attack-mapping

name	attack-mapping
description	MITRE ATT&CK technique mapping for a CVE or every entry in `.vulnetix/memory.yaml`. Use when planning detection coverage gaps, mapping a CVE to defender controls, building an executive heatmap of repo risk by tactic, or correlating with internal D3FEND counter-techniques.
argument-hint	[<vuln-id>] | [--all-tracked]
user-invocable	true
allowed-tools	Bash, Read, Glob, Grep
model	sonnet
triggers	["map to ATT&CK","attack mapping","techniques used","mitre"]
chain	["vuln","detection-rules"]
outputBudget	short
cooldown	per-session

Vulnetix ATT&CK Mapping Skill

Use when

• You need to know which ATT&CK techniques a CVE enables (Initial Access? Execution? Persistence?).
• Building an executive heatmap: which tactics dominate this repo's risk profile.
• Mapping current detection coverage gaps via ATT&CK → D3FEND.
• Correlating multiple CVEs to a shared technique chain (e.g. T1190 + T1059).
• Producing input for a purple-team exercise.

Don't use for

• Generating detection rules for the IDS — use /vulnetix:detection-rules.
• Single-CVE deep-dive — use /vulnetix:exploits.
• IOC pivots — use /vulnetix:ioc-pivot.

Conventions

This skill follows _lib/contract.md: the Vulnetix CLI is auto-installed by hooks, .vulnetix/capabilities.yaml is always present, every vulnetix vdb call is piped through a verified jq filter from _lib/jq/, independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns.

Produces an ATT&CK technique view of repo risk. Run with a single vuln-id for a focused mapping, or --all-tracked to roll up every entry in .vulnetix/memory.yaml.

Step 1: Decide mode

If $ARGUMENTS matches a vuln-id pattern → single mode. Else if it contains --all-tracked → roll-up mode reading every vulnerabilities.* entry in .vulnetix/memory.yaml (skip those with status not_affected or fixed).

Step 2: Fetch ATT&CK data per vuln

vulnetix vdb attack-techniques "$VULN_ID" -o json | jq -f "${CLAUDE_PLUGIN_ROOT}/skills/_lib/jq/attack-techniques.jq"

Capture: technique IDs (T####), tactic, sub-technique, observed-in-wild count.

Step 3: Render

Single mode — table of techniques with tactic + observation count. Mermaid flowchart from kill-chain tactic → technique → vuln.