skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

mapping-mitre-attack-techniques

Maps detections and adversary behaviors to MITRE ATT&CK techniques for coverage analysis.

954|172|Updated Mar 13, 2026
Search Tags:#threat intelligence#siem#mitre att&ck#detection engineering#sigma rules#attack navigator#coverage heatmap
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill mapping-mitre-attack-techniques
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: mapping-mitre-attack-techniques
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-intelligence/mapping-mitre-attack-techniques
Command: npx skills add https://github.com/xalgord/xalgorix --skill mapping-mitre-attack-techniques

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires mitreattack-python.

What problem does it solve?

Security teams struggle to know which MITRE ATT&CK techniques their detection stack actually covers, leaving blind spots that adversaries can exploit. This Skill maps SIEM alerts, Sigma rules, and observed adversary behaviors to ATT&CK techniques and sub-techniques, quantifies detection coverage, and prioritizes gaps based on threat intelligence.

Core Features & Use Cases

  • ATT&CK Coverage Mapping: Tag Sigma rules and SIEM use cases with technique IDs and classify each technique as Detected, Logged, or Blind.
  • Threat-Informed Prioritization: Cross-reference coverage gaps with adversary groups (e.g., APT29) targeting your sector using the mitreattack-python library.
  • Navigator Heatmap Generation: Export coverage scores as ATT&CK Navigator JSON layers and produce executive reports ranking blind-spot techniques.
  • Use Case: A SOC lead needs to justify budget for new logging. Use this Skill to build a coverage heatmap showing that 12 Execution sub-techniques are blind, then recommend enabling PowerShell Script Block Logging to close the gap.

Quick Start

Map my existing Sigma detection rules to MITRE ATT&CK techniques and generate an ATT&CK Navigator heatmap showing current detection coverage and prioritized gaps.

Frequently Asked Questions about mapping-mitre-attack-techniques

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I map Sigma rules to MITRE ATT&CK techniques?▼

Sigma rules support native ATT&CK tagging via the tags field, using entries like attack.t1059.001 for specific sub-techniques. Assign technique IDs to each rule, then classify coverage as Detected, Logged, or Blind to build a coverage matrix.

How do I create an ATT&CK Navigator heatmap for detection coverage?▼

Build a Navigator JSON layer with technique IDs and coverage scores from 0 to 100, then import it into the ATT&CK Navigator web app. The layer format specifies version, domain, techniques with scores and comments, and a color gradient.

What Python library queries MITRE ATT&CK data programmatically?▼

The mitreattack-python library provides programmatic access to ATT&CK STIX data, including techniques, groups, software, and mitigations. Install it with pip and load the enterprise-attack.json STIX bundle to query techniques and group associations.

Does logging a data source mean an ATT&CK technique is detected?▼

No, logging telemetry like process creation events does not equal detection. A technique is only covered when a detection rule actually fires on malicious patterns, so coverage scoring should distinguish Detected, Logged, and Blind states.

When should I not use ATT&CK coverage mapping?▼

ATT&CK mapping is an analytical activity and should not be used for real-time incident triage. It is best performed post-detection, during threat hunting planning, or when assessing detection program coverage against adversary groups.

Related Skills

Explore More Software Engineering Skills→
AradotsoAradotso
11

security-detections-mcp

Query security detection rules across multiple formats with MITRE ATT&CK coverage analysis.

Official
Advanced
MHaggisMHaggis
471

Atomic Red Team Testing

Execute and validate Atomic Red Team adversary emulation tests across SIEMs.

Community
Advanced
blamejsblamejs

defensive-countermeasure-mapping

Map offensive security findings to MITRE D3FEND defensive countermeasures.

Official
Advanced
dmaynordmaynor
5

purple-teaming

Plan and execute purple team exercises to validate security detections against MITRE ATT&CK techniques.

Community
Advanced