ATT&CK Mapping
Map report findings to ATT&CK tactics and techniques — navigator literacy for $LAB_RT emulation evidence.
Visual · t21_attck_mapping
ATT&CK map = tactic → technique → evidence row. $LAB_RT report. Original Cyberlium.
Stakeholders understand MITRE language — map your lab TTPs honestly, not every technique on the matrix because it looks impressive.
ATT&CK mapping in reports ties each emulated behavior to tactic (Initial Access, Persistence, Lateral Movement, Exfiltration, etc.) and technique ID with evidence reference from $LAB_RT timeline — heat map or table for executives, detail rows for engineers. Include detection status from purple map (detected, missed, not in scope). Do not map techniques you did not emulate or plan in RoE; do not import stranger APT heat maps as your own. Cyberlium teaches navigator literacy and honest coverage — gaps are findings too. Submodule IDs when brief requires precision — still no weaponized cookbooks attached.
1. Mapping mechanics
One table row: tactic, technique ID, procedure summary (RoE), evidence ID, detection outcome.
Cross-link purple detections map — single source of truth.
Command guide
Try these commands — Mapping mechanics
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: grep, curl, jq. Reference sites: ATT&CK mapping in reports (https://attack.mitre.org/matrices/enterprise/); Technique IDs (https://attack.mitre.org/techniques/enterprise/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Executive view
Coverage snapshot: which tactics tested, where blue detected, top misses — not fear theater.
Optional ATT&CK navigator export screenshot redacted — lab layer only.
3. Honesty rules
No technique rows from unauthorized actions or stranger intel pasted as emulated.
Planned-but-not-run techniques labeled planned, not demonstrated.
4. What you ship: ATT&CK mapping table
≥8 rows with evidence IDs + detection column + honest planned vs demo labels.
5. What you record before the next lesson
ATT&CK mapping table path.
6. Wrong vs right: stranger phishing vs authorized RT lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Paste APT29 full matrix claiming your $LAB_RT lab ran all techniques.
- Right: ATT&CK table from honest $LAB_RT evidence. Next: Remediation Recs.
Mission: ATT&CK mapping table
1) Create mapping columns. 2) Add rows from lab timeline. 3) Mark detection outcome each. 4) Label planned vs demonstrated.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Navigator export — redact what?”
APPLY: ATT&CK mapping ties:
APPLY: True or False: Map techniques not emulated as demonstrated.
APPLY: Detection column shows: