Red › Module 9 › Lesson 2
ATT&CK Mapping
Map report findings to ATT&CK tactics and techniques — navigator literacy for $LAB_RT emulation evidence.
Visual · t21_attck_mapping
ATT&CK map = tactic → technique → evidence row. $LAB_RT report. Original Cyberlium.
Opening
Stakeholders understand MITRE language — map your lab TTPs honestly, not every technique on the matrix because it looks impressive.
ATT&CK mapping in reports ties each emulated behavior to tactic (Initial Access, Persistence, Lateral Movement, Exfiltration, etc.) and technique ID with evidence reference from $LAB_RT timeline — heat map or table for executives, detail rows for engineers. Include detection status from purple map (detected, missed, not in scope). Do not map techniques you did not emulate or plan in RoE; do not import stranger APT heat maps as your own. Cyberlium teaches navigator literacy and honest coverage — gaps are findings too. Submodule IDs when brief requires precision — still no weaponized cookbooks attached.
1. Mapping mechanics
One table row: tactic, technique ID, procedure summary (RoE), evidence ID, detection outcome.
Cross-link purple detections map — single source of truth.
Command guide
Try these commands — Mapping mechanics
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
ATT&CK mapping in reports — https://attack.mitre.org/matrices/enterprise/ Technique IDs — https://attack.mitre.org/techniques/enterprise/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install jq
macOS:
Command — copy this
brew install jq
Windows: Built-in (PowerShell: Invoke-WebRequest)
Command — copy this
choco install jq
═══ LINUX / macOS ═══
Command — copy this
grep -hE 'T[0-9]{4}|mapped' "$HOME/cyberlium-lab/t21-rt/"*.txt 2>/dev/null | head -10
curl -sS https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json | jq -r '.objects[] | select(.type=="attack-pattern") | .external_references[]? | select(.source_name=="mitre-attack" and (.external_id | test("^T[0-9]"))) | .external_id' 2>/dev/null | head -5Primary tools to practice this lesson: grep, curl, jq. Reference sites: ATT&CK mapping in reports (https://attack.mitre.org/matrices/enterprise/); Technique IDs (https://attack.mitre.org/techniques/enterprise/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Executive view
Coverage snapshot: which tactics tested, where blue detected, top misses — not fear theater.
Optional ATT&CK navigator export screenshot redacted — lab layer only.
3. Honesty rules
No technique rows from unauthorized actions or stranger intel pasted as emulated.
Planned-but-not-run techniques labeled planned, not demonstrated.
4. What you ship: ATT&CK mapping table
≥8 rows with evidence IDs + detection column + honest planned vs demo labels.
5. What you record before the next lesson
ATT&CK mapping table path.
6. Wrong vs right: stranger phishing vs authorized RT lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Paste APT29 full matrix claiming your $LAB_RT lab ran all techniques.
Right
ATT&CK table from honest $LAB_RT evidence. Next: Remediation Recs.
Mission: ATT&CK mapping table
1) Create mapping columns. 2) Add rows from lab timeline. 3) Mark detection outcome each. 4) Label planned vs demonstrated.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Navigator export — redact what?”
Knowledge Check
APPLY: ATT&CK mapping ties:
Multiple choice
Knowledge Check
APPLY: True or False: Map techniques not emulated as demonstrated.
True or False
Knowledge Check
APPLY: Detection column shows:
Multiple choice