mapping-attack-techniques

Mapping ATT&CK Techniques

ATT&CK is a shared vocabulary, not a methodology. Its value is that offense, detection, and response can name the same behaviour — which makes this skill a router, not a technique catalogue. It resolves a technique to the skill that holds the actual procedure, and it runs the loop that connects the two sides.

When to Use

• A request names a technique ID (T1003.001), a technique name ("Kerberoasting"), or a tactic ("we need lateral movement coverage")
• Converting a threat intel report or an adversary emulation plan into work
• Planning or reporting coverage against the matrix
• Running a purple team exercise: emulate, detect, validate, close the gap
• Choosing which skill applies when a request spans offense and defense

When NOT to Use

• A plain-language request ("dump creds off this host") — the domain skills trigger directly on that; routing through here adds a hop for nothing
• Code-level vulnerability work — ATT&CK does not model source defects; use auditing-code-for-vulnerabilities with CWE and ASVS instead
• AI/LLM systems — use securing-ai-systems; the framework there is MITRE ATLAS, not ATT&CK Enterprise
• Mobile targets — testing-mobile-applications; the Mobile matrix has its own IDs that do not correspond to Enterprise ones

The Index

secskills-core/ttp-index.json maps techniques to the skills that cover them. Read it directly to resolve a lookup:

# Which skill covers this technique?
python3 -c "
import json;d=json.load(open('secskills-core/ttp-index.json'))
print([r for r in d['techniques'] if r['id']=='T1003.001'])"

# Everything under one tactic
python3 -c "
import json;d=json.load(open('secskills-core/ttp-index.json'))
[print(r['id'], r['name'], '→', ', '.join(r['skills']))
 for r in d['techniques'] if 'TA0008' in r['tactics']]"

# Search by name when you have words, not an ID
rg -i 'kerberoast|pass the hash' secskills-core/ttp-index.json

Each skill also carries a generated ## ATT&CK Coverage section listing its techniques. That section and the index are kept in sync by scripts/sync_attack.py; the index is the source of truth.