Threat Intelligence Mapping to ATT&CK
What this domain tests
This domain tests conversion of threat intelligence into defensible ATT&CK mappings. The exam focuses on evidence quality, granularity, confidence, and the difference between an intrusion set, malware, and a behavior.
Core rules
- Map behavior, not an indicator alone. A file hash or IP address supports context but does not by itself identify a technique.
- Use the lowest granularity the source supports. If a report says PowerShell but not the specific invocation, T1059.001 may fit; if it only says command execution, map the parent or leave it unassigned.
- Keep source reliability and analytic confidence separate from ATT&CK confidence. A high-reliability source can still describe a low-confidence behavior.
- Groups are intrusion sets, software is tooling or malware, and campaigns are time-bound activities. Do not equate a group with a malware family or a technique.
- Record the evidence phrase, platform, source, date, and confidence for each mapping. Avoid mapping every sentence in a report.
Worked example
A report states that an actor sent a spearphishing attachment that launched PowerShell to download a payload and created a scheduled task. Defensible mappings include T1566.001 Phishing: Spearphishing Attachment, T1059.001 PowerShell, T1105 Ingress Tool Transfer, and T1053.005 Scheduled Task. Reasoning: each verb describes a distinct behavior with a matching technique. The word payload alone is not a technique; the download and scheduled task are. If the report does not specify the attachment type, map T1566 rather than T1566.001.
Traps that cost marks
Mapping IOCs as techniques, over-specifying sub-techniques without evidence, treating ATT&CK group pages as current campaign reporting, and ignoring platform constraints. Also avoid using a group name as a detection hypothesis without behavior.