LimaCharlie

The rules cover attacks on Windows, macOS and Linux. While the content of individual rules is Soteria's IP, you can check the dynamic MITRE ATT&amp;CK mapping here:

<a href="https://mitre-attack.github.io/attack-navigator/#layerURL=https%3A%2F%2Fstorage.googleapis.com%2Fsoteria-detector-mapping%2F%2Fall.json" rel="nofollow noopener noreferrer" target="_blank">All rules</a>

<a href="https://mitre-attack.github.io/attack-navigator/#layerURL=https://storage.googleapis.com/soteria-detector-mapping//windows.json" rel="nofollow noopener noreferrer" target="_blank">Windows</a>

<a href="https://mitre-attack.github.io/attack-navigator/#layerURL=https://storage.googleapis.com/soteria-detector-mapping//linux.json" rel="nofollow noopener noreferrer" target="_blank">Linux</a>

<a href="https://mitre-attack.github.io/attack-navigator/#layerURL=https://storage.googleapis.com/soteria-detector-mapping//mac.json" rel="nofollow noopener noreferrer" target="_blank">macOS</a>

- <a href="https://mitre-attack.github.io/attack-navigator/#layerURL=https%3A%2F%2Fstorage.googleapis.com%2Fsoteria-detector-mapping%2F%2Fall.json" rel="nofollow noopener noreferrer" target="_blank">All rules</a>
- <a href="https://mitre-attack.github.io/attack-navigator/#layerURL=https://storage.googleapis.com/soteria-detector-mapping//windows.json" rel="nofollow noopener noreferrer" target="_blank">Windows</a>
- <a href="https://mitre-attack.github.io/attack-navigator/#layerURL=https://storage.googleapis.com/soteria-detector-mapping//linux.json" rel="nofollow noopener noreferrer" target="_blank">Linux</a>
- <a href="https://mitre-attack.github.io/attack-navigator/#layerURL=https://storage.googleapis.com/soteria-detector-mapping//mac.json" rel="nofollow noopener noreferrer" target="_blank">macOS</a>

How do I know what Soteria rules cover?