mapping-mitre-attack-techniques

name	mapping-mitre-attack-techniques
description	Maps observed adversary behaviors, security alerts, and detection rules to MITRE ATT&CK techniques and sub-techniques to quantify detection coverage and guide control prioritization. Use when building an ATT&CK-based coverage heatmap, tagging SIEM alerts with technique IDs, aligning security controls to adversary playbooks, or reporting threat exposure to executives. Activates for requests involving ATT&CK Navigator, Sigma rules, MITRE D3FEND, or coverage gap analysis.
domain	cybersecurity
subdomain	threat-intelligence
tags	["MITRE-ATT&CK","ATT&CK-Navigator","Sigma","D3FEND","TTP","detection-engineering","NIST-CSF"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_ai_rmf	["MEASURE-2.7","MAP-5.1","MANAGE-2.4"]
atlas_techniques	["AML.T0070","AML.T0066","AML.T0082"]
d3fend_techniques	["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis"]
nist_csf	["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"]
mitre_attack	["T1591","T1592","T1593","T1589","T1685.002"]

Mapping MITRE ATT&CK Techniques

When to Use

Use this skill when:

• Generating an ATT&CK coverage heatmap to show which techniques your detection stack addresses
• Tagging existing SIEM use cases or Sigma rules with ATT&CK technique IDs for structured reporting
• Aligning your security program roadmap to specific adversary groups known to target your sector

Do not use this skill for real-time incident triage — ATT&CK mapping is an analytical activity best performed post-detection or during threat hunting planning.

Prerequisites

• Access to MITRE ATT&CK knowledge base (https://attack.mitre.org) or local ATT&CK STIX data bundle
• ATT&CK Navigator web app or local installation (https://mitre-attack.github.io/attack-navigator/)
• Inventory of existing detection rules (Sigma, Splunk, Sentinel KQL) to assess current coverage
• ATT&CK Python library: pip install mitreattack-python

Workflow

Step 1: Obtain Current ATT&CK Data

Download the latest ATT&CK STIX bundle for the relevant matrix (Enterprise, Mobile, ICS):

curl -o enterprise-attack.json \
  https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json

Use the mitreattack-python library to query techniques programmatically:

from mitreattack.stix20 import MitreAttackData

mitre = MitreAttackData("enterprise-attack.json")
techniques = mitre.get_techniques(remove_revoked_deprecated=True)
for t in techniques[:5]:
    print(t["external_references"][0]["external_id"], t["name"])

Step 2: Map Existing Detections to Techniques

For each SIEM rule or Sigma file, assign ATT&CK technique IDs. Sigma rules support native ATT&CK tagging:

tags:
  - attack.execution
  - attack.t1059.001