Active › Module 8 › Lesson 2
ATT&CK Mapping
Map AD techniques to MITRE ATT&CK — Kerberoast, PtH, DCSync, ACL paths on literacy matrix for $LAB_AD findings.
Visual · t25_attack_mapping
ATT&CK mapping = technique IDs on findings. Original Cyberlium.
Opening
Findings speak blue-team language when they cite T1558.003 — not when they cite a stranger-domain cheat sheet.
ATT&CK mapping literacy for Topic 25: T1558.003 Kerberoasting, T1550.002 Pass-the-Hash, T1003.006 DCSync, T1068 exploitation of misconfig paths (ACL/delegation context), T1484 domain policy modification edges, T1558 delegation subtechniques as named. Build finding row: observed behavior on $LAB_AD (or synthetic scenario), technique ID, Event ID cross-link from Lesson 8-1, mitigation from Module 7. Cyberlium maps for defender reporting — NOT ATT&CK as attack playbook ordering against stranger domains, NOT 'kill chain homework' requiring unauthorized actions. Purple team: map detection coverage gap — technique detected vs not on lab SIEM table.
1. Technique rows
Minimum five techniques from Modules 5–7 with ID, name, defender control, Event ID.
Use enterprise ATT&CK matrix reading — link to lab finding not internet target.
Command guide
Try these commands — Technique rows
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MITRE ATT&CK mapping — https://attack.mitre.org/ (technique IDs for detections) Microsoft Advanced Audit — https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings CISA AD — https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Built-in (PowerShell: Invoke-WebRequest) Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export LAB_AD=${LAB_AD:-$HOME/cyberlium-lab/t25-ad}
python3 - <<'PY'
mapping = {
'T1558.003': '4769 Kerberoast', 'T1558.004': '4768 AS-REP',
'T1550.002': '4624 PtH', 'T1003.006': '4662 DCSync',
}
for tid, det in mapping.items(): print(f'{tid} -> {det}')
PYCommand — copy this
curl -sS https://attack.mitre.org/techniques/T1558/003/ | head -5 curl -sS https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings | head -6
Primary tools to practice this lesson: curl, python3. Reference sites: MITRE ATT&CK mapping (https://attack.mitre.org/); Microsoft Advanced Audit (https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings); CISA AD (https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Coverage table
Columns: technique, detection rule idea, log source, gap on $LAB_AD.
Honest gap rows feed Module 9 purple loop.
3. Refused
No ATT&CK-ordered attack script against unauthorized AD as deliverable.
Mapping serves blue report and purple planning — not red cookbook export.
4. What you ship: ATT&CK mapping table
Five technique rows + coverage gap column + $LAB_AD finding link.
5. What you record before the next lesson
ATT&CK mapping table path.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Submit ATT&CK kill chain executed on employer AD without ticket.
Right
ATT&CK mapping table for lab findings. Next: Honeytokens Named.
Mission: ATT&CK mapping table
1) Five technique rows with IDs. 2) Event ID cross-link each. 3) Detection gap column. 4) Link to $LAB_AD finding.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “T1003.006 vs T1003.003 — literacy difference?”
Knowledge Check
APPLY: Kerberoasting maps to:
Multiple choice
Knowledge Check
APPLY: True or False: ATT&CK mapping justifies stranger-domain attacks.
True or False
Knowledge Check
APPLY: DCSync maps to:
Multiple choice