# Mapping Attack Techniques > Navigate security work by MITRE ATT&CK tactic and technique — resolve a technique ID or name to the right skill, map a threat intel report or adversary emulation plan to procedures, and run the purple-team loop from technique to detection to validation. Use when a request names an ATT&CK ID like T1003.001, a tactic like lateral movement, an APT group or intel report, or when planning coverage aga… - **Type:** Skill - **Install:** `agentstack add skill-evilfreelancer-secs-mapping-attack-techniques` - **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior - **Seller:** [EvilFreelancer](https://agentstack.voostack.com/s/evilfreelancer) - **Installs:** 0 - **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml) - **Latest version:** 0.1.0 - **License:** Apache-2.0 - **Upstream author:** [EvilFreelancer](https://github.com/EvilFreelancer) - **Source:** https://github.com/EvilFreelancer/secs/tree/main/.agents/skills/mapping-attack-techniques ## Install ```sh agentstack add skill-evilfreelancer-secs-mapping-attack-techniques ``` Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent. ## About # Mapping ATT&CK Techniques ATT&CK is a shared vocabulary, not a methodology. Its value is that offense, detection, and response can name the same behaviour — which makes this skill a router, not a technique catalogue. It resolves a technique to the skill that holds the actual procedure, and it runs the loop that connects the two sides. ## When to Use - A request names a technique ID (`T1003.001`), a technique name ("Kerberoasting"), or a tactic ("we need lateral movement coverage") - Converting a threat intel report or an adversary emulation plan into work - Planning or reporting coverage against the matrix - Running a purple team exercise: emulate, detect, validate, close the gap - Choosing which skill applies when a request spans offense and defense ## When NOT to Use - **A plain-language request** ("dump creds off this host") — the domain skills trigger directly on that; routing through here adds a hop for nothing - **Code-level vulnerability work** — ATT&CK does not model source defects; use `auditing-code-for-vulnerabilities` with CWE and ASVS instead - **AI/LLM systems** — use `securing-ai-systems`; the framework there is MITRE ATLAS, not ATT&CK Enterprise - **Mobile targets** — `testing-mobile-applications`; the Mobile matrix has its own IDs that do not correspond to Enterprise ones ## The Index `secskills-core/ttp-index.json` maps techniques to the skills that cover them. Read it directly to resolve a lookup: ```bash # Which skill covers this technique? python3 -c " import json;d=json.load(open('secskills-core/ttp-index.json')) print([r for r in d['techniques'] if r['id']=='T1003.001'])" # Everything under one tactic python3 -c " import json;d=json.load(open('secskills-core/ttp-index.json')) [print(r['id'], r['name'], '→', ', '.join(r['skills'])) for r in d['techniques'] if 'TA0008' in r['tactics']]" # Search by name when you have words, not an ID rg -i 'kerberoast|pass the hash' secskills-core/ttp-index.json ``` Each skill also carries a generated `## ATT&CK Coverage` section listing its techniques. That section and the index are kept in sync by `scripts/sync_attack.py`; the index is the source of truth. **Three things the index deliberately does not do.** It does not claim coverage of every technique — the `_unmapped` block names the skills that use a different framework and says which. It does not repeat detection and hunting on every row, because those apply to all of them. And it is hand-curated, so technique IDs drift as ATT&CK releases new versions: re-verify against [attack.mitre.org](https://attack.mitre.org) before citing an ID in a report. ## Resolving a Request ``` Technique ID or name → look up in the index → load the named skill Tactic → list the tactic's techniques → ask which procedure Intel report → extract TTPs (not IOCs) → map each → prioritize by what your environment actually exposes Group / APT name → pull the group's technique list from ATT&CK → intersect with your attack surface → hunt the intersection ``` **Techniques are not procedures.** T1055 (Process Injection) has a dozen materially different implementations, and a detection for one catches none of the others. When a request arrives as a bare technique ID, the useful next question is *which procedure* — the specific API sequence, tool, or command variant. Answering "we cover T1055" without naming a procedure is the most common way ATT&CK is used to mislead. ## The Purple Team Loop This is what the shared vocabulary is for. Each step hands to a different skill, and the technique ID is what keeps them talking about the same thing. ``` 1. Select → pick a technique by threat relevance, not matrix tidiness 2. Emulate → run the procedure (offensive skill, or Atomic Red Team) 3. Observe → did telemetry capture it? which data source, which fields? 4. Detect → write the rule against the behaviour → engineering-detections 5. Validate → re-run the emulation; confirm the alert fires and is triageable 6. Hunt → search historically for prior instances → hunting-threats 7. Record → tested / untested / no-telemetry, per technique ``` Step 3 is the one that produces the real finding. A technique that executes with no telemetry at all is a visibility gap, and that outranks a missing rule — you cannot write a detection for data you do not collect. Select techniques by relevance: what actors targeting your sector actually use, what your crown-jewel assets are reachable through, and where you already suspect a gap. Working left-to-right across the matrix produces even coverage of things nobody does to you. ## Coverage Reporting Report per technique in three states, never as a single percentage: | State | Means | | --- | --- | | **Tested** | Emulated, telemetry confirmed present fleet-wide, rule fired, triage steps exist | | **Untested** | A rule exists but has never been validated against an emulation | | **No telemetry** | The data source is not collected, or not on all platforms | A green ATT&CK Navigator layer built from untested rules is the most common self-deception in security programs. If you generate a layer, encode the three states as distinct colours and say in the legend what each means. ```bash # Navigator layer from the index (coverage claimed, not coverage tested) python3 -c " import json;d=json.load(open('secskills-core/ttp-index.json')) print(json.dumps({'name':'SecSkills skill coverage','versions':{'layer':'4.5'}, 'domain':'enterprise-attack', 'description':'Skills that cover each technique. Claimed, not validated.', 'techniques':[{'techniqueID':r['id'],'comment':', '.join(r['skills']),'score':1} for r in d['techniques']]}))" > coverage-layer.json ``` Label any generated layer as *claimed* coverage. Turning it into *tested* coverage requires the loop above, one technique at a time. ## Rationalizations to Reject - *"We cover that technique."* Which procedure, validated how, with which telemetry, on which platforms? - *"Let's get coverage across the whole matrix."* Even coverage is a misallocation. Prioritize by what is actually used against you. - *"The technique ID is in the rule's tags, so it's mapped."* Tagging is not testing. - *"ATT&CK doesn't have an ID for this, so it's out of scope."* The matrix is a model of observed behaviour, not a boundary. Code-level bugs, AI system attacks, and Web3 exploits have no Enterprise IDs and still matter — say which framework you used instead. - *"The intel report lists these IOCs, so hunt those."* Hunt the TTPs. The hashes and IPs in a published report are already dead. - *"We emulated it and nothing alerted, so the rule is broken."* Check telemetry first. Usually the data was never collected. ## Reading External Sources Fetch public advisories, specifications, and vendor reports as Markdown: ```bash curl -sL "https://defuddle.md/" # scheme in the path is optional ``` This strips page boilerplate — roughly 78% fewer tokens on a prose page — and returns the full text rather than a summary, so you can grep it and trust a negative result. Three things it is not for. Fetch JSON and API responses raw, because readability extraction mangles structured data. Fetch authenticated or JavaScript-rendered pages directly, because it retrieves them anonymously. And never route **adversary infrastructure** (phishing links, C2, malware hosting), **client-owned hosts**, or **engagement URLs** through it — the request leaves your machine to a third party, and for live adversary infrastructure it also tips off the operator. Some sites block the extractor and return an error blob rather than the page — `{"error":"Failed to fetch: 418 I'm a teapot"}` from freedesktop.org, for instance. That is the fetch being refused, **not** the source saying the thing does not exist. Re-fetch the URL directly before drawing any conclusion from it. ## References - `engineering-detections` — writing and validating the rule for a technique - `hunting-threats` — historical search for a technique in your environment - `responding-to-incidents` — mapping observed attacker activity to techniques - `secskills-core/ttp-index.json` — the technique-to-skill index this skill reads - MITRE ATT&CK, ATT&CK Navigator, Atomic Red Team, CALDERA, MITRE ATLAS (AI) ## Source & license This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code. - **Author:** [EvilFreelancer](https://github.com/EvilFreelancer) - **Source:** [EvilFreelancer/secs](https://github.com/EvilFreelancer/secs) - **License:** Apache-2.0 Install and usage instructions live in the source repository linked above. ## Pricing - **Free** — Free ## Security capabilities Automated source analysis of v0.1.0 — what this tool can access: - **Network access:** yes - **Filesystem access:** no - **Shell / process execution:** no - **Environment & secrets:** no - **Dynamic code execution:** no *"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.* ## Versions - **0.1.0** — security scan: passed — Imported from the upstream source. ## Links - Listing page: https://agentstack.voostack.com/l/skill-evilfreelancer-secs-mapping-attack-techniques - Seller: https://agentstack.voostack.com/s/evilfreelancer - Browse the marketplace: https://agentstack.voostack.com/browse --- Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.