mitre-attack-lookup

MITRE ATT&CK Lookup

What this skill does

Queries the MITRE ATT&CK knowledge base using mitrize — a Git-based static dataset that converts STIX 2.1 JSON into individual Markdown files with YAML frontmatter. Supports technique lookup, threat actor profiling, software analysis, mitigation mapping, full-text search, and group overlap comparison. Covers Enterprise, Mobile, and ICS domains (ATT&CK v18.1+, 898 techniques, 203 groups, 929 software entries).

When to use

• When you need to look up a specific ATT&CK technique by ID or name (e.g., T1059, "Command and Scripting Interpreter")
• When profiling a threat actor's TTPs (e.g., all techniques used by APT28 or Kimsuky)
• When mapping detected IOCs/behaviors to ATT&CK techniques during incident response
• When building detection rules and need to understand technique details and mitigations
• When comparing two threat groups to find overlapping and unique techniques
• When searching the ATT&CK knowledge base by keyword (e.g., "ransomware", "PowerShell")

Prerequisites

• Git (to clone the mitrize repository)
• Python 3.6+ (stdlib only — no pip dependencies)
• ~100 MB disk space for the full repository

Inputs

Parameter	Required	Description	Example
QUERY_TYPE	Yes	Type of lookup: technique, group, software, mitigation, tactic, search, group-techniques, overlap, stats	technique
QUERY_VALUE	Yes	ID, name, or search keyword	T1059, Kimsuky, ransomware
DOMAIN	No	ATT&CK domain for direct file access (default: enterprise)	enterprise, mobile, ics

Workflow

Step 1: Clone mitrize (first time only)

MITRIZE_DIR="${HOME}/mitrize"
if [ ! -d "$MITRIZE_DIR" ]; then
  echo "[*] Cloning mitrize repository..."
  git clone --depth 1 https://github.com/woohyun212/mitrize.git "$MITRIZE_DIR"
  echo "[+] Clone complete"
else
  echo "[*] mitrize already exists at $MITRIZE_DIR"
  cd "$MITRIZE_DIR" && git pull --ff-only 2>/dev/null
fi