I85PREP
⌘ K
MITRE ATT&CK Fundamentals study materials
MITRE ATT&CK Fundamentals study resources

MITRE ATT&CK Fundamentals: Threat-Informed Defense and Mapping to ATT&CK

MITRE ATT&CK Fundamentals · Work through your exam, one topic at a time.

All guide sections

Threat-Informed Defense and Mapping to ATT&CK

The Threat-Informed Defense and Mapping to ATT&CK domain tests whether you can turn intelligence into prioritized defensive work. Threat-informed defense uses ATT&CK to connect adversary behavior to defensive priorities. The workflow is: define scope, collect intelligence, extract observable behaviors, map each behavior to the most specific defensible technique, record evidence and confidence, then assess detection, mitigation, and response gaps. The output should drive detection engineering, control tuning, purple-team exercises, and risk decisions-not a one-time slide.

Core rules

  • Map behavior, not actor names or malware brands.
  • Record source, confidence, and the exact procedure text.
  • Use the parent technique when evidence is incomplete; use a sub-technique when the distinguishing detail is present.
  • Reassess mappings when ATT&CK versions or intelligence change.
  • Measure detection quality, not just the percentage of techniques colored.

Worked example

A report states that an actor used a spearphishing attachment, PowerShell, and scheduled tasks. The mapping is Phishing: Spearphishing Attachment (T1566.001), PowerShell (T1059.001), and Scheduled Task/Job (T1053). The team checks whether email attachments are detonated, PowerShell script-block logging is enabled, and scheduled-task creation is audited. They prioritize the gap with the highest likelihood and impact, then write a test that reproduces the procedure. The actor's name is recorded as context, not as the mapping target.

Traps

Over-mapping to many techniques inflates coverage. Mapping only to tactics hides implementation detail. Copying a vendor mapping without checking evidence creates false confidence. Treating ATT&CK coverage as a compliance score ignores detection quality and environment context. Finally, do not let a mapping become permanent; adversary behavior and telemetry change.