This article explores the process of evaluating security tools against the ATT&CK framework, emphasizing the importance of detecting techniques.