Maneuver Calculus

A framework for working out whether your defenses actually cover a given adversary behavior — and for saying "we don't know" when they don't.

Security teams answer coverage questions from a control inventory: the EDR is deployed, the rule is enabled, so the technique is covered. That inventory cannot tell you that the rule's telemetry died last Tuesday, that the rule keys on a filename the adversary changes for free, or that nobody ever tested whether it fires. Maneuver Calculus models one adversary procedure at a time — what it needs, what it does, what it leaves behind — and derives the coverage answer from what your detections are actually keyed on and actually receiving, instead of taking anyone's word for it. Where the model cannot derive an answer, it returns the gap rather than a verdict: an unmodeled behavior is never reported as covered.

It does not replace ATT&CK. It works one level below the technique, at the individual procedure, and maps up to it — see MC for ATT&CK users.

Detection engineers and threat researchers deciding what to key a rule on. Incident responders reconstructing what a foothold made possible. Anyone who has to defend a coverage claim to someone who will check it.