mitre-attack

Maps adversary tactics, techniques, and procedures to detection coverage and threat intelligence workflows.

Updated Jun 5, 2026

Search Tags:#gap analysis #threat intelligence #soc #mitre att&ck #detection engineering #threat actor profiling #ttp mapping

Ready to run

npx skills add https://github.com/yogiex/opencode-cyber-security-skills --skill mitre-attack-yogiex

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: mitre-attack
Source: https://github.com/yogiex/opencode-cyber-security-skills/tree/main/skills/mitre-attack
Command: npx skills add https://github.com/yogiex/opencode-cyber-security-skills --skill mitre-attack-yogiex

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security teams struggle to translate raw threat data into structured knowledge about adversary behavior, making it hard to assess detection coverage, profile threat actors, and identify defensive gaps. ## Core Features & Use Cases - Threat Actor Profiling: Map groups like APT29 or Lazarus to their observed techniques, software, and targeted sectors for CTI reporting. - Detection Engineering: Map Sigma rules and telemetry data sources to technique IDs (e.g., T1059.001) and build coverage matrices. - Defensive Gap Analysis: Prioritize high-risk techniques, assess existing detection and mitigation coverage, and identify gaps requiring new rules or controls. - Use Case: A SOC analyst investigating a PowerShell-based intrusion uses the skill to map observed behavior to T1059.001, check which data sources detect it, and document coverage in an ATT&CK Navigator layer. ## Quick Start Ask the agent to map the techniques used by APT29 and assess whether your current detection rules cover them.

Frequently Asked Questions about mitre-attack

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I map detection rules to MITRE ATT&CK techniques?▼

Identify the technique ID each rule addresses (e.g., a PowerShell Sigma rule maps to T1059.001), then record the required data source and coverage status in a matrix. ATT&CK Navigator can visualize the result as a heatmap layer.

What is the difference between ATT&CK tactics, techniques, and sub-techniques?▼

Tactics describe why an adversary acts (the goal, like Credential Access), techniques describe how (e.g., T1003 OS Credential Dumping), and sub-techniques are specific variants (e.g., T1003.001 LSASS Memory). Procedures are concrete implementations by specific groups.

How do I use MITRE ATT&CK for threat actor profiling?▼

Look up the group in ATT&CK to see its documented techniques, software, and targeted sectors. Combine this with incident data to build a profile of favored tactics, typical tools, and likely follow-on techniques.

What data sources are needed to detect ATT&CK techniques?▼

Each technique lists required data components such as Process Creation, Command Execution, Network Traffic, Registry modification, or Cloud API calls. Map your existing telemetry (EDR, Sysmon, Zeek, CloudTrail) against these to find collection gaps.

When should I not use the MITRE ATT&CK framework?▼

ATT&CK is not suited for step-by-step incident response procedures, organizational risk management, or architectural threat modeling. Use dedicated incident response plans, NIST CSF, or STRIDE-based threat modeling for those tasks.