ATT&CK Mapping

ATT&CK mapping literacy names tactics, techniques, and procedures in defender context — map lab scenarios to framework IDs on YOUR $HUNT_LAB without live attack replication.

ATT&CK Mapping• Audio Walkthrough

00:00/03:28

Visual · t30_attack_mapping

ATT&CK mapping literacy. $HUNT_LAB only. Original Cyberlium.

MITRE ATT&CK gives shared language — literacy maps techniques to hunt hypotheses on lab telemetry, not exploit cookbooks on live networks.

MITRE ATT&CK organizes adversary behavior into tactics (Initial Access, Execution, Persistence…) and techniques (T1110 Brute Force, T1059 Command and Scripting Interpreter…). Defenders use ATT&CK for detection coverage, hunt planning, and reporting — naming behavior for context, not replication. Cyberlium maps ATT&CK to YOUR $HUNT_LAB scenarios — e.g., T1110 on synthetic auth jsonl — never run live attacks to 'validate' techniques. Next: Technique Hypotheses.

1. ATT&CK structure (named)

Tactic: adversary goal (Credential Access, Lateral Movement — literacy only). Technique: method (T1110 brute force, T1021 remote services). Sub-technique: variant detail. Procedure: org-specific instance — document on lab fictional host.

On $HUNT_LAB, map one lab scenario to one tactic and one technique ID with plain-language meaning.

Command guide

Try these commands — ATT&CK structure (named)

═══ LINUX / BASH (SOC Analyst Triage) ═══

Filter system logs for security-relevant warnings and errors

Command — copy this

journalctl -p 3 -xb --no-pager | head -20

Search for suspicious persistent cron entries or service changes

Command — copy this

ls -lat /etc/cron.* /etc/systemd/system/ | head -15

═══ WINDOWS POWERSHELL ═══ Triage recent system service installations (Event 7045)

Command — copy this

Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-Table TimeCreated, Message -Wrap

Check open listening network connections with process owners

Command — copy this

Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort

Primary tools to practice this lesson: curl, grep. Reference sites: MITRE ATT&CK matrix (https://attack.mitre.org/matrices/enterprise/); MITRE T1059 (https://attack.mitre.org/techniques/T1059/); Sigma (https://github.com/SigmaHQ/sigma). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Why ATT&CK helps L2 hunts

Shared IDs improve handoffs to L3, detection engineers, and leadership. Coverage maps show which techniques lack detections — hunt priorities emerge from gaps, not random curiosity.

Students compare ATT&CK docs to lab jsonl fields — adaptation literacy, not live attack emulation.

3. Literacy ≠ live technique replication

Forbidden: executing lateral movement or credential dumping to 'test' ATT&CK coverage on production. Allowed: ATT&CK map card — tactic, technique ID, lab telemetry field, detection question on $HUNT_LAB.

Ship: ATT&CK map card for YOUR lab scenario. Next: Technique Hypotheses.

4. What you ship: ATT&CK map card for $HUNT_LAB

Tactic, technique ID, lab field mapping, detection question. $HUNT_LAB named. NO live attacks. chmod 600.

5. What you record before the next lesson

Date. ATT&CK map card. $HUNT_LAB named. File t30-m03-l01-attack-mapping.txt chmod 600.

6. Wrong vs right: stranger prod vs YOUR hunt telemetry

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Run live attack to validate T1110 on employer AD. Map techniques without lab telemetry anchor.
Right: Write ATT&CK map card for YOUR $HUNT_LAB scenario. Next: Technique Hypotheses.

Hands-on Exercise