cyber-mapping-mitre-attack-techniques

name	cyber-mapping-mitre-attack-techniques
description	Maps observed adversary behaviors, security alerts, and detection rules to MITRE ATT&CK techniques and sub-techniques to quantify detection coverage and guide control prioritization. Use when building an ATT&CK-based coverage heatmap, tagging SIEM alerts with technique IDs, aligning security controls to adversary playbooks, or reporting threat exposure to executives. Activates for requests involvi
source	mukul975/Anthropic-Cybersecurity-Skills
license	Apache-2.0
authorized_lab	false
origin_frontmatter	name: mapping-mitre-attack-techniques | description: 'Maps observed adversary behaviors, security alerts, and detection rules | to MITRE ATT&CK techniques and sub-techniques to quantify detection coverage and | guide control prioritization. Use when building an ATT&CK-based coverage heatmap, | tagging SIEM alerts with technique IDs, aligning security controls to adversary | playbooks, or reporting threat exposure to executives. Activates for requests involving | ATT&CK Navigator, Sigma
hide	true

Defensive/analysis cyber skill. Source: mukul975/Anthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.

Mapping MITRE ATT&CK Techniques

When to Use

Use this skill when:

• Generating an ATT&CK coverage heatmap to show which techniques your detection stack addresses
• Tagging existing SIEM use cases or Sigma rules with ATT&CK technique IDs for structured reporting
• Aligning your security program roadmap to specific adversary groups known to target your sector

Do not use this skill for real-time incident triage — ATT&CK mapping is an analytical activity best performed post-detection or during threat hunting planning.

Prerequisites

• Access to MITRE ATT&CK knowledge base (https://attack.mitre.org) or local ATT&CK STIX data bundle
• ATT&CK Navigator web app or local installation (https://mitre-attack.github.io/attack-navigator/)
• Inventory of existing detection rules (Sigma, Splunk, Sentinel KQL) to assess current coverage
• ATT&CK Python library: pip install mitreattack-python

Workflow

Step 1: Obtain Current ATT&CK Data

Download the latest ATT&CK STIX bundle for the relevant matrix (Enterprise, Mobile, ICS):

curl -o enterprise-attack.json \
  https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json

Use the mitreattack-python library to query techniques programmatically:

from mitreattack.stix20 import MitreAttackData

mitre = MitreAttackData("enterprise-attack.json")
techniques = mitre.get_techniques(remove_revoked_deprecated=True)
for t in techniques[:5]:
    print(t["external_references"][0]["external_id"], t["name"])

Step 2: Map Existing Detections to Techniques

For each SIEM rule or Sigma file, assign ATT&CK technique IDs. Sigma rules support native ATT&CK tagging: