| name | attack-mapping |
| description | MITRE ATT&CK technique mapping for a CVE or every entry in `.vulnetix/memory.yaml`. Use when planning detection coverage gaps, mapping a CVE to defender controls, building an executive heatmap of repo risk by tactic, or correlating with internal D3FEND counter-techniques. |
| argument-hint | [<vuln-id>] | [--all-tracked] |
| user-invocable | true |
| allowed-tools | Bash, Read, Glob, Grep |
| model | sonnet |
| triggers | ["map to ATT&CK","attack mapping","techniques used","mitre"] |
| chain | ["vuln","detection-rules"] |
| outputBudget | short |
| cooldown | per-session |
Vulnetix ATT&CK Mapping Skill
Use when
- You need to know which ATT&CK techniques a CVE enables (Initial Access? Execution? Persistence?).
- Building an executive heatmap: which tactics dominate this repo's risk profile.
- Mapping current detection coverage gaps via ATT&CK → D3FEND.
- Correlating multiple CVEs to a shared technique chain (e.g. T1190 + T1059).
- Producing input for a purple-team exercise.
Don't use for
- Generating detection rules for the IDS — use
/vulnetix:detection-rules.
- Single-CVE deep-dive — use
/vulnetix:exploits.
- IOC pivots — use
/vulnetix:ioc-pivot.
Conventions
This skill follows _lib/contract.md: the Vulnetix CLI is auto-installed by hooks, .vulnetix/capabilities.yaml is always present, every vulnetix vdb call is piped through a verified jq filter from _lib/jq/, independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns.
Produces an ATT&CK technique view of repo risk. Run with a single vuln-id for a focused mapping, or --all-tracked to roll up every entry in .vulnetix/memory.yaml.
Step 1: Decide mode
If $ARGUMENTS matches a vuln-id pattern → single mode. Else if it contains --all-tracked → roll-up mode reading every vulnerabilities.* entry in .vulnetix/memory.yaml (skip those with status not_affected or fixed).
Step 2: Fetch ATT&CK data per vuln
vulnetix vdb attack-techniques "$VULN_ID" -o json | jq -f "${CLAUDE_PLUGIN_ROOT}/skills/_lib/jq/attack-techniques.jq"
Capture: technique IDs (T####), tactic, sub-technique, observed-in-wild count.
Step 3: Render
Single mode — table of techniques with tactic + observation count. Mermaid flowchart from kill-chain tactic → technique → vuln.
