---
name: mitre-attack
description: MITRE ATT&CK mapping discipline and technique reference for OpenTide TVM, DOM, and MDR objects — technique vs sub-technique selection, tactic assignment, multi-technique chaining, version pinning, revocation handling, coverage gap analysis, platform matrix awareness, and a locally searchable technique index. Use when populating threat.att&ck fields in TVMs, mapping DOM signals to techniques, tagging MDR rules, assessing detection coverage against the ATT&CK matrix, or looking up technique IDs and descriptions.
---

# MITRE ATT&CK — mapping discipline + technique reference

This skill encodes the discipline of mapping adversary behaviour to ATT&CK and back, plus a locally searchable technique index. Every OpenTide object type carries ATT&CK references; getting them right is a quality gate.

**Current baseline**: ATT&CK **v19** (April 2026, Enterprise domain: 15 tactics, 222 techniques, 475 sub-techniques).

> **v19 breaking change**: Defense Evasion was split into **Stealth** (TA0005) and **Defense Impairment** (TA0112). Any existing mappings referencing TA0005 as "Defense Evasion" must be reviewed and re-assigned.

> **Online version check**: If this skill may be outdated, verify the current ATT&CK version at:
> - Release notes: https://attack.mitre.org/resources/updates/
> - Version history: https://attack.mitre.org/versions/
> - Machine-readable STIX: https://github.com/mitre/cti (enterprise-attack branch)
> - Blog announcements: https://medium.com/mitre-attack

---

## 1. Tactic, technique, sub-technique — when to use which

| Level | Use when | Example |
|---|---|---|
| **Tactic only** | Early TVM drafting where the specific technique is unknown or the intelligence is vague | "Adversary seeks credential access" → `TA0006` |
| **Technique** | The behaviour class is clear but the specific implementation is not documented | "Adversary uses credential dumping" → `T1003` |
| **Sub-technique** | The specific implementation is documented in the intelligence | "Adversary dumps LSASS memory" → `T1003.001` |

### Decision rules

1. **Always prefer the most specific level the evidence supports.** If the source says "Mimikatz sekurlsa::logonpasswords", map to `T1003.001`, not `T1003`.
2. **Never map to a sub-technique without also implying the parent.** The parent is implicit in ATT&CK's hierarchy — do not list both `T1003` and `T1003.001` for the same behaviour.
3. **Map to the parent technique only when** the source describes the behaviour class but not the specific method, or when multiple sub-techniques apply and you cannot distinguish which.
4. **Do not over-tag.** If a detection rule catches one specific sub-technique, map to that sub-technique only. LLMs tend to list every plausible sub-technique — resist this.

---

## 2. Tactic assignment

A technique can appear under multiple tactics. Select the tactic that matches the **adversary's goal in context**, not every tactic the technique could theoretically serve.

| Scenario | Correct tactic | Wrong |
|---|---|---|
| Adversary uses `schtasks` to persist | Persistence (TA0003) | Execution (TA0002) — even though schtasks executes |
| Adversary uses `schtasks` to run a payload once | Execution (TA0002) | Persistence (TA0003) — no persistence intent |
| Adversary uses PowerShell to download a payload | Command and Scripting Interpreter (T1059.001) under Execution | Don't also tag Initial Access |

### v19 tactic split

| Old tactic | New tactics (v19) | Action |
|---|---|---|
| Defense Evasion (TA0005) | **Stealth** (TA0005) — hiding artefacts, obfuscation, masquerading | Review existing TA0005 mappings |
| | **Defense Impairment** (TA0112) — disabling tools, clearing logs, firewall modification | Re-assign where the goal is impairing defences |

---

## 3. Multi-technique chaining

A single TVM or MDR may reference multiple techniques when the intelligence documents a **behavioural chain**. Rules:

1. **Each technique in the chain must be independently evidenced.** Do not infer intermediate steps.
2. **Order matters in TVMs.** The `chaining` field should reflect the temporal sequence documented in the intelligence.
3. **MDR rules typically map to 1-2 techniques.** A detection rule that claims to cover 5+ techniques is almost certainly an AP-H2 Kitchen Sink (see `threat-hunting` skill).
4. **DOM signals map to the technique(s) the signal can actually detect**, not the full chain the parent TVM describes.

---

## 4. Version pinning and revocation handling

### Version pinning

- OpenTide content should reference ATT&CK technique IDs without version suffixes (e.g. `T1059.001`, not `T1059.001 v2.0`).
- The **repository-level** ATT&CK version is declared in the content repo's metadata or schema configuration. Individual objects inherit this.
- When ATT&CK releases a new version, review objects whose mapped techniques had **major version changes** or **revocations**.

### Revocations

ATT&CK periodically revokes techniques, replacing them with new IDs. v19 examples:
- `Impair Defenses` → revoked, replaced by `Disable or Modify Tools` (T1685)
- `Disable or Modify System Firewall` → revoked, replaced by T1686

**Handling revocations in OpenTide:**
1. Search the content repo for the revoked technique ID.
2. Update to the replacement technique ID.
3. Review the description — the replacement may have a narrower or broader scope.
4. Log the change in the PR narrative.

### Deprecations

Deprecated techniques have no replacement. Remove the mapping and document the gap.

---

## 5. Mapping in OpenTide objects

### TVM (Threat Vector)

| Field | ATT&CK content |
|---|---|
| `threat.att&ck` | Array of technique/sub-technique IDs with tactic context |
| `terrain` | Narrative references to ATT&CK behaviours with evidence |
| `chaining` | Ordered technique sequence when the TVM describes a multi-step chain |

**Quality bar**: Every technique ID in `threat.att&ck` must trace to a specific claim in the source intelligence. Unmapped techniques are preferable to speculative mappings.

### DOM (Detection Objective)

| Field | ATT&CK content |
|---|---|
| `objective.signals[].att&ck` | Technique(s) the signal can detect |
| Coverage narrative | Which sub-techniques are covered vs gaps |

**Quality bar**: A DOM signal should map to the technique(s) it can actually observe, not the full TVM chain. If a signal detects `T1003.001` (LSASS dump) but not `T1003.003` (NTDS), map only `.001`.

### MDR (Detection Rule)

| Field | ATT&CK content |
|---|---|
| Rule metadata / `configurations.*.mitre` | Technique IDs for the platform rule |
| `description` | Technique context in prose |

**Quality bar**: The MDR technique mapping must match what the query actually detects. A KQL query filtering on `FileName =~ "ntdsutil.exe"` maps to `T1003.003`, not the parent `T1003`.

---

## 6. Coverage analysis (inverse mapping)

ATT&CK mapping also works in reverse: given a set of detection rules, which techniques are covered?

### Coverage matrix construction

1. Extract all technique IDs from MDR objects in the content repo.
2. Map against the ATT&CK Enterprise matrix (222 techniques, 475 sub-techniques in v19).
3. Classify coverage:

| Level | Definition |
|---|---|
| **Detected** | At least one production MDR rule maps to this technique |
| **Hunted** | A validated hunt query exists but no production rule |
| **Theoretical** | A DOM signal is defined but no query exists |
| **Gap** | No coverage at any level |

### Coverage anti-patterns

| Anti-pattern | Description |
|---|---|
| **Breadth without depth** | Mapping to parent techniques only, claiming "T1059 covered" when only PowerShell (T1059.001) has a rule |
| **Phantom coverage** | Mapping a rule to a technique it cannot actually detect (e.g. a network rule claiming to detect a registry technique) |
| **Stale coverage** | Rules mapped to revoked technique IDs that no longer exist in the current ATT&CK version |
| **Platform mismatch** | Claiming Linux technique coverage with a Windows-only detection rule |

---

## 7. Common mapping mistakes

| Mistake | Fix |
|---|---|
| Listing both parent and sub-technique for the same behaviour | Use the most specific level only |
| Mapping to every tactic a technique supports | Select the tactic matching the adversary's goal in context |
| Copying technique lists from CTI reports without validation | Verify each mapping against the actual behaviour described |
| Using deprecated/revoked technique IDs | Check against current ATT&CK version |
| Mapping a detection rule to techniques it cannot observe | Map only to what the query's data source can see |
| Over-tagging MDR rules with 5+ techniques | One rule typically detects 1-2 specific behaviours |

---

## 8. ATT&CK data sources and data components

ATT&CK v19 includes **Data Components** (e.g. Process Creation, File Modification, Network Connection Creation) that link techniques to observable telemetry. Use these to validate that your detection platform actually has visibility into the mapped technique.

| Data component | Telemetry type | Example sources |
|---|---|---|
| Process Creation | Process execution logs | EDR process events, Security EID 4688, Sysmon EID 1 |
| File Creation / Modification | File system activity logs | EDR file events, Sysmon EID 11, Security EID 4663 |
| Network Connection Creation | Network connection logs | EDR network events, Sysmon EID 3, firewall logs |
| User Account Authentication | Authentication logs | SIEM sign-in logs, Security EID 4624/4625 |
| Windows Registry Key Modification | Registry change logs | EDR registry events, Sysmon EID 12/13/14, Security EID 4657 |
| Module Load | DLL/image load logs | EDR image load events, Sysmon EID 7 |
| Command Execution | Command-line / script logs | PowerShell 4104, EDR command events |
| Scheduled Job Creation | Task/job creation logs | Security EID 4698, Sysmon EID (via WMI), cron logs |
| Service Creation | Service installation logs | System EID 7045, Security EID 4697 |
| Active Directory Object Access | Directory service logs | SIEM audit logs, Security EID 4662 |

> Consult your platform skill for exact table/index names. If the data component required by a technique is not available on your platform, the mapping is theoretical — document the gap.

---

## 9. Platform matrix awareness

ATT&CK Enterprise covers multiple platform domains. Ensure technique mappings align with the target platform:

| Platform | Scope | Notes |
|---|---|---|
| **Windows** | Desktop + Server | Largest technique coverage; most sub-techniques |
| **Linux** | Servers, containers, IoT | Growing coverage; includes container-specific techniques |
| **macOS** | Desktop | Smaller but distinct technique set (TCC, launchd, etc.) |
| **Cloud** (AWS, Azure, GCP) | IaaS / PaaS | Cloud-specific techniques (T1578, T1580, T1535, etc.) |
| **SaaS** | Office 365, Google Workspace, etc. | Identity and data-focused techniques |
| **Network** | Routers, switches, firewalls | Network device-specific techniques |
| **Containers** | Docker, Kubernetes | Container escape, orchestration abuse |
| **ICS** | Industrial control systems | Separate ATT&CK for ICS matrix (not covered here) |

**Rule**: When mapping a detection rule to a technique, verify the technique applies to the platform the rule targets. A Windows-only detection cannot claim coverage of a Linux-only technique.

---

## 10. Tactic reference (v19 Enterprise)

| ID | Tactic | Description |
|---|---|---|
| TA0043 | Reconnaissance | Gathering information to plan future operations |
| TA0042 | Resource Development | Establishing resources to support operations |
| TA0001 | Initial Access | Gaining an initial foothold |
| TA0002 | Execution | Running adversary-controlled code |
| TA0003 | Persistence | Maintaining access across restarts/credential changes |
| TA0004 | Privilege Escalation | Gaining higher-level permissions |
| TA0005 | Stealth | Hiding artefacts, obfuscation, masquerading (v19: split from Defense Evasion) |
| TA0112 | Defense Impairment | Disabling tools, clearing logs, firewall modification (v19: split from Defense Evasion) |
| TA0006 | Credential Access | Stealing credentials |
| TA0007 | Discovery | Exploring the environment |
| TA0008 | Lateral Movement | Moving through the environment |
| TA0009 | Collection | Gathering data of interest |
| TA0011 | Command and Control | Communicating with compromised systems |
| TA0010 | Exfiltration | Stealing data |
| TA0040 | Impact | Manipulating, interrupting, or destroying systems and data |

## 11. Quality checklist

- [ ] Every technique ID is valid in the current ATT&CK version.
- [ ] Sub-technique used when the specific implementation is documented; parent when not.
- [ ] Parent and sub-technique not both listed for the same behaviour.
- [ ] Tactic matches the adversary's goal in context, not every possible tactic.
- [ ] MDR technique mapping matches what the query actually detects.
- [ ] DOM signal mapping covers only the techniques the signal can observe.
- [ ] TVM technique mapping traces to specific source intelligence claims.
- [ ] No revoked or deprecated technique IDs remain.
- [ ] Coverage claims validated against available data sources / data components.
- [ ] Multi-technique chains are independently evidenced per step.
- [ ] Platform matrix alignment verified (technique applies to the target platform).
- [ ] v19 tactic split handled: TA0005 = Stealth, TA0112 = Defense Impairment (not "Defense Evasion").
- [ ] Technique index (`references/Enterprise-Techniques.md`) consulted for ID validation.
- [ ] Online ATT&CK version checked if skill may be outdated.