# Mitre Attck Reference > - Skill: `frank-luongt/mitre-attck-reference` (Agent Skill) - Install (CLI): `npx skillmds@latest add frank-luongt/mitre-attck-reference` - Raw SKILL.md: https://api.skillmd.com/api/skills/frank-luongt/mitre-attck-reference/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Coding & Dev Tools - Author: frank-luongt (https://skillmd.com/u/frank-luongt) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/frank-luongt/mitre-attck-reference --- --- name: mitre-attck-reference description: MITRE ATT&CK Enterprise framework reference for mapping adversary tactics, techniques, and detection guidance tags: [security, threat-intelligence] --- # MITRE ATT&CK Framework Reference ## Overview MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a globally recognized knowledge base of adversary behavior. The Enterprise matrix organizes attack patterns into 14 tactical phases that describe the progression of a cyberattack from initial reconnaissance through final impact. Security agents use ATT&CK to classify incidents, build detection logic, identify coverage gaps, and communicate threats using a shared vocabulary. The Enterprise matrix covers behaviors observed against Windows, macOS, Linux, cloud (AWS, Azure, GCP), network infrastructure, and container environments. Each technique has a unique identifier (e.g., T1566) and may include sub-techniques (e.g., T1566.001). ## When to Use This Skill - Classifying security incidents against a standardized taxonomy - Building or reviewing detection rules that need ATT&CK technique references - Performing threat coverage gap analysis across your detection stack - Writing incident reports that require ATT&CK mapping - Evaluating adversary emulation plans or red team findings - Correlating threat intelligence feeds with internal telemetry ## How It Works ### Step 1: Identify the Tactic Determine which tactical phase the observed activity falls under. The 14 Enterprise tactics in kill-chain order are: | ID | Tactic | Description | |-------|-------------------------|--------------------------------------------------| | TA0043 | Reconnaissance | Gathering information to plan an attack | | TA0042 | Resource Development | Establishing infrastructure and capabilities | | TA0001 | Initial Access | Gaining a foothold in the target environment | | TA0002 | Execution | Running malicious code | | TA0003 | Persistence | Maintaining access across restarts | | TA0004 | Privilege Escalation | Gaining higher-level permissions | | TA0005 | Defense Evasion | Avoiding detection | | TA0006 | Credential Access | Stealing credentials | | TA0007 | Discovery | Understanding the environment | | TA0008 | Lateral Movement | Moving through the network | | TA0009 | Collection | Gathering data of interest | | TA0011 | Command and Control | Communicating with compromised systems | | TA0010 | Exfiltration | Stealing data out of the network | | TA0040 | Impact | Disrupting availability or integrity | ### Step 2: Map the Technique Within the identified tactic, select the specific technique that matches the observed behavior. Key techniques per tactic: **Reconnaissance (TA0043):** T1595 Active Scanning, T1592 Gather Victim Host Info, T1589 Gather Victim Identity Info, T1590 Gather Victim Network Info, T1593 Search Open Websites/Domains, T1594 Search Victim-Owned Websites **Resource Development (TA0042):** T1583 Acquire Infrastructure, T1586 Compromise Accounts, T1584 Compromise Infrastructure, T1587 Develop Capabilities, T1585 Establish Accounts, T1588 Obtain Capabilities **Initial Access (TA0001):** T1566 Phishing, T1190 Exploit Public-Facing App, T1133 External Remote Services, T1078 Valid Accounts, T1195 Supply Chain Compromise, T1199 Trusted Relationship **Execution (TA0002):** T1059 Command and Scripting Interpreter, T1204 User Execution, T1203 Exploitation for Client Execution, T1047 WMI, T1053 Scheduled Task/Job, T1569 System Services **Persistence (TA0003):** T1053 Scheduled Task/Job, T1547 Boot/Logon Autostart, T1136 Create Account, T1098 Account Manipulation, T1543 Create/Modify System Process, T1546 Event Triggered Execution **Privilege Escalation (TA0004):** T1548 Abuse Elevation Control, T1134 Access Token Manipulation, T1068 Exploitation for Privilege Escalation, T1078 Valid Accounts, T1547 Boot/Logon Autostart, T1055 Process Injection **Defense Evasion (TA0005):** T1070 Indicator Removal, T1036 Masquerading, T1027 Obfuscated Files, T1055 Process Injection, T1218 System Binary Proxy Execution, T1562 Impair Defenses, T1112 Modify Registry **Credential Access (TA0006):** T1110 Brute Force, T1555 Credentials from Password Stores, T1003 OS Credential Dumping, T1558 Steal or Forge Kerberos Tickets, T1539 Steal Web Session Cookie, T1552 Unsecured Credentials **Discovery (TA0007):** T1087 Account Discovery, T1083 File and Directory Discovery, T1057 Process Discovery, T1018 Remote System Discovery, T1082 System Information Discovery, T1016 System Network Configuration **Lateral Movement (TA0008):** T1021 Remote Services, T1570 Lateral Tool Transfer, T1080 Taint Shared Content, T1550 Use Alternate Authentication Material, T1563 Remote Service Session Hijacking **Collection (TA0009):** T1560 Archive Collected Data, T1119 Automated Collection, T1005 Data from Local System, T1039 Data from Network Shared Drive, T1114 Email Collection, T1056 Input Capture **Command and Control (TA0011):** T1071 Application Layer Protocol, T1132 Data Encoding, T1573 Encrypted Channel, T1105 Ingress Tool Transfer, T1090 Proxy, T1572 Protocol Tunneling, T1571 Non-Standard Port **Exfiltration (TA0010):** T1041 Exfiltration Over C2 Channel, T1048 Exfiltration Over Alternative Protocol, T1567 Exfiltration Over Web Service, T1029 Scheduled Transfer, T1030 Data Transfer Size Limits **Impact (TA0040):** T1486 Data Encrypted for Impact, T1489 Service Stop, T1490 Inhibit System Recovery, T1485 Data Destruction, T1498 Network Denial of Service, T1496 Resource Hijacking ### Step 3: Find Sub-Techniques Many techniques have sub-techniques that provide finer granularity. For example: - T1566.001 - Phishing: Spearphishing Attachment - T1566.002 - Phishing: Spearphishing Link - T1566.003 - Phishing: Spearphishing via Service - T1566.004 - Phishing: Spearphishing Voice Always map to the most specific sub-technique available to improve detection precision and reporting accuracy. ### Step 4: Identify Detection Data Sources Each technique in ATT&CK lists recommended data sources. Common data source categories: | Data Source | Log Types | |--------------------------|-----------------------------------------------------| | Process | Sysmon (Event 1), EDR telemetry, auditd | | Network Traffic | Zeek/Bro logs, firewall logs, DNS logs, proxy logs | | File | Sysmon (Event 11, 15), file integrity monitoring | | Command | PowerShell ScriptBlock (4104), Bash history | | User Account | Windows Security (4624, 4625, 4720), LDAP audit | | Cloud Service | CloudTrail, Azure Activity Log, GCP Audit Log | | Application Log | Web server access logs, application audit logs | | Windows Registry | Sysmon (Event 12, 13, 14), Windows Security | ### Step 5: Build Detection Rules Use the mapped technique and data sources to create detection rules in your SIEM or detection platform. Reference the ATT&CK technique ID in every rule for traceability. ## Examples ### Example 1: Mapping a Phishing Attack to ATT&CK Scenario: A user received an email with a malicious Word document attachment. Opening it executed a PowerShell download cradle. ATT&CK mapping: - **Tactic:** Initial Access (TA0001) - **Technique:** T1566.001 - Phishing: Spearphishing Attachment - **Follow-on Tactic:** Execution (TA0002) - **Follow-on Technique:** T1059.001 - Command and Scripting Interpreter: PowerShell Detection data sources: - Email gateway logs (attachment metadata, sender reputation) - Sysmon Event 1 (process creation: WINWORD.EXE spawning powershell.exe) - PowerShell ScriptBlock Logging (Event 4104) - Network traffic (outbound HTTP/HTTPS to uncommon domains) ### Example 2: Mapping Lateral Movement to ATT&CK Scenario: An attacker used stolen credentials to establish RDP sessions across multiple internal hosts. ATT&CK mapping: - **Tactic:** Lateral Movement (TA0008) - **Technique:** T1021.001 - Remote Services: Remote Desktop Protocol - **Supporting Tactic:** Credential Access (TA0006) - **Supporting Technique:** T1078 - Valid Accounts Detection data sources: - Windows Security Event 4624 (Type 10 - RemoteInteractive logon) - Windows Security Event 4625 (failed logon attempts) - Network traffic (port 3389 connections between internal hosts) - EDR telemetry (new RDP client processes on workstations) ### Example 3: YAML-Based Detection Rule Referencing ATT&CK ```yaml title: Suspicious PowerShell Download Cradle id: 7f3b2a1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c status: production description: > Detects PowerShell commands commonly used as download cradles, often observed after initial access via phishing attachments. references: - https://attack.mitre.org/techniques/T1059/001/ - https://attack.mitre.org/techniques/T1566/001/ tags: - attack.execution - attack.t1059.001 - attack.initial_access - attack.t1566.001 logsource: product: windows category: ps_script definition: "PowerShell ScriptBlock Logging (Event 4104) must be enabled" detection: selection_keywords: ScriptBlockText|contains: - "Invoke-WebRequest" - "Invoke-RestMethod" - "Net.WebClient" - "Start-BitsTransfer" - "DownloadFile" - "DownloadString" selection_execution: ScriptBlockText|contains: - "Invoke-Expression" - "IEX" - "-enc" - "-EncodedCommand" condition: selection_keywords and selection_execution timeframe: 5m level: high falsepositives: - Legitimate admin scripts that download and execute content - Software deployment tools using PowerShell ``` ## Best Practices ### Do This - Always map incidents to the most specific sub-technique available - Include ATT&CK technique IDs in all detection rule metadata - Perform quarterly coverage gap analysis using ATT&CK Navigator - Cross-reference threat intelligence reports with your ATT&CK heat map - Use ATT&CK data sources to validate that required telemetry is collected - Link detection rules to response playbooks via shared technique IDs - Track technique prevalence using threat reports (e.g., Red Canary, Mandiant) ### Don't Do This - Do not map only to the tactic level; always identify the specific technique - Do not assume one detection rule covers an entire technique and all sub-techniques - Do not ignore the data source requirements; a rule is useless without the right logs - Do not treat ATT&CK as a compliance checklist; prioritize based on threat landscape - Do not forget to update mappings when ATT&CK releases new versions (typically biannual) - Do not create detection rules without testing them against both true positive and benign samples ## Security Checklist - [ ] All known incidents are mapped to ATT&CK techniques with sub-technique granularity - [ ] Detection rules include ATT&CK technique IDs in metadata/tags - [ ] ATT&CK Navigator layer is generated showing current detection coverage - [ ] Coverage gaps are identified and prioritized by threat relevance - [ ] Required data sources for high-priority techniques are actively collected - [ ] Detection rules are tested against adversary emulation (e.g., Atomic Red Team) - [ ] Response playbooks reference corresponding ATT&CK techniques - [ ] Threat intelligence feeds are correlated with ATT&CK technique mappings - [ ] ATT&CK mappings are reviewed and updated with each framework release - [ ] Coverage metrics are reported to stakeholders (percentage of techniques detected) ## Related Skills - @sigma-rules-guide - Writing and managing Sigma detection rules with ATT&CK tags - @ir-playbook-templates - Incident response playbooks linked to ATT&CK techniques - @cve-epss-guide - Vulnerability prioritization that maps CVEs to ATT&CK techniques ## Additional Resources - [MITRE ATT&CK Enterprise Matrix](https://attack.mitre.org/matrices/enterprise/) - [ATT&CK Navigator](https://mitre-attack.github.io/attack-navigator/) - Interactive coverage visualization - [Atomic Red Team](https://github.com/redcanaryco/atomic-red-team) - Technique validation tests - [MITRE CAR (Cyber Analytics Repository)](https://car.mitre.org/) - Detection analytics mapped to ATT&CK - [ATT&CK STIX Data](https://github.com/mitre-attack/attack-stix-data) - Machine-readable ATT&CK content - [D3FEND](https://d3fend.mitre.org/) - Defensive technique knowledge graph linked to ATT&CK