ATT&CK coverage
What I tested with Atomic Red Team, what the default rules caught, and what they missed. The gaps drove the custom rules.
The default Wazuh ruleset caught 4 of 8 techniques. The misses included the most serious one, LSASS credential dumping, which was also a telemetry gap: Sysmon was not logging the access at all until I turned it on. Custom rules now cover every gap.
Execution
Caught by default rules 91837 / 91800 via script block logging.
Persistence
Missed by defaults. Custom rule 100030 covers Run/RunOnce writes.
Defaults caught the dropped script (92205), not the task itself. Rule 100050 names it.
Caught by default rules 60109 / 60110 from the Security log.
Defense Evasion
Caught by default rule 92021, though only level 3.
Credential Access
The headline gap. Missed, and the telemetry was missing too. Rule 100010 catches it after enabling ProcessAccess logging.
Discovery
Missed by defaults (whoami raises no alert). Custom rule 100020 now catches it.
Collection
Missed by defaults. Custom rule 100040 flags LOLBin archivers.