attack-map

/attack-map

Map threat actor TTPs to MITRE ATT&CK techniques and generate a detection validation checklist.

Trigger

Use when you need to:

• Map a known threat actor's behavior to ATT&CK for detection engineering
• Analyze a threat intelligence report and extract actionable TTPs
• Build a detection validation matrix for a specific adversary profile
• Prepare atomic testing scenarios for blue team capability validation
• Create an ATT&CK Navigator layer for a specific threat

NOTE: This command is for educational and defensive purposes -- building detections that catch these techniques.

Input

• Required: One of the following:
  • A threat actor name or designation (e.g., "APT29", "FIN7", "Scattered Spider")
  • A threat intelligence report or advisory to analyze
  • A specific attack pattern or kill chain to map
• Optional flag: --detection -- include detection rule stubs (Sigma format) for each technique
• Optional flag: --atomic -- include Atomic Red Team test IDs for validation
• Optional flag: --navigator -- output ATT&CK Navigator JSON layer

Process

1. Threat Intelligence Gathering: Collect publicly available intelligence on the specified threat actor or attack pattern from MITRE CTI, vendor reports, and CISA advisories.

2. TTP Extraction: Identify each tactic, technique, and procedure used by the adversary. Be specific -- extract sub-techniques (T1059.001 PowerShell, not just T1059 Command and Scripting Interpreter).

3. ATT&CK Mapping: Map each TTP to the MITRE ATT&CK Enterprise matrix with:

   • Technique ID and name
   • The specific procedure (how the adversary uses this technique)
   • The tactic phase (where in the kill chain this occurs)
   • Confidence level (observed / assessed / inferred)

4. Detection Requirements: For each technique, identify:

   • Required data sources (Sysmon events, Windows Event Log IDs, network flow data, cloud audit logs)
   • Detection logic (what pattern indicates this technique)
   • False positive considerations
   • Detection difficulty rating