Why EDR Alone is Not Enough: The '100% Coverage' Myth and the Living off the Land Blind Spot

迎健太

Is MITRE Engenuity's "100% Detection" real? Analyzing the structural limitations of standalone EDR through empirical third-party data and LotL attack techniques.

Why Intrusions Don't Stop Despite Deploying EDR

"We have EDR deployed. Therefore, we should be detecting major threats, both known and unknown." This is what many security managers believe. In fact, major EDR vendors like CrowdStrike and Cybereason have repeatedly issued press releases claiming "100% detection and 100% visibility" in MITRE Engenuity's "ATT&CK Evaluations." When weighing deployment costs against operational overhead, this "100%" figure easily becomes a reassuring factor that EDR alone can provide complete protection.

However, a joint advisory released by the US CISA, NSA, and FBI in February 2024 poured cold water on this sense of security. It was reported that the Chinese APT group Volt Typhoon had compromised US critical infrastructure and remained undetected for "at least five years" (Advisory AA24-038A). How was such long-term evasion possible in environments where EDR is widely deployed? The key to the answer lies in an attack technique known as "Living off the Land (LotL)."

The Reality of "100%": The Single-Scenario Premise

First, it is crucial to understand what the vendor-claimed "100%" actually means. MITRE Engenuity's evaluation measures the detection rate against "a single scenario" emulating the attack chain of a specific threat group (e.g., Cybereason's 2022 evaluation replicated real-world threat actor behavior). Cybereason itself explicitly stated in its release that the evaluation targeted "9 attack sequences and 109 attack behaviors."

On the other hand, the complete MITRE ATT&CK framework is a vast matrix spanning 14 tactics and 191 techniques. A single scenario covers only a tiny fraction of these paths. In other words, "100%" is neither a lie nor an exaggeration, but when properly understood, it means "100% against a specific scenario," not "100% against the entire ATT&CK framework." Distinguishing between the two is the first step in properly contextualizing common industry beliefs.

Why LotL Attacks Evade EDR Detection

LotL attacks are highly effective because they complete their attack chains using only legitimate, Microsoft-signed administration tools such as PowerShell, WMI, certutil, and PsExec. Attackers do not drop any malicious executables. Because many EDR detection logics rely on signature-based matching or cross-referencing with known IOCs (Indicators of Compromise), they have nothing to match against when no "malicious file" exists in the first place.

Even more challenging are the operational constraints that prevent organizations from blocking PowerShell or WMI due to business impact. These are legitimate tools routinely used by IT departments and system administrators. EDR vendors themselves acknowledge this limitation. Technical explanations from detection vendors like Vectra AI repeatedly point out that "to an endpoint alone, LotL looks like nothing more than a normal process execution." The joint advisory by CISA/NSA/FBI (February 2024) and AA23-144A (May 2023) warn of this exact methodology in active attacks against critical infrastructure.

Third-Party Empirical Data Highlights the Gaps

Aside from vendor claims, empirical data from independent research exists. The study "How does Endpoint Detection use the MITRE ATT&CK Framework?" by Virkud et al., presented at USENIX Security 2024, independently measured how many rules commercial products actually implement against the entire ATT&CK matrix.

The results showed that the open-source SigmaHQ scored the highest at 79%, followed by Carbon Black (EDR) at 55%, Splunk (SIEM) at 52%, and Elastic (SIEM) at 48%. Furthermore, when filtering out high-false-positive low- and medium-severity rules to measure only high-risk rules, the coverage dropped significantly: Splunk went from 52% to 25%, and Elastic from 48% to 26%. Out of 191 ATT&CK techniques, 53 (27.7%) had no rules implemented in any of the tested products.

It is important to note that the difference between these empirical measurements and vendor-claimed figures is simply a matter of "what is being measured." Vendor claims represent detection rates for specific scenarios, while the empirical data represents rule implementation coverage across the entire ATT&CK framework. Concluding that "vendors are lying" by simply comparing these two is incorrect. Additionally, Virkud et al. note in their paper that "ATT&CK coverage is an unsuitable metric for measuring the effectiveness of detection products." This study measured "whether a rule exists," not "whether it can successfully detect an actual attack." High coverage does not guarantee actual defensive capabilities, and low coverage does not automatically mean a system is defenseless. The metrics must be interpreted with an understanding of their true nature.

Why More Logs Isn't the Answer

While it is tempting to conclude that "since EDR alone is insufficient, we should just collect logs and perform correlation analysis," that approach is oversimplified. A study by Vectra AI shows that organizations receive an average of 2,992 alerts per day, with 63% of them left unaddressed. A USENIX 2022 study also highlights the high rate of false positives in detection alerts ("99% False Positives").

In other words, simply deploying a log management platform without proper strategy risks turning it into an "expensive trash can" that drowns teams in an alert storm. What matters is not the storage container for logs, but the design of which use cases to correlate, how to define anomalies, and the logic to execute these detections continuously without relying solely on manual effort.

Synthesis: The Structural Limits of Endpoint-Centric Design

Evaluating these common beliefs and counter-evidence reveals that the issue is not that "EDR products are inferior," but rather that the core design philosophy of "determining anomalies at the individual endpoint level" has structural limits. A LotL attack looks like a "normal process execution" when viewed from a single endpoint. However, the picture changes entirely when you correlate data across multiple endpoints and diverse log sources (such as authentication and network logs).

For example, if PowerShell is executed late at night from a finance department terminal that rarely uses it, or if a suspicious download via certutil is immediately followed by lateral movement to another terminal via PsExec, these events might go unnoticed in isolated logs. However, correlating them across timelines and sources flags them as an "anomalous combination." The solution is not to abandon EDR. EDR remains necessary as the first layer of endpoint defense; it is a necessary condition, but not a sufficient one. Organizations must shift their thinking toward placing a correlation engine capable of analyzing EDR, network, and authentication logs on a layer above EDR.

Solutions Offered by Yagura

Yagura maintains its own cost-effective Data Lake SIEM platform to support this correlation analysis. Because we develop and operate this infrastructure in-house, we can provide an environment to store and correlate EDR, network, and authentication logs without requiring the deployment of expensive legacy SIEM products.

Furthermore, to address the challenge of alert fatigue caused by increased log volume, we integrate automated investigations powered by AI SOC. Rather than forwarding raw alert matches directly to analysts, the AI automatically conducts initial investigations across related logs, presenting prioritized and contextualized findings to human teams. As Gartner notes in its October 2025 report, "Innovation Insight: AI SOC Agents," the core value of an AI SOC lies in "augmentation," not complete automation. Retaining human decision-making while removing the operational burden is essential to keeping log platforms from becoming "expensive trash cans."

Conclusion

Vendor claims of "100% detection" in EDR evaluations are not false, but they represent performance in specific scenarios, not comprehensive ATT&CK coverage. Independent studies show commercial product coverage ranges between 48% and 55%, and LotL attacks exploit this exact gap by leveraging legitimate tools without dropping malware.

This does not make EDR obsolete. EDR is still required as a foundational layer. However, by adding a layer above it to correlate multiple log sources, organizations can detect anomalies like LotL attacks that appear normal in isolation. Companies that have not yet deployed a SIEM or are constrained by costs often postpone this upper-layer design, but continuing to rely solely on the myth of total EDR coverage is the greatest risk of all.

Related Service: Learn more about Yagura AI SOC, which autonomously investigates EDR and SIEM alerts to automate initial containment steps.