MITRE ATT&CK: Mapping Events to Tactics & Techniques

Prerequisites

• COA-K001: SOC Architecture & Alert Lifecycle

Why This Lesson Matters

ATT&CK is the lingua franca of modern security operations. Detection rules reference technique IDs. Threat intelligence reports cite tactic groups. Pentest findings map to sub-techniques. An analyst who cannot navigate ATT&CK and attach IDs to their observations produces investigation notes that are harder to correlate, harder to share, and harder to improve upon.

1. ATT&CK Structure

MITRE ATT&CK is a knowledge base of adversary behaviours observed in real intrusions, organised hierarchically:

Enterprise ATT&CK
└── Tactic (14 total) — the adversary's goal
    └── Technique (hundreds) — how the goal is achieved
        └── Sub-technique (thousands) — specific variant

Tactics answer why — what the adversary is trying to accomplish at this stage. Techniques answer what — the general approach. Sub-techniques answer how exactly — the specific implementation.

Example:

Tactic:       TA0006 — Credential Access
Technique:    T1003   — OS Credential Dumping
Sub-technique: T1003.001 — LSASS Memory

1.1 The 14 Enterprise Tactics

1.2 High-Priority Techniques for L1 Analysts

These techniques generate the highest alert volume in most SOC environments:

2. Using ATT&CK in SOC Practice

2.1 Mapping an Alert to ATT&CK

Step 1: Identify the event type (process creation, network connection, file creation, auth event). Step 2: Look at what the event describes behaviourally (a new service being installed = persistence). Step 3: Navigate to the tactic, then find the technique that matches. Step 4: Check sub-techniques for specificity.

Example: Sysmon Event 1 shows powershell.exe launched by winword.exe with argument -EncodedCommand JABmAGw...

• Behaviour: Script interpreter launched by document application with obfuscated argument
• Tactic: TA0002 — Execution (and possibly TA0005 — Defense Evasion for the encoding)
• Technique: T1059.001 — Command and Scripting Interpreter: PowerShell
• Sub-technique context: The encoding is consistent with T1027 — Obfuscated Files or Information

In your investigation note: "PowerShell execution from Word parent process with base64-encoded command — T1059.001 / T1027 — investigate encoded payload."

2.2 ATT&CK Navigator

The ATT&CK Navigator (https://mitre-attack.github.io/attack-navigator/) is a heat-map interface where you can: - Highlight which techniques your detection coverage covers - Map a threat actor's known TTPs to identify detection gaps - Compare two threat profiles side by side

For SOC work: export your SIEM detection rules as a Navigator layer and compare against a relevant threat actor's profile to find what you are blind to.

2.3 Threat Intelligence Integration

CTI reports use ATT&CK as their vocabulary. When a CISA advisory says "this actor uses T1566.001 (Spearphishing Attachment) for initial access and T1053.005 (Scheduled Tasks) for persistence," a SOC analyst should:

1. Check whether their SIEM has detection rules for T1566.001 and T1053.005
2. Run a threat hunt for any undetected instances of these techniques in the last 30 days
3. If no rule exists, write one or escalate to L3

3. Documenting with ATT&CK IDs

Every investigation note or incident ticket should reference technique IDs for events that map to ATT&CK:

Before (unprofessional):

Saw some suspicious PowerShell. Checked the command line, it was encoded. Escalated to L2.

After (professional):

Sysmon Event 1 at 14:32:17 UTC on WS-042: powershell.exe (PID 4872) spawned by winword.exe (PID 3201). CommandLine contains -EncodedCommand flag consistent with T1059.001. Decoded payload (base64) reveals download cradle to hxxp://185[.]220[.]101[.]5/update.ps1 — consistent with T1105 (Ingress Tool Transfer). Escalating as P2-TP — potential phishing-delivered execution chain.

The second version is actionable, searchable, shareable with CTI, and legally defensible.

4. Common Mistakes

Mistake 1: Mapping to the wrong tactic. A credential dump is Credential Access (TA0006), not Execution, even though it runs as a process. Focus on the goal of the action, not the mechanism.

Mistake 2: Stopping at the technique level. T1059 (Command and Scripting Interpreter) has 9 sub-techniques. T1059.001 (PowerShell) and T1059.003 (Windows Command Shell) have very different detection approaches. Always drill down.

Mistake 3: Using ATT&CK IDs as a substitute for evidence. Writing "T1003.001 detected" without showing the Sysmon Event 10 that triggered it is incomplete. The ID labels the behaviour; evidence proves it occurred.

5. Practice Exercises

1. Map each of the following observations to the correct ATT&CK tactic and technique:
2. A script creates a new scheduled task named Windows Update Helper that executes C:Tempupdater.exe at logon
3. A process reads C:WindowsSystem32lsass.exe memory via OpenProcess with PROCESS_VM_READ
4. A user account enumerates all domain users with net user /domain and Get-ADUser -Filter *

5. Files on a file server are renamed with .locked extension at 500 files/second

6. You are given a CTI report stating that a threat actor uses T1566.002, T1204.002, T1059.001, T1547.001, and T1041. Build a coverage table: for each technique, write one SIEM data source and one field/value you would query to detect it.

7. Open the ATT&CK Navigator and create a layer highlighting the 9 techniques from the "High-Priority Techniques" table in Section 1.2. Export as JSON.

6. Lab

Assessment mode: quiz

You are presented with 10 event log excerpts. For each excerpt, select the correct ATT&CK tactic and the correct technique ID from a provided list. A score of ≥ 80% is required.

7. Framework Alignment

8. Further Reading

• MITRE ATT&CK — https://attack.mitre.org — Primary reference; use the search and matrix views
• ATT&CK Navigator — https://mitre-attack.github.io/attack-navigator/
• MITRE ATT&CK for SOC Analysts (free training) — https://mad.mitre-engenuity.org
• Sigma Rules project — https://github.com/SigmaHQ/sigma — Community detection rules mapped to ATT&CK

["Navigate the ATT&CK matrix to find a technique by tactic context and apply the correct tactic, technique, and sub-technique IDs to three described attacker behaviours", "Write a professional investigation note that cites ATT&CK IDs, evidence references, and a severity classification for a described alert scenario", "Build an ATT&CK Navigator coverage layer for a provided set of SIEM detection rules and identify at least two detection gaps"]

Prerequisites → Why this matters → ATT&CK structure (tactics → techniques → sub-techniques) → 14 enterprise tactics table → High-priority techniques for L1 analysts → Using ATT&CK in practice (step-by-step mapping, Navigator, CTI integration) → Professional documentation with ATT&CK IDs (before/after example) → Common mistakes → Practice exercises → Quiz lab → Framework alignment → Further reading