| name | attack-lookup |
| description | Look up MITRE ATT&CK tactics, techniques, and mitigations, and map an observed behavior, finding, or detection to the right technique ID(s). Use whenever work needs a consistent ATT&CK reference — detection coverage, threat reports, red-team TTP planning, or tagging a finding. |
Goal
Correct, consistent ATT&CK references — the right tactic + technique ID(s) for a
behavior — so detections, reports, and emulation across the team all speak the same
language.
Steps
- Classify the behavior by adversary goal → that's the tactic (the "why":
Initial Access, Execution, Persistence, … Impact).
- Find the technique under that tactic that matches the "how"; pick the
sub-technique when one fits (e.g., T1059.001 PowerShell under T1059
Command and Scripting Interpreter). See
reference.md for the tactic list and
common techniques.
- Map to mitigations/data sources when relevant — what detects or prevents it
(feeds
detection-engineering).
- Cite precisely — technique ID + name, and note the ATT&CK version/domain
(Enterprise/Mobile/ICS). For anything beyond the common set, verify the current ID
against attack.mitre.org rather than guessing — IDs and sub-technique structure
change between versions.
Output
The matched tactic(s) + technique ID(s) with names, optional mitigation/data-source
pointers, and a one-line rationale for the mapping. For coverage gap analysis use
detection-engineering:detection-coverage-review; for actor TTP sets use
threat-intelligence.
Notes
ATT&CK is a living matrix — don't trust a memorized ID for an obscure technique;
confirm against the current version. Map to the most specific sub-technique that's
actually supported by evidence; over-precise tagging is as misleading as vague tagging.
See reference.md for the tactic taxonomy and frequently used techniques.
