| name | implementing-threat-modeling-with-mitre-attack |
| description | Implements threat modeling using the MITRE ATT&CK framework to map adversary TTPs against organizational assets, assess detection coverage gaps, and prioritize defensive investments. Use when SOC teams need to align detection engineering with threat landscape, conduct threat assessments for new environments, or justify security tool procurement.
|
| domain | cybersecurity |
| tags | ["soc","mitre-attack","threat-modeling","ttp","detection-coverage","attack-navigator","risk-assessment"] |
| subdomain | soc-operations |
| version | 1.0 |
| author | oyi77 |
| license | Apache-2.0 |
| nist_ai_rmf | ["MEASURE-2.7","MAP-5.1","MANAGE-2.4"] |
| atlas_techniques | ["AML.T0070","AML.T0066","AML.T0082"] |
| d3fend_techniques | ["File Metadata Consistency Validation","Application Protocol Command Analysis","Identifier Analysis","Content Format Conversion","Message Analysis"] |
| nist_csf | ["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"] |
Implementing Threat Modeling With Mitre Attack
Overview
Cybersecurity skill for implementing threat modeling with mitre attack. Follows industry best practices and security standards.
When to Use
Trigger phrases:
- "implementing threat modeling with mitre attack"
- "SOC teams need to assess detection coverage against relevant threat actors and t"
- "Security leadership requires threat-informed defense prioritization"
- "New environments (cloud migration, OT integration) need detection strategy plann"
Use this skill when:
- SOC teams need to assess detection coverage against relevant threat actors and their TTPs
- Security leadership requires threat-informed defense prioritization
- New environments (cloud migration, OT integration) need detection strategy planning
- Purple team exercises require structured adversary emulation based on threat models
- Annual risk assessments need ATT&CK-based threat landscape analysis
Do not use as a one-time exercise — threat models must be continuously updated as adversary TTPs evolve and organizational attack surface changes.
When NOT to Use
- When you lack proper authorization for testing
- For production systems without change management
- When the task requires legal or compliance expertise beyond technical scope
Prerequisites
- MITRE ATT&CK framework knowledge (Enterprise, ICS, Mobile, or Cloud matrices)
- ATT&CK Navigator tool (web or local) for layer visualization
- Current detection rule inventory mapped to ATT&CK technique IDs
- Threat intelligence on adversary groups targeting your sector
- Organizational asset inventory with criticality classifications
Workflow
import re
IOC_PATTERNS = {
"ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
"domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
"hash_md5": r"\b[a-f0-9]{32}\b",
"hash_sha256": r"\b[a-f0-9]{64}\b",
}
def extract_iocs(text: ) -> :
{k: re.findall(v, text) k, v IOC_PATTERNS.items()}
