---
name: mitre-attack-mapping
description: Map observed malware behaviors to MITRE ATT&CK techniques, assess confidence levels, and generate ATT&CK Navigator layers for visualization and reporting.
---

# MITRE ATT&CK Mapping

Map observed malware behaviors to the MITRE ATT&CK framework. This skill covers observing behaviors, mapping to techniques with confidence levels, looking up technique details, and generating ATT&CK Navigator layers for visualization.

## Prerequisites

- **Python 3.10+** for running lookup and Navigator layer scripts
- **ATT&CK data**: Bundled technique database (`assets/attack-data.json`)
- **ATT&CK Navigator**: Web-based visualization tool for importing generated layers (https://mitre-attack.github.io/attack-navigator/)

## Steps

### 1. Observe and Document Behaviors

During analysis, document each observed behavior:
- API calls and system interactions
- File system modifications (creation, deletion, encryption)
- Registry modifications
- Network communications (protocols, destinations, patterns)
- Process creation and injection
- Persistence mechanisms
- Defense evasion techniques

### 2. Look Up ATT&CK Techniques

Use the technique lookup script to find matching techniques:

```bash
# Search by keyword
python3 scripts/technique_lookup.py --search "process injection"

# Look up specific technique by ID
python3 scripts/technique_lookup.py --id T1055

# Search by tactic
python3 scripts/technique_lookup.py --tactic defense-evasion

# Get detection and mitigation info
python3 scripts/technique_lookup.py --id T1055 --detail full
```

The lookup uses bundled ATT&CK data from `assets/attack-data.json`. See `references/attack-mapping-guide.md` for mapping methodology.

### 3. Assess Confidence Levels

For each mapping, assign a confidence level:

- **High (80-100)**: Direct observation of the technique (e.g., saw `CreateRemoteThread` call into another process = T1055)
- **Medium (50-79)**: Strong indicators but not definitive (e.g., suspicious registry key at Run location, but could be legitimate)
- **Low (20-49)**: Possible but unconfirmed (e.g., packed binary may indicate defense evasion, but packing alone is insufficient)

### 4. Generate ATT&CK Navigator Layer

Create a Navigator layer for visualization:

```bash
python3 scripts/attack_navigator_layer.py \
    --name "TrojanX Analysis" \
    --techniques "T1055:high,T1071.001:high,T1082:medium,T1547.001:high,T1027:low" \
    --output trojanx_layer.json
```

Options:
- `--techniques` format: `TECHNIQUE_ID:confidence` (comma-separated)
- `--color-scheme` options: `confidence` (default), `tactic`, `custom`
- `--description` adds a layer description
- `--comments` adds technique-level comments from a JSON file
- `--metadata` adds custom metadata to techniques

Import the generated JSON into ATT&CK Navigator at https://mitre-attack.github.io/attack-navigator/

### 5. Review Detection Recommendations

After mapping, get detection guidance:

```bash
python3 scripts/technique_lookup.py --id T1055 --detail full
```

See `references/detection-recommendations.md` for detection recommendations organized by technique.

### 6. Document in Report

Include in the final report:
- Table of mapped techniques with confidence levels
- Navigator layer screenshot or link
- Detection recommendations for the observed techniques
- Comparison to known threat actor TTPs

## References

- `references/attack-mapping-guide.md` — Effective ATT&CK mapping methodology
- `references/detection-recommendations.md` — Detection recommendations by ATT&CK technique
- `assets/attack-data.json` — Bundled ATT&CK Enterprise technique data
- `assets/navigator-template.json` — Template ATT&CK Navigator layer