skills.rest
yogiex
yogiexCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

mitre-attack

Maps adversary tactics, techniques, and procedures to detection coverage and threat intelligence workflows.

Updated Jun 5, 2026
Search Tags:#gap analysis#threat intelligence#soc#mitre att&ck#detection engineering#threat actor profiling#ttp mapping
One-click install
npx skills add https://github.com/yogiex/opencode-cyber-security-skills --skill mitre-attack-yogiex
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: mitre-attack
Source: https://github.com/yogiex/opencode-cyber-security-skills/tree/main/skills/mitre-attack
Command: npx skills add https://github.com/yogiex/opencode-cyber-security-skills --skill mitre-attack-yogiex

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security teams struggle to translate raw threat data into structured knowledge about adversary behavior, making it hard to assess detection coverage, profile threat actors, and identify defensive gaps. ## Core Features & Use Cases - Threat Actor Profiling: Map groups like APT29 or Lazarus to their observed techniques, software, and targeted sectors for CTI reporting. - Detection Engineering: Map Sigma rules and telemetry data sources to technique IDs (e.g., T1059.001) and build coverage matrices. - Defensive Gap Analysis: Prioritize high-risk techniques, assess existing detection and mitigation coverage, and identify gaps requiring new rules or controls. - Use Case: A SOC analyst investigating a PowerShell-based intrusion uses the skill to map observed behavior to T1059.001, check which data sources detect it, and document coverage in an ATT&CK Navigator layer. ## Quick Start Ask the agent to map the techniques used by APT29 and assess whether your current detection rules cover them.

Frequently Asked Questions about mitre-attack

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I map detection rules to MITRE ATT&CK techniques?▼

Identify the technique ID each rule addresses (e.g., a PowerShell Sigma rule maps to T1059.001), then record the required data source and coverage status in a matrix. ATT&CK Navigator can visualize the result as a heatmap layer.

What is the difference between ATT&CK tactics, techniques, and sub-techniques?▼

Tactics describe why an adversary acts (the goal, like Credential Access), techniques describe how (e.g., T1003 OS Credential Dumping), and sub-techniques are specific variants (e.g., T1003.001 LSASS Memory). Procedures are concrete implementations by specific groups.

How do I use MITRE ATT&CK for threat actor profiling?▼

Look up the group in ATT&CK to see its documented techniques, software, and targeted sectors. Combine this with incident data to build a profile of favored tactics, typical tools, and likely follow-on techniques.

What data sources are needed to detect ATT&CK techniques?▼

Each technique lists required data components such as Process Creation, Command Execution, Network Traffic, Registry modification, or Cloud API calls. Map your existing telemetry (EDR, Sysmon, Zeek, CloudTrail) against these to find collection gaps.

When should I not use the MITRE ATT&CK framework?▼

ATT&CK is not suited for step-by-step incident response procedures, organizational risk management, or architectural threat modeling. Use dedicated incident response plans, NIST CSF, or STRIDE-based threat modeling for those tasks.

Related Skills

Explore More Software Engineering Skills→
xalgordxalgord
954

hunting-for-spearphishing-indicators

Detect spearphishing campaigns by hunting indicators across email logs, endpoint telemetry, and network data.

Community
Intermediate
xalgordxalgord
954

performing-threat-emulation-with-atomic-red-team

Executes Atomic Red Team tests to validate MITRE ATT&CK detection coverage.

Community
Intermediate
xalgordxalgord
954

conducting-malware-incident-response

Guides malware incident response from detection through containment, eradication, and recovery.

Community
Advanced
defconxtdefconxt

Threat Intelligence

Profile threat actors and manage IOCs using the Diamond Model and Cyber Kill Chain.

Community
Advanced