# Map Malware Behavior

> Map observed malicious behavior to MITRE ATT&CK techniques. Use when analysis, telemetry, incident evidence, or a report needs a behavior map for detection, response, or communication without inferring an actor or campaign.

- Skill: `gaelic-ghost/map-malware-behavior` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add gaelic-ghost/map-malware-behavior`
- Raw SKILL.md: https://api.skillmd.com/api/skills/gaelic-ghost/map-malware-behavior/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Marketing & Growth
- Author: gaelic-ghost (https://skillmd.com/u/gaelic-ghost)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/gaelic-ghost/map-malware-behavior

---


# Map Malware Behavior

## Overview

Translate evidence into current ATT&CK technique references while keeping the original observation primary. Map only behaviors supported by evidence and preserve platform/version context.

Read [references/behavior-mapping.md](references/behavior-mapping.md) for evidence and mapping fields.

## Workflow

1. Normalize observations.
   - Record actor/process, action, object, time, environment, privilege, source, and confidence.
2. Open current ATT&CK content.
   - Select the relevant Enterprise, Mobile, ICS, cloud, container, or platform matrix and record the version/date checked.
3. Match behavior, not keywords.
   - Read the technique definition and platform applicability.
   - Choose the most specific supported sub-technique; preserve multiple plausible mappings as alternatives when evidence is incomplete.
4. Record mapping evidence.
   - Link each technique to the exact observation and explain why it fits and where it does not.
5. Avoid attribution inflation.
   - Do not infer actor, malware family, campaign, intent, or sequence solely because ATT&CK pages list similar procedure examples.
6. Use the map.
   - Route to containment, hunting, or detection content and name telemetry gaps.

## Output

Return an evidence-to-technique table, platform and ATT&CK version/date, confidence, alternative mappings, telemetry gaps, and defensive use.