skills.rest
OpenTideHQ
OpenTideHQOFFICIAL
Explore all skills by this author →
WebsiteGitHub

mitre-attack

Maps adversary behaviors to MITRE ATT&CK techniques for detection engineering objects.

Updated Jun 24, 2026
Search Tags:#threat detection#coverage analysis#tactics#siem#mitre att&ck#detection engineering#technique mapping
One-click install
npx skills add https://github.com/opentidehq/skills --skill mitre-attack-opentidehq
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: mitre-attack
Source: https://github.com/opentidehq/skills/tree/main/skills/mitre-attack
Command: npx skills add https://github.com/opentidehq/skills --skill mitre-attack-opentidehq

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Detection engineers often mislabel threat intelligence with wrong ATT&CK technique IDs, over-tag detection rules, or use revoked techniques, producing unreliable coverage claims. This Skill enforces disciplined ATT&CK mapping across OpenTide TVM, DOM, and MDR objects. ## Core Features & Use Cases - Mapping Discipline: Decision rules for choosing tactic vs technique vs sub-technique, correct tactic assignment by adversary intent, and multi-technique chaining with independent evidence per step. - Version & Revocation Handling: Guidance for ATT&CK v19 (including the Defense Evasion split into Stealth TA0005 and Defense Impairment TA0112), version pinning, and replacing revoked technique IDs. - Coverage Gap Analysis: Inverse mapping from detection rules to the ATT&CK matrix with Detected/Hunted/Theoretical/Gap classification and anti-pattern detection. - Use Case: When writing a detection rule for LSASS memory dumping, use this Skill to map it precisely to T1003.001, validate the data components your platform collects, and confirm the technique applies to your target platform. ## Quick Start Use the mitre-attack skill to map this threat intelligence report to the correct ATT&CK techniques and check our detection coverage gaps.

Frequently Asked Questions about mitre-attack

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I map threat intelligence to MITRE ATT&CK techniques?▼

Map to the most specific level the evidence supports: use a sub-technique when the implementation is documented (e.g., T1003.001 for LSASS dumping), the parent technique when only the behavior class is known, and a tactic only for vague early-stage intelligence. Never list both a parent and its sub-technique for the same behavior.

How do I choose the right ATT&CK tactic for a technique?▼

Select the tactic matching the adversary's goal in context, not every tactic the technique supports. For example, schtasks used for persistence maps to TA0003, while the same command running a one-time payload maps to Execution TA0002.

What changed in MITRE ATT&CK v19 for Defense Evasion?▼

ATT&CK v19 split Defense Evasion into Stealth (TA0005), covering hiding artifacts and obfuscation, and Defense Impairment (TA0112), covering disabling tools and clearing logs. Existing TA0005 mappings must be reviewed and re-assigned to the correct new tactic.

How do I handle revoked ATT&CK technique IDs in detection content?▼

Search the content repository for the revoked ID, update it to the replacement technique, review the description since scope may differ, and log the change in the PR narrative. Deprecated techniques with no replacement should be removed and the gap documented.

How many techniques should a detection rule map to?▼

A detection rule typically maps to one or two techniques that its query and data sources can actually observe. Rules claiming five or more techniques indicate over-tagging, and a rule must never claim techniques outside its platform or telemetry visibility.

How do I measure detection coverage against the ATT&CK matrix?▼

Extract all technique IDs from MDR rules, map them against the Enterprise matrix, and classify each technique as Detected, Hunted, Theoretical, or Gap. Validate claims against available data components to avoid phantom or stale coverage.

Related Skills

Explore More Software Engineering Skills→
xalgordxalgord
954

building-attack-pattern-library-from-cti-reports

Extract adversary behaviors from CTI reports and build STIX 2.1 attack pattern libraries mapped to MITRE ATT&CK.

Community
Intermediate
xalgordxalgord
954

building-detection-rules-with-sigma

Create vendor-agnostic Sigma detection rules and convert them to Splunk, Elastic, and Sentinel queries.

Community
Advanced
xalgordxalgord
954

building-threat-hunt-hypothesis-framework

Builds testable threat hunt hypotheses from threat intelligence, ATT&CK techniques, and telemetry data sources.

Community
Intermediate
daemon-blockint-techdaemon-blockint-tech
7

cti-analyst

Vet and package cyber threat intelligence with STIX/TAXII exports and ATT&CK mappings.

Community
Advanced