002 Right-to-Left Override, T1036.007 Double File Extension, T1070.006 Timestomp, and T1027.006 HTML Smuggling. Three are data-from-information-repositories: T1213.004 Customer Relationship Management Software, T1213.005 Messaging Applications, and T1213.006 Databases. Process-injection plumbing shows up as T1055.005 Thread Local Storage and T1055.008 Ptrace System Calls. A collection trio sits in the set, T1115 Clipboard Data, T1056.002 GUI Input Capture, and T1113 Screen Capture. The remainder spread across tactics: T1578.001 Create Snapshot, T1006 Direct Volume Access, T1562.012 Disable or Modify Linux Audit System, T1553.001 Gatekeeper Bypass, T1491.001 Internal Defacement, T1547.015 Login Items, T1106 Native API, and T1049 System Network Connections Discovery. That is the full set of 27, every one a technique whose artifacts no remaining defense watches.
I want to be exact about what zero-defense means and what it does not. It is a fact about where D3FEND has and has not mapped defenses, not a claim these techniques are undefendable in the field. A SOC can absolutely catch clipboard capture or a timestomp; what the wall reports is that, in the v1.4.0 ontology, the artifacts these techniques produce have no D3FEND control relating to them after the matching is done. The hole is in the defensive knowledge graph, not necessarily in any given deployment, and conflating those two would be exactly the overclaim the bench exists to avoid.
One honest caution about the join between this section and the last. The bench planted eight techniques, and none of its four misses are among the 27. T1003.001, T1048, T1110, and T1490 are all on the wall, thinly covered, which is why the graph offered leads for them at all. The 27 are the structural holes the bench has not yet probed, and they are the obvious next planting target: a second run that plants several of the inter-process-communication and file-hiding techniques would test whether the structural zero on the wall corresponds to a measured zero in a tuned stack, which is the question this case study opens rather than closes.
Where this stops short
Design-time reasoning, not a runtime join.
These limits bound the result, so I will state each one plainly. The most important is that there is no runtime record-to-defense hop. I cannot take an OCSF event payload and join it automatically to a countermeasure, because the OCSF d3fend object rides only the remediation-activity path, not the raw telemetry classes a detection reads. Everything here is design-time reasoning over the schema set against a measured firing result, not a runtime link from an event to a control. When the graph offers a lead for a missed technique, that lead is reached through the design-time map, and the firing result is what tells you whether anything in the deployment actually acted.
Second, the 14,004-row matrix behind every offered lead is artifact co-occurrence inference, not d3f:counters edges, so the leads are possibilities by construction and the trust tier is the honest way to carry that. Third, the wall is answering the detect-phase question; coverage colored by hardening or response is not detection, and the bench scores firing, which keeps the two from blurring. Fourth, this is tier B, synthetic, single machine, eight techniques. It sizes the method and demonstrates the join. It does not certify any deployment, and reading it as a deployment audit would be precisely the move the wall essay warned against.
Two more limits sit underneath the data itself. The D3FEND-to-CCO grounding is shallow: D3FEND v1.4.0 imports the Common Core Ontologies through a hand-curated bridge of roughly sixteen axioms, a top-class alignment rather than a grounding of the digital-artifact leaves, which is sound at the upper classes and wrong on the artifact subtree if you push it that far. And the figure I lean on for how disconnected the artifact leaves are from OCSF, that roughly 97.7 percent of the DigitalArtifact leaves carry no OCSF link (14 of 607), is my own measurement from 2026-06-03, not a community statistic. No competing public quantification of that exists that I have found, so I publish it only as SDW-measured and would change it the moment someone measures it independently.
Taken together these say the result is narrow and the method is the point. I measured a real disagreement between mapped and fired on a synthetic probe, and I tiered the trust on every edge so the disagreement is legible rather than asserted. What I have not done is run this against a production stack, which is the work that would turn a sized method into a certified finding.
The priors named
Each move is owned. The join is the white space.
I want to attribute rather than claim, because every individual move in this method belongs to someone, and the contribution is only in how they are combined. MITRE's ATT&CK Evaluations own measured firing during emulation, grading each substep against telemetry and analytics, and they are the strongest measured prior in the field. What they do not do is measure your deployment, because they measure vendor products in MITRE's lab, and they carry no per-edge provenance back to the schema a detection reads. Tidal Cyber owns the rhetorical thesis in market, that coverage measures presence and not performance, which I treat as the position to improve on rather than a strawman. ipurple.team already attaches simulation-gated confidence to per-technique coverage, so trust-tiering itself is not novel and I do not pitch it as such. MITRE's CAR Analytic Coverage Comparison is the nearest honest-framing prior, openly a mapped cross-walk and explicitly not measured firing. Atomic Red Team is honest in the firing direction, running an atomic and seeing whether it fires, with no mapping claim.
The conceptual frame is older still. Jared Atkinson's Funnel of Fidelity and Capability Abstraction work owns the idea that a mapped technique is not a working detection and that coverage is a layer-dependent illusion. Anton Chuvakin's SOC visibility triad and broken-collector argument is the closest practitioner framing, and SDW sits one level below it, at the OCSF class-and-field grain. Ryan Stillions named the detection-maturity ladder in 2014. The rigorous form is academic: Sommer and Paxson's 2010 argument that anomaly detection inverts a model's strength, and Axelsson's 2000 base-rate fallacy, are why mapped coverage overstates efficacy, and T1021's precision of 0.0003 is that arithmetic made concrete on real rows.
So what is new here is not any single move and not an originality claim. No prior I found ties the trust tier on a defensive edge to whether the OCSF class and field a detection depends on is actually populated and firing in a given run, set against the design-time map, with per-edge provenance back to the schema. The defensible position is the three together as one instrument: OCSF-grounded, measured in the deployment under test, and per-edge trust-tiered against the wall's structure. The join is the white space, and this case study is the first measurement that the join produces a disagreement worth reading, seventy-four leads on the mapped side and three firings on the measured side, with the gap between them recorded rather than argued.