skills.rest
jassics
jassicsCOMMUNITY
Explore all skills by this author →
Website𝕏@jassicsGitHub

attack-lookup

Map observed behaviors to MITRE ATT&CK technique IDs and references.

6|Updated May 30, 2026
Search Tags:#cybersecurity#detection#red teaming#malware analysis#mitre attack andck
One-click install
npx skills add https://github.com/jassics/awesome-claude-security --skill attack-lookup
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: attack-lookup
Source: https://github.com/jassics/awesome-claude-security/tree/main/plugins/security-knowledge/skills/attack-lookup
Command: npx skills add https://github.com/jassics/awesome-claude-security --skill attack-lookup

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill provides a fast reference to MITRE ATT&CK technique IDs, helping you map observed behaviors, findings, or detections to the correct technique quickly.

Core Features & Use Cases

  • ATT&CK Reference: Quickly look up and reference MITRE ATT&CK tactics, techniques, and mitigations.
  • Mapping Behavior: Map an observed behavior to the corresponding technique ID(s) for consistent ATT&CK references.
  • Use Case: For instance, when you need to identify which ATT&CK technique corresponds to a detected malware behavior.

Quick Start

To look up a technique ID for a specific behavior, use the command: /attack-lookup:find-technique behavior="malware behavior"

Frequently Asked Questions about attack-lookup

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I map observed malware behavior to a MITRE ATT&CK technique ID?▼

You map observed malware behavior to a MITRE ATT&CK technique ID by using a lookup command to quickly cross-reference the behavior against the ATT&CK matrix for accurate detection mapping.

What is the best way to find MITRE ATT&CK mitigations for a detected cyber threat?▼

Finding MITRE ATT&CK mitigations for a detected cyber threat involves referencing the current ATT&CK matrix to retrieve related mitigation data mapped to the specific observed behavior or technique ID.

Can I use this for red teaming operations to reference specific ATT&CK techniques?▼

Yes, you can use this for red teaming operations to obtain consistent reference and mapping of detections to the ATT&CK framework, applying it to observed behaviors or findings during engagements.

Does the attack-lookup Skill require external dependencies to map cybersecurity detections?▼

No, the attack-lookup Skill requires no external dependencies to map cybersecurity detections, but it does require reference to the current MITRE ATT&CK matrix and related mitigation data for accurate behavior mapping.

When do I need to map observed behaviors to the ATT&CK framework?▼

You need to map observed behaviors to the ATT&CK framework when you are a cybersecurity analyst or red-teamer requiring consistent reference and mapping of detections to standardize threat intelligence and malware analysis.

Related Skills

Explore More Software Engineering Skills→
jassicsjassics
6

detection-coverage-review

Analyze detection coverage against the MITRE ATT&CK matrix to identify gaps.

Community
Intermediate
MHaggisMHaggis
471

ATT&CK Navigator Layer Generator

Generate MITRE ATT&CK Navigator JSON layers for detection coverage and gap analysis.

Community
Intermediate
aviskaaraviskaar
6

threat-hunter

Conduct proactive threat hunting campaigns using MITRE ATT&CK frameworks.

Official
Advanced
vignesh2027vignesh2027
6

cybersecurity-analyst

Model threats and develop hunting hypotheses aligned to MITRE ATT&CK techniques.

Community
Advanced