Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add gensecaihq/Wazuh-Autopilot --skill mitre-attack-mappinggit clone --depth 1 https://github.com/gensecaihq/Wazuh-AutopilotWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/gensecaihq/wazuh-autopilot/mitre-attack-mapping)<a href="https://agentmods.dev/skills/gensecaihq/wazuh-autopilot/mitre-attack-mapping"><img src="https://agentmods.dev/badge/skills/gensecaihq/wazuh-autopilot/mitre-attack-mapping/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/gensecaihq/wazuh-autopilot/mitre-attack-mapping"><img src="https://agentmods.dev/badge/skills/gensecaihq/wazuh-autopilot/mitre-attack-mapping.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00044 | $0.01416 |
| Opus 5.5 | $0.00018 | $0.00566 |
| Sonnet 5 | $0.00009 | $0.00283 |
| Haiku 4.5 | $0.00004 | $0.00142 |
Grade B, and why
mitre-attack-mapping scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
| rule 5402 sudo to root; rule 5401 failed sudo | T1548.003 | T1548.003 Sudo and Sudo Caching | How it starts
The opening of the file, as written. The whole thing — 80 lines — stays where its author put it; the contents beside it link to each section on GitHub.
MITRE ATT&CK Mapping
ATT&CK is the shared language between triage, hunting, response and detection engineering. Map precisely: prefer a sub-technique when evidence supports it, otherwise the parent technique.
Procedure
- Start with
rule.mitre.id/rule.mitre.tacticfrom each alert — Wazuh ships these on many rules. Treat them as a hint, not truth: verify against the behaviour. - Add techniques for behaviour seen in logs that the rule didn't tag (e.g. a process command line showing discovery commands).
- Pick the tactic from the context: the same technique can serve multiple tactics (T1078 Valid Accounts: Initial Access, Persistence, Privilege Escalation, Defense Evasion) — record the tactic that fits this case.
- Assign a numeric confidence per technique: 0.9 confirmed (log evidence of the behaviour), 0.7 likely (strong indicator), 0.4 possible (rule tag only).
Wazuh rule → technique mappings
The first column is taken from the Wazuh 4.14 ruleset's own <mitre> tags. The ruleset
is not always right: rule 60122 (Windows logon failure, level 5) is tagged T1531 Account
Access Removal, which one failed logon isn't. Treat every tag as a hint.
| Wazuh signal | Ruleset tag | Map to (when behaviour confirms) |
|---|---|---|
| rule 5710 sshd non-existent user (level 5) | T1110.001, T1021.004 | T1110.001 Password Guessing |
| rules 5712, 5720, 5763 sshd brute force / multiple failures (level 10); rule 5716 single failure | T1110 | T1110.001, or T1110.003 Password Spraying if many users from one source |
| rule 5715 sshd authentication success | T1078, T1021 | T1078 Valid Accounts only after failures or from an unusual source; T1021.004 SSH for internal hops |
| rule 60204 multiple Windows logon failures (level 10) | T1110 | T1110 (Event ID 4625 bursts) |
| rule 60106 Windows logon success | T1078 | T1078; Event ID 4624 logon type 10 between workstations suggests T1021.001 RDP |
| rule 550 FIM checksum changed | T1565.001 | T1505.003 Web Shell if a script changed in a web root; T1543.002 / T1053.003 for systemd units or cron files |
| rule 553 FIM file deleted | T1070.004, T1485 | T1070.004 Indicator Removal if logs or tools were deleted |
| rule 554 FIM file added | (none) | T1105 Ingress Tool Transfer if a binary or script appeared in a temp or web path |
| rules 594, 750 registry value/key changed | T1565.001, T1112 | T1547.001 Run Keys when under ...\CurrentVersion\Run |
| rule 5902 new user added | T1136 | T1136.001 Create Account: Local Account |
| rule 5402 sudo to root; rule 5401 failed sudo | T1548.003 | T1548.003 Sudo and Sudo Caching |
| rule 60154 Administrators group changed (level 12) | T1484 | T1098 Account Manipulation / T1078.002 if a domain account was added |
| rule 504 agent disconnected, rule 506 agent stopped | T1562.001 | T1562.001 Impair Defenses only with corroboration (many agents, attacker activity) |
| rule 87105 VirusTotal positives (level 12) | T1203 | map to what the file does (e.g. T1496 for a miner); T1203 only for exploit documents |
| rule 92213 Sysmon: executable dropped in a malware-typical folder (level 15) | T1105 | T1105 Ingress Tool Transfer |
| rule 510 rootcheck anomaly | (none) | T1014 Rootkit / T1036 Masquerading only when the finding describes a hidden process or trojaned binary |
web attack rules (rule.groups web, attack) |
varies | T1190 Exploit Public-Facing Application |
| Windows Event ID 1102 / 104 log cleared | varies | T1070.001 Clear Windows Event Logs |
Sysmon Event ID 1 with powershell -enc |
varies | T1059.001 PowerShell + T1027 Obfuscated Files or Information |
| beaconing / outbound to known-bad IP | none | T1071 Application Layer Protocol |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 80 lines · 44 tokens per session scan B 62263969510a
mitre-attack-mapping is a skill published in the GitHub repository gensecaihq/Wazuh-Autopilot (57 stars, last pushed 2d ago), licensed MIT. It adds 44 tokens to every session and 1,416 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-25.
Other skills, from other repositories
agent-crdt-synchronizer
Agent skill for crdt-synchronizer - invoke with $agent-crdt-synchronizer.
agent-topology-optimizer
Agent skill for topology-optimizer - invoke with $agent-topology-optimizer.
agent-benchmark-suite
Agent skill for benchmark-suite - invoke with $agent-benchmark-suite.
agent-performance-monitor
Agent skill for performance-monitor - invoke with $agent-performance-monitor.
agent-resource-allocator
Agent skill for resource-allocator - invoke with $agent-resource-allocator.
agentic-jujutsu
Quantum-resistant, self-learning version control for AI agents with ReasoningBank intelligence and multi-agent coordination.