skills.rest
blamejs
blamejsOFFICIAL
Explore all skills by this author →
WebsiteGitHub

defensive-countermeasure-mapping

Map offensive security findings to MITRE D3FEND defensive countermeasures.

Updated May 11, 2026
Search Tags:#threat modeling#compliance#zero trust#blue team#mitre#d3fend#defensive mapping
One-click install
npx skills add https://github.com/blamejs/exceptd-skills --skill defensive-countermeasure-mapping
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: defensive-countermeasure-mapping
Source: https://github.com/blamejs/exceptd-skills/tree/main/skills/defensive-countermeasure-mapping
Command: npx skills add https://github.com/blamejs/exceptd-skills --skill defensive-countermeasure-mapping

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security operations centers can articulate attacker behavior at MITRE ATT&CK/ATLAS technique-level granularity, but most cannot map their own deployed defenses to the same grain, leading to under-defended systems, compliance theater, and false confidence in security postures against modern AI and cyber threats.

Core Features & Use Cases

  • Offensive-to-Defensive Mapping: Converts offensive findings (CVEs, ATLAS/ATT&CK TTPs, framework control gaps, CWEs, DLP concerns) into explicit MITRE D3FEND defensive countermeasure maps.
  • Layered Defense Enforcement: Every output is threaded through defense-in-depth, least-privilege, and zero-trust principles, surfacing gaps where only a single defensive layer is deployed.
  • Compliance Gap Identification: Flags where common compliance frameworks (NIST, ISO 27001, NIS2, etc.) operate at too coarse a grain to address technique-level threats, eliminating audit false positives and compliance theater.
  • Use Case: A blue team responding to a kernel local privilege escalation CVE can use this skill to generate a full multi-layer defensive map instead of only claiming generic EDR detection coverage, identifying missing hardening, isolation, and restore controls.

Quick Start

Use the defensive-countermeasure-mapping skill to generate a layered D3FEND defensive map for the CVE-2026-31431 kernel LPE finding, including defense-in-depth layers, least-privilege scoping, and zero-trust posture for each recommended countermeasure.

Frequently Asked Questions about defensive-countermeasure-mapping

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I map MITRE ATT&CK TTPs to D3FEND defensive countermeasures?▼

Mapping MITRE ATT&CK techniques to D3FEND countermeasures converts offensive findings into layered defensive controls, explicitly threading defense-in-depth, least-privilege scoping, and zero-trust posture classification for each recommended countermeasure.

What is the best way to map CVEs to layered defensive controls for a SOC?▼

Mapping CVEs to layered defensive controls generates a full multi-layer D3FEND map instead of generic EDR coverage, identifying missing hardening, isolation, and restore controls for threats like kernel local privilege escalation exploits.

How do I identify compliance theater gaps in NIST or ISO 27001 frameworks?▼

Identifying compliance theater gaps flags where common compliance frameworks operate at too coarse a grain to address technique-level threats, eliminating audit false positives and false confidence in security postures against modern threats.

Can I map defensive countermeasures for AI pipeline threats like LLM prompt injection?▼

Mapping defensive countermeasures for AI pipeline threats addresses mid-2026 threat landscapes including LLM prompt injection, MCP supply chain attacks, and kernel LPE exploits by generating explicit D3FEND countermeasure maps for ATLAS findings.

Does defensive mapping work for zero trust architecture implementation?▼

Defensive mapping works for zero trust architecture by applying zero-trust posture classification to each D3FEND countermeasure, ensuring least-privilege privilege scoping and defense-in-depth layers are explicitly threaded throughout the deployed controls.

Why do my compliance controls fail to cover technique-level ATT&CK threats?▼

Compliance controls fail to cover technique-level ATT&CK threats because standard frameworks operate at too coarse a grain, creating compliance theater where framework controls cannot address the specific technique-level behavior of modern cyber and AI threats.

Related Skills

Explore More Legal & Compliance Skills→
jfrometajfrometa

red-team-tactics

Map adversary techniques to MITRE ATT&CK phases for red-team simulations.

Community
Basic
Jayarr03Jayarr03

mitre-defend-review

Analyze system controls for MITRE D3FEND compliance and defensive coverage gaps.

Community
Advanced
intelligentcode-aiintelligentcode-ai
35

security-engineer

Automate vulnerability assessments, architecture reviews, and compliance audits.

Official
Basic
MHaggisMHaggis
471

ATT&CK Navigator Layer Generator

Generate MITRE ATT&CK Navigator JSON layers for detection coverage and gap analysis.

Community
Intermediate