skills.rest
woohyun212
woohyun212COMMUNITY
Explore all skills by this author →
WebsiteGitHub

mitre-attack-lookup

Query ATT&CK techniques, groups, software, and mitigations from local markdown files.

21|1|Updated Apr 12, 2026
Search Tags:#python#lookup#incident-response#threat-hunting#mitre#attack
One-click install
npx skills add https://github.com/woohyun212/security-skill --skill mitre-attack-lookup
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: mitre-attack-lookup
Source: https://github.com/woohyun212/security-skill/tree/main/mitre-attack-lookup
Command: npx skills add https://github.com/woohyun212/security-skill --skill mitre-attack-lookup

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security analysts need fast, offline access to detailed ATT&CK data for techniques, groups, software, and mitigations without relying on external services or APIs.

Core Features & Use Cases

  • Comprehensive ATT&CK queries: Retrieve technique details, group tactics, software information, and mitigation guidance from the locally cloned mitrize repository.
  • Incident response and threat hunting: Map observed behaviors or IOCs to ATT&CK techniques and generate group profiles for attribution.
  • Search and comparison: Perform keyword searches across the entire ATT&CK knowledge base and compare technique overlap between threat groups.

Quick Start

Ask the AI to look up the ATT&CK technique T1059 and list its description and mitigations.

Frequently Asked Questions about mitre-attack-lookup

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I lookup ATT&CK techniques and groups offline for incident response?▼

To lookup ATT&CK techniques and groups offline, query a locally cloned mitrize repository using Python 3 stdlib to retrieve detailed technique, group, software, and mitigation mappings without external APIs.

Can I search the entire ATT&CK knowledge base and compare technique overlap between threat groups?▼

Yes, you can perform keyword searches across the entire ATT&CK knowledge base and compare technique overlap between threat groups directly from the locally cloned markdown files.

Do I need external dependencies or API keys to query MITRE ATT&CK data for threat hunting?▼

No external dependencies or API keys are required to query MITRE ATT&CK data; the skill relies solely on Python 3 stdlib to parse the locally cloned mitrize markdown repository.

What is the best way to map observed IOCs to ATT&CK techniques during security assessments?▼

The best way to map observed IOCs to ATT&CK techniques is using a local lookup tool that queries the offline knowledge base to retrieve related tactics, group profiles, and mitigation guidance.

Does the ATT&CK lookup tool work without internet access for retrieving mitigation guidance?▼

Yes, the ATT&CK lookup works entirely offline without internet access, querying the local mitrize repository to retrieve mitigation guidance, software information, and group tactics.

How do I retrieve detailed group profiles and software information for ATT&CK attribution?▼

To retrieve detailed group profiles and software information for ATT&CK attribution, query the local markdown repository to map observed behaviors to specific threat groups and their associated tools.

Related Skills

Explore More Data & Analytics Skills→
OpenTideHQOpenTideHQ
4

mitre-attack

Map OpenTide object signals to MITRE ATT&CK techniques with a local index.

Official
Advanced
jfrometajfrometa

red-team-tactics

Map adversary techniques to MITRE ATT&CK phases for red-team simulations.

Community
Basic
jaskaranhundaljaskaranhundal
3

threat-intelligence

Enrich security events by classifying IOCs and mapping behaviors to MITRE ATT&CK techniques.

Community
Advanced
Hack23Hack23
9

security-architecture

Create security architecture documents including threat models and defense-in-depth strategies.

Official
Basic