Technique ID and name - Procedure used (specific tool, command, method) - Timestamp and target system - Detection result (detected/not detected/partially detected) - Detection source (if detected): EDR, SIEM, network monitoring, user report - Time to detect (if detected) - Recommended detection impr