Map Malware Behavior
Overview
Translate evidence into current ATT&CK technique references while keeping the original observation primary. Map only behaviors supported by evidence and preserve platform/version context.
Read references/behavior-mapping.md for evidence and mapping fields.
Workflow
- Normalize observations.
- Record actor/process, action, object, time, environment, privilege, source, and confidence.
- Open current ATT&CK content.
- Select the relevant Enterprise, Mobile, ICS, cloud, container, or platform matrix and record the version/date checked.
- Match behavior, not keywords.
- Read the technique definition and platform applicability.
- Choose the most specific supported sub-technique; preserve multiple plausible mappings as alternatives when evidence is incomplete.
- Record mapping evidence.
- Link each technique to the exact observation and explain why it fits and where it does not.
- Avoid attribution inflation.
- Do not infer actor, malware family, campaign, intent, or sequence solely because ATT&CK pages list similar procedure examples.
- Use the map.
- Route to containment, hunting, or detection content and name telemetry gaps.
Output
Return an evidence-to-technique table, platform and ATT&CK version/date, confidence, alternative mappings, telemetry gaps, and defensive use.
1---2name: map-malware-behavior3description: Map observed malicious behavior to MITRE ATT&CK techniques. Use when analysis, telemetry, incident evidence, or a report needs a behavior map for detection, response, or communication without inferring an actor or campaign.4---56# Map Malware Behavior78## Overview910Translate evidence into current ATT&CK technique references while keeping the original observation primary. Map only behaviors supported by evidence and preserve platform/version context.1112Read [references/behavior-mapping.md](references/behavior-mapping.md) for evidence and mapping fields.1314## Workflow15161. Normalize observations.17 - Record actor/process, action, object, time, environment, privilege, source, and confidence.182. Open current ATT&CK content.19 - Select the relevant Enterprise, Mobile, ICS, cloud, container, or platform matrix and record the version/date checked.203. Match behavior, not keywords.21 - Read the technique definition and platform applicability.22 - Choose the most specific supported sub-technique; preserve multiple plausible mappings as alternatives when evidence is incomplete.234. Record mapping evidence.24 - Link each technique to the exact observation and explain why it fits and where it does not.255. Avoid attribution inflation.26 - Do not infer actor, malware family, campaign, intent, or sequence solely because ATT&CK pages list similar procedure examples.276. Use the map.28 - Route to containment, hunting, or detection content and name telemetry gaps.2930## Output3132Return an evidence-to-technique table, platform and ATT&CK version/date, confidence, alternative mappings, telemetry gaps, and defensive use.
gaelic-ghost