MITRE ATT&CK Mapping Skill

Post-analysis enrichment tool that maps existing security findings to the MITRE ATT&CK framework. This skill does NOT discover new vulnerabilities. It takes findings produced by other skills (OWASP, STRIDE, SANS/CWE Top 25) and enriches them with ATT&CK tactics, techniques, attack chain analysis, and threat actor TTP cross-references.

This skill operates on findings, not on source code directly.

Supported Flags

Read ../../shared/schemas/flags.md for the full flag specification. This skill supports the following flags.

| Flag | Skill-Specific Behavior | |------|------------------------| | --scope | Not used directly. Findings are sourced from prior analysis or .appsec/findings.json. | | --depth | Controls enrichment depth. standard maps techniques. deep builds kill chains. expert adds threat actor TTPs and DREAD scoring. | | --severity | Filter input findings before mapping. Only findings at or above this severity are processed. | | --format | Applied to final output. | | --quiet | Mappings only, suppress narrative descriptions. | | --explain | Add detailed ATT&CK context and learning material per mapping. |

Framework Reference

Read ../../shared/frameworks/mitre-attck.md for the full MITRE ATT&CK specification including tactic definitions, technique descriptions, code-level patterns, cross-framework mapping tables, and kill chain construction guidance.

Workflow

Step 1: Acquire Findings

Collect existing findings from one or more sources, checked in priority order:

Current conversation context: If findings are present from a prior analysis step (e.g., /appsec:owasp or /appsec:stride), use those.
Findings file: Check .appsec/findings.json for persisted findings.
User-specified file: If the user provides a path, read and parse it.

If no findings are available, inform the user and suggest running /appsec:owasp, /appsec:stride, or /appsec:sans25 first.

Step 2: Validate and Normalize Findings

Verify each finding conforms to shared/schemas/findings.md. Ensure required fields are present (id, title, severity, location.file, description). Discard malformed entries with a warning.

Normalize existing cross-references for mapping priority:

references.cwe — primary key for ATT&CK mapping.
references.owasp — secondary, via OWASP-to-ATT&CK table.
references.stride — tertiary, via STRIDE-to-ATT&CK table.

Step 3: Map Findings to ATT&CK Techniques

For each finding, determine applicable ATT&CK techniques using the cross-framework mapping tables in mitre-attck.md:

CWE-based: "ATT&CK Techniques to CWE" table (e.g., CWE-89 maps to T1190, T1059).
OWASP-based: "ATT&CK Techniques to OWASP Top 10" table (when CWE unavailable).
STRIDE-based: "ATT&CK Techniques to STRIDE" table (tertiary source).
Pattern-based: Analyze description and title keywords against technique descriptions.

For each mapped technique, record technique_id, technique_name, tactic_id, and tactic_name. Update references.mitre_attck with the primary technique ID.

Step 4: Build Tactic Coverage Matrix

Each technique belongs to one or more tactics. Produce a matrix showing which tactics each finding touches:

| Finding ID | Recon | Initial Access | Execution | Priv Esc | Cred Access | Collection | Exfiltration | Impact | |------------|-------|---------------|-----------|----------|-------------|------------|--------------|--------| | INJ-001 | | T1190 | T1059 | | T1552 | T1005 | T1041 | T1485 | | AUTH-003 | T1589 | T1078 | | T1548 | T1110 | | | |

Step 5: Build Attack Chains

Group findings that chain into multi-step attack scenarios from reconnaissance through impact. For each chain:

Entry point: A finding enabling Initial Access (TA0001) or Reconnaissance (TA0043).
Lateral steps: Trace technique-to-technique transitions through the kill chain.
Terminal impact: Map to Impact tactics (TA0040): data destruction (T1485), manipulation (T1565), ransomware (T1486), or DoS (T1498).
Chain severity: Maximum terminal impact severity, elevated one level if 3+ findings compound.

CHAIN-001: SQL Injection to Data Exfiltration
  Severity: critical
  Steps:
    1. [INJ-001] SQL injection in /api/users (T1190 -> Initial Access)
    2. [INJ-001] Database dump via UNION SELECT (T1005 -> Collection)
    3. [CRYPT-002] Credentials stored in plaintext (T1552 -> Credential Access)
    4. [AUTH-003] No MFA on admin portal (T1078 -> Privilege Escalation)
  Impact: Full database compromise, credential theft, admin takeover

Step 6: Kill Chain Visualization

Produce a text-based kill chain diagram mapping findings onto Lockheed Martin Cyber Kill Chain stages aligned with ATT&CK tactics:

Reconnaissance   Initial Access    Execution        Collection       Exfiltration
     |                |                |                |                |
     v                v                v                v                v
[T1595 Scan] -> [T1190 SQLi] --> [T1059 Cmd] -> [T1005 Dump] -> [T1041 Exfil]
                 INJ-001           INJ-001        INJ-001
                                                     |
                                                     v
                                   [T1552 Creds] -> [T1078 Acct] -> [T1548 Priv]
                                    CRYPT-002        AUTH-003        AUTH-003

For --format json, produce a structured chain object with nodes and edges.

Step 7: Cross-Reference Threat Actor TTPs

Available at --depth deep and --depth expert. For each technique, note which threat actor groups commonly use it:

| Technique | Known Usage | |-----------|-------------| | T1190 Exploit Public-Facing App | APT28, APT41, Lazarus Group, FIN7, most initial access brokers | | T1078 Valid Accounts | APT29, APT41, FIN6 -- commonly after credential theft | | T1552 Unsecured Credentials | APT33, FIN7 -- harvesting from config files | | T1505.003 Web Shell | APT41, Hafnium -- persistent access via uploaded shells |

This is NOT a threat intelligence assessment. It shows that identified techniques are actively used in real-world attacks.

Step 8: Produce Output

{
  "tool": "mitre",
  "input_findings": 12,
  "mapped_findings": 10,
  "unmapped_findings": 2,
  "techniques_identified": 8,
  "tactics_covered": 6,
  "attack_chains": 2,
  "tactic_coverage": {
    "reconnaissance": ["T1595"],
    "initial_access": ["T1190", "T1078"],
    "execution": ["T1059"],
    "credential_access": ["T1552", "T1110"],
    "collection": ["T1005"],
    "exfiltration": ["T1041"],
    "impact": ["T1485"]
  },
  "chains": [ ... ],
  "enriched_findings": [ ... ]
}

Step 9: Present Results

Output the report in the requested --format. Include:

Mapping summary: findings mapped, techniques identified, tactics covered.
Tactic coverage matrix: ATT&CK tactics represented and gaps.
Technique breakdown: findings per technique with parent tactic.
Attack chains: step-by-step narrative with kill chain visualization.
Coverage gaps: tactics with no mapped findings flagged as areas needing further analysis.

Expert Mode

If --depth expert is set, additionally:

Read ../../shared/frameworks/dread.md for DREAD scoring criteria. Assign a DREAD score to each attack chain.
Threat actor profiling: For each chain, identify the most likely threat actor class (opportunistic, insider, APT, nation-state) based on complexity and resources required.
Detection gap analysis: For each technique in a chain, assess whether the codebase has logging or alerting to detect the attack at that stage. Cross-reference with OWASP A09 findings if available. Flag chains where multiple stages lack detection as highest priority.
Mitigation roadmap: For each chain, produce a prioritized list of mitigations that break the chain at the earliest stage. Prefer mitigations that break multiple chains simultaneously.
Append expert findings with prefix ATK and metadata.tool set to "mitre-attck".