---
name: rt-mitre-map
description: "Map Red Team findings to MITRE ATT&CK framework tactics and techniques. Identify technique IDs for each finding, create coverage matrix, and generate ATT&CK Navigator layer JSON. Covers all 14 tactics and 200+ techniques. Helps demonstrate adversary simulation depth and aligns with threat intelligence."
---

# rt-mitre-map — MITRE ATT&CK Mapping Skill

## 1. Overview and Purpose

The `rt-mitre-map` skill translates raw Red Team findings into structured MITRE ATT&CK coverage. It answers the fundamental client question: *"Which adversary behaviors did you simulate, and how does that compare to real-world threat actors targeting our industry?"*

### When to Use This Skill

- After collecting three or more confirmed findings from `finding_tracker.py`
- Before generating the executive or technical report (gives the report its threat-intelligence anchor)
- When a client requests ATT&CK Navigator layers for their SOC or purple team
- When demonstrating adversary simulation depth versus a standard vulnerability assessment

### Position in Engagement Lifecycle

```
Reconnaissance -> Exploitation -> Post-Exploitation -> [rt-mitre-map] -> Reporting
```

The mapping step sits between findings collection and final report generation. It enriches each finding with a technique ID, groups findings by tactic, calculates coverage breadth, and exports a Navigator layer the client can import directly.

### What This Skill Produces

1. Per-finding technique annotations (written back to findings-master.csv via `finding_tracker.py`)
2. A Markdown coverage matrix organized by tactic
3. An ATT&CK Navigator layer JSON file ready to import at `https://mitre-attack.github.io/attack-navigator/`
4. A threat actor alignment section mapping your coverage to known APT groups

---

## 2. Step-by-Step Workflow

### Step 1 — Load All Confirmed Findings

Pull the current finding list from the tracker:

```bash
python3 {project-root}/_rtexit/scripts/finding_tracker.py list
```

Expected output example:

```
ID      SEVERITY   CVSS   TITLE                                    ASSET
F-001   CRITICAL   9.8    SQL Injection in /api/v1/login           api.acmecorp.com
F-002   HIGH       8.1    NTLM Hash Capture via Responder          192.168.10.0/24
F-003   HIGH       7.5    Kerberoastable Service Account (svc-sql) ACME\svc-sql
F-004   MEDIUM     6.5    Insecure Direct Object Reference         portal.acmecorp.com
F-005   MEDIUM     5.9    Password Spraying — 3 Accounts Locked    ACME AD
F-006   LOW        3.1    Verbose Error Messages — Stack Traces    api.acmecorp.com
```

Note the existing `mitre` field in each row. This is the field you will populate.

### Step 2 — Map Each Finding to ATT&CK Technique(s)

For each finding, identify the primary technique ID and, if applicable, a sub-technique. Use the format `TXXXX` for a technique and `TXXXX.XXX` for a sub-technique.

Reference the 14 ATT&CK Enterprise tactics (in kill-chain order):

| # | Tactic ID | Tactic Name            | TA Code   |
|---|-----------|------------------------|-----------|
| 1 | TA0043    | Reconnaissance         | RECON     |
| 2 | TA0042    | Resource Development   | RESDEV    |
| 3 | TA0001    | Initial Access         | INITACC   |
| 4 | TA0002    | Execution              | EXEC      |
| 5 | TA0003    | Persistence            | PERSIST   |
| 6 | TA0004    | Privilege Escalation   | PRIVESC   |
| 7 | TA0005    | Defense Evasion        | DEFEVAS   |
| 8 | TA0006    | Credential Access      | CREDACC   |
| 9 | TA0007    | Discovery              | DISCOV    |
|10 | TA0008    | Lateral Movement       | LATMOV    |
|11 | TA0009    | Collection             | COLLECT   |
|12 | TA0011    | Command and Control    | C2        |
|13 | TA0010    | Exfiltration           | EXFIL     |
|14 | TA0040    | Impact                 | IMPACT    |

**Mapping Decision Logic:**

Ask these questions for each finding:
- What did the attacker *do* to exploit this? -> that is the technique
- What tactic does that action serve? -> that is the tactic
- Is there a more specific sub-technique that fits? -> prefer sub-techniques when they exist

**Common Finding-to-Technique Mappings (reference table):**

| Finding Type                          | Technique ID      | Technique Name                             | Tactic      |
|---------------------------------------|-------------------|--------------------------------------------|-------------|
| SQL Injection (authentication bypass) | T1190             | Exploit Public-Facing Application          | Initial Access |
| SQL Injection (data extraction)       | T1005             | Data from Local System                     | Collection  |
| NTLM Hash Capture (Responder)         | T1557.001         | Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning | Credential Access |
| Kerberoasting                         | T1558.003         | Steal or Forge Kerberos Tickets: Kerberoasting | Credential Access |
| Password Spraying                     | T1110.003         | Brute Force: Password Spraying             | Credential Access |
| IDOR                                  | T1078             | Valid Accounts                             | Defense Evasion / Initial Access |
| Verbose Error Messages                | T1592.002         | Gather Victim Host Information: Software   | Reconnaissance |
| Pass-the-Hash                         | T1550.002         | Use Alternate Authentication Material: Pass the Hash | Lateral Movement |
| DCSync                                | T1003.006         | OS Credential Dumping: DCSync             | Credential Access |
| Scheduled Task Persistence            | T1053.005         | Scheduled Task/Job: Scheduled Task        | Persistence |
| Registry Run Key                      | T1547.001         | Boot or Logon Autostart Execution: Registry Run Keys | Persistence |
| LSASS Memory Dump                     | T1003.001         | OS Credential Dumping: LSASS Memory       | Credential Access |
| Living-off-the-Land (LOLBins)         | T1218             | System Binary Proxy Execution             | Defense Evasion |
| Phishing with Attachment              | T1566.001         | Phishing: Spearphishing Attachment        | Initial Access |
| Command-Line Interface                | T1059.001         | Command and Scripting Interpreter: PowerShell | Execution |
| SMB Lateral Movement                  | T1021.002         | Remote Services: SMB/Windows Admin Shares | Lateral Movement |
| Data Staged for Exfil                 | T1074.001         | Data Staged: Local Data Staging           | Collection  |
| Exfil over HTTPS                      | T1048.002         | Exfiltration Over Alternative Protocol: HTTPS | Exfiltration |

### Step 3 — Annotate Findings in the Tracker

Update each finding with its technique ID using the `mitre` field:

```bash
# Update F-001 with technique T1190
python3 {project-root}/_rtexit/scripts/finding_tracker.py add \
  "SQL Injection in /api/v1/login" CRITICAL 9.8 \
  --asset "api.acmecorp.com" \
  --mitre "T1190" \
  --cwe "CWE-89" \
  --phase "exploitation"

# For existing findings, edit findings-master.csv directly and update the mitre column:
# F-001 -> T1190
# F-002 -> T1557.001
# F-003 -> T1558.003
# F-004 -> T1078
# F-005 -> T1110.003
# F-006 -> T1592.002
```

Then export the annotated list to confirm changes:

```bash
python3 {project-root}/_rtexit/scripts/finding_tracker.py export --format csv
```

Log the mapping activity to the timeline:

```bash
python3 {project-root}/_rtexit/scripts/autodoc_engine.py log \
  --skill rt-mitre-map \
  --phase reporting \
  --note "MITRE ATT&CK mapping completed — 6 findings mapped across 4 tactics"
```

### Step 4 — Build the Coverage Matrix

Organize mapped findings by tactic. Count unique techniques per tactic. This becomes Section 3 of your report.

**Template format:**

```markdown
## ATT&CK Coverage Matrix — ACME Corporation Red Team
**Engagement:** RT-2025-031
**Date:** 2025-05-31
**Techniques Demonstrated:** 6 unique techniques across 4 tactics

### TA0001 — Initial Access
| Technique ID | Technique Name                        | Finding Ref | Severity | Validated |
|--------------|---------------------------------------|-------------|----------|-----------|
| T1190        | Exploit Public-Facing Application     | F-001       | CRITICAL | Yes       |

### TA0006 — Credential Access
| Technique ID | Technique Name                                            | Finding Ref | Severity | Validated |
|--------------|-----------------------------------------------------------|-------------|----------|-----------|
| T1557.001    | LLMNR/NBT-NS Poisoning and SMB Relay                     | F-002       | HIGH     | Yes       |
| T1558.003    | Steal or Forge Kerberos Tickets: Kerberoasting           | F-003       | HIGH     | Yes       |
| T1110.003    | Brute Force: Password Spraying                           | F-005       | MEDIUM   | Yes       |

### TA0005 — Defense Evasion
| Technique ID | Technique Name      | Finding Ref | Severity | Validated |
|--------------|---------------------|-------------|----------|-----------|
| T1078        | Valid Accounts      | F-004       | MEDIUM   | Yes       |

### TA0043 — Reconnaissance
| Technique ID | Technique Name                                  | Finding Ref | Severity | Validated |
|--------------|-------------------------------------------------|-------------|----------|-----------|
| T1592.002    | Gather Victim Host Information: Software        | F-006       | LOW      | Yes       |
```

### Step 5 — Generate ATT&CK Navigator Layer JSON

Create the JSON layer file. Save it to `{project-root}/_rtexit-output/docs/reports/attack-navigator-layer.json`.

The layer format for ATT&CK Navigator v4.9:

```json
{
  "name": "ACME Corporation Red Team — RT-2025-031",
  "versions": {
    "attack": "16",
    "navigator": "4.9",
    "layer": "4.5"
  },
  "domain": "enterprise-attack",
  "description": "Red Team engagement findings mapped to MITRE ATT&CK Enterprise v16. Engagement conducted 2025-05-15 through 2025-05-31.",
  "filters": {
    "platforms": ["Windows", "Linux", "Network", "PRE", "SaaS"]
  },
  "sorting": 0,
  "layout": {
    "layout": "side",
    "aggregateFunction": "average",
    "showID": true,
    "showName": true,
    "showAggregateScores": false,
    "countUnscored": false
  },
  "hideDisabled": false,
  "techniques": [
    {
      "techniqueID": "T1190",
      "tactic": "initial-access",
      "color": "#ff0000",
      "comment": "F-001: SQL Injection in /api/v1/login — CVSS 9.8 — CRITICAL",
      "enabled": true,
      "metadata": [],
      "links": [],
      "showSubtechniques": false,
      "score": 100
    },
    {
      "techniqueID": "T1557",
      "subtechniqueOf": "",
      "tactic": "credential-access",
      "color": "#ff6600",
      "comment": "F-002: NTLM Hash Capture via Responder — CVSS 8.1 — HIGH",
      "enabled": true,
      "metadata": [],
      "links": [],
      "showSubtechniques": true,
      "score": 80
    },
    {
      "techniqueID": "T1557.001",
      "tactic": "credential-access",
      "color": "#ff6600",
      "comment": "F-002: NTLM Hash Capture via Responder (LLMNR Poisoning) — CVSS 8.1 — HIGH",
      "enabled": true,
      "metadata": [],
      "links": [],
      "showSubtechniques": false,
      "score": 80
    },
    {
      "techniqueID": "T1558",
      "subtechniqueOf": "",
      "tactic": "credential-access",
      "color": "#ff6600",
      "comment": "F-003: Kerberoastable Service Account (svc-sql) — CVSS 7.5 — HIGH",
      "enabled": true,
      "metadata": [],
      "links": [],
      "showSubtechniques": true,
      "score": 80
    },
    {
      "techniqueID": "T1558.003",
      "tactic": "credential-access",
      "color": "#ff6600",
      "comment": "F-003: Kerberoastable Service Account (svc-sql) — CVSS 7.5 — HIGH",
      "enabled": true,
      "metadata": [],
      "links": [],
      "showSubtechniques": false,
      "score": 80
    },
    {
      "techniqueID": "T1078",
      "tactic": "defense-evasion",
      "color": "#ffaa00",
      "comment": "F-004: IDOR — Accessing other users records via valid session token — CVSS 6.5 — MEDIUM",
      "enabled": true,
      "metadata": [],
      "links": [],
      "showSubtechniques": false,
      "score": 60
    },
    {
      "techniqueID": "T1110",
      "subtechniqueOf": "",
      "tactic": "credential-access",
      "color": "#ffaa00",
      "comment": "F-005: Password Spraying — 3 accounts temporarily locked — CVSS 5.9 — MEDIUM",
      "enabled": true,
      "metadata": [],
      "links": [],
      "showSubtechniques": true,
      "score": 60
    },
    {
      "techniqueID": "T1110.003",
      "tactic": "credential-access",
      "color": "#ffaa00",
      "comment": "F-005: Password Spraying — 3 accounts temporarily locked — CVSS 5.9 — MEDIUM",
      "enabled": true,
      "metadata": [],
      "links": [],
      "showSubtechniques": false,
      "score": 60
    },
    {
      "techniqueID": "T1592",
      "subtechniqueOf": "",
      "tactic": "reconnaissance",
      "color": "#aaaaaa",
      "comment": "F-006: Verbose Error Messages expose stack traces — CVSS 3.1 — LOW",
      "enabled": true,
      "metadata": [],
      "links": [],
      "showSubtechniques": true,
      "score": 30
    },
    {
      "techniqueID": "T1592.002",
      "tactic": "reconnaissance",
      "color": "#aaaaaa",
      "comment": "F-006: Verbose Error Messages expose stack traces — CVSS 3.1 — LOW",
      "enabled": true,
      "metadata": [],
      "links": [],
      "showSubtechniques": false,
      "score": 30
    }
  ],
  "gradient": {
    "colors": ["#ffffff", "#ffaa00", "#ff0000"],
    "minValue": 0,
    "maxValue": 100
  },
  "legendItems": [
    {"label": "CRITICAL (score 100)", "color": "#ff0000"},
    {"label": "HIGH (score 80)", "color": "#ff6600"},
    {"label": "MEDIUM (score 60)", "color": "#ffaa00"},
    {"label": "LOW (score 30)", "color": "#aaaaaa"}
  ],
  "metadata": [
    {"name": "Engagement", "value": "RT-2025-031"},
    {"name": "Client", "value": "ACME Corporation"},
    {"name": "Operator", "value": "Red Team"},
    {"name": "ATT&CK Version", "value": "Enterprise v16"}
  ],
  "links": [],
  "showTacticRowBackground": true,
  "tacticRowBackground": "#1a1a2e",
  "selectTechniquesAcrossTactics": false,
  "selectSubtechniquesWithParent": false
}
```

**Score-to-color mapping guide:**
- CRITICAL findings: score 100, color `#ff0000`
- HIGH findings: score 80, color `#ff6600`
- MEDIUM findings: score 60, color `#ffaa00`
- LOW findings: score 30, color `#aaaaaa`
- INFO findings: score 10, color `#dddddd`

### Step 6 — Threat Actor Alignment (Optional but High-Value)

Map your coverage against known APT groups relevant to the client's industry. Pull this data from MITRE ATT&CK Groups (https://attack.mitre.org/groups/).

**Example — Financial Sector Client:**

```markdown
## Threat Actor Alignment

The following APT groups are known to target the Financial Services sector.
This table compares the techniques demonstrated during the engagement against
techniques attributed to each threat actor.

| Threat Actor  | Known Techniques (relevant subset)           | Demonstrated in Engagement |
|---------------|----------------------------------------------|---------------------------|
| FIN7          | T1190, T1566.001, T1078, T1059.001, T1074    | T1190, T1078 (2/5 = 40%)  |
| Lazarus Group | T1110, T1557, T1059, T1021, T1041            | T1110, T1557 (2/5 = 40%)  |
| APT41         | T1190, T1558, T1003, T1021, T1074            | T1190, T1558 (2/5 = 40%)  |

### Key Finding
The engagement demonstrated techniques used by all three APT groups known to target
the financial sector. The organization's current detective controls failed to alert
on T1557.001 (LLMNR Poisoning) and T1558.003 (Kerberoasting), both of which are
primary techniques in Lazarus Group and APT41 playbooks respectively.
```

---

## 3. Templates

### 3.1 — Coverage Summary Block (for executive report)

```markdown
## 4. MITRE ATT&CK Coverage Summary

During this engagement, the Red Team successfully demonstrated **6 MITRE ATT&CK
techniques** spanning **4 of the 14 enterprise tactics**. This reflects a realistic
adversary simulation targeting the organization's external perimeter and internal
Active Directory environment.

| Tactic              | Techniques Demonstrated | Highest Severity |
|---------------------|------------------------|------------------|
| Reconnaissance      | 1                      | LOW              |
| Initial Access      | 1                      | CRITICAL         |
| Credential Access   | 3                      | HIGH             |
| Defense Evasion     | 1                      | MEDIUM           |

**Coverage breadth:** 6 techniques out of 200+ in the ATT&CK Enterprise matrix.
This is consistent with a focused, targeted engagement rather than a broad simulation.

A full ATT&CK Navigator layer has been provided as a separate deliverable
(attack-navigator-layer.json) for import into the client's security operations platform.
```

### 3.2 — Per-Finding ATT&CK Block (for technical report finding section)

```markdown
### F-003: Kerberoastable Service Account (svc-sql)

**Severity:** HIGH | **CVSS:** 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
**Asset:** ACME\svc-sql
**Phase:** Post-Exploitation

#### MITRE ATT&CK Mapping
- **Tactic:** Credential Access (TA0006)
- **Technique:** Steal or Forge Kerberos Tickets (T1558)
- **Sub-technique:** Kerberoasting (T1558.003)
- **ATT&CK URL:** https://attack.mitre.org/techniques/T1558/003/

#### Technique Description
Kerberoasting abuses the Kerberos authentication protocol to request service tickets
for service principal names (SPNs) associated with domain accounts. The encrypted
ticket can be extracted and cracked offline without any special privileges. The
`svc-sql` account was configured with SPN `MSSQLSvc/dbserver.acme.local:1433` and
had a 12-character password that was cracked in 4 hours using a targeted wordlist.

#### Detection Opportunity
- Windows Event ID 4769 (Kerberos Service Ticket Request) with Encryption Type 0x17 (RC4)
- Anomalous volume of TGS requests from a single user account
- SIEM rule: `EventID=4769 AND TicketEncryptionType=0x17 AND NOT AccountName=machine$`
```

---

## 4. Integration with Scripts

### 4.1 — finding_tracker.py Integration

The `mitre` field in `findings-master.csv` accepts a comma-separated list of technique IDs. When a finding maps to multiple techniques (e.g., a pivot that used both Pass-the-Hash and SMB lateral movement), list all:

```bash
# Single technique
python3 _rtexit/scripts/finding_tracker.py add \
  "Kerberoastable Service Account" HIGH 7.5 \
  --asset "ACME\svc-sql" \
  --mitre "T1558.003" \
  --phase "post-exploitation"

# Multiple techniques (comma-separated, no spaces)
# Edit findings-master.csv directly for this:
# mitre field: "T1550.002,T1021.002"
```

Pull stats after mapping to confirm coverage:

```bash
python3 _rtexit/scripts/finding_tracker.py stats
```

Expected output after mapping:

```
=== Engagement Statistics ===
Total Findings : 6
  CRITICAL     : 1
  HIGH         : 2
  MEDIUM       : 2
  LOW          : 1

Findings with MITRE mapping : 6/6 (100%)
Tactics covered             : 4
Unique techniques           : 6
```

### 4.2 — autodoc_engine.py Integration

Log every significant mapping action:

```bash
# Log start of mapping session
python3 _rtexit/scripts/autodoc_engine.py log \
  --skill rt-mitre-map \
  --phase reporting \
  --note "Started MITRE ATT&CK mapping — 6 findings to process"

# Log completion with layer file creation
python3 _rtexit/scripts/autodoc_engine.py log \
  --skill rt-mitre-map \
  --phase reporting \
  --note "ATT&CK Navigator layer generated — attack-navigator-layer.json"

# Log the layer file as evidence
python3 _rtexit/scripts/autodoc_engine.py custody \
  --finding "ALL" \
  --evidence "_rtexit-output/docs/reports/attack-navigator-layer.json"
```

### 4.3 — Output File Locations

| Artifact                      | Path                                                           |
|-------------------------------|----------------------------------------------------------------|
| Coverage matrix (Markdown)    | `_rtexit-output/docs/reports/mitre-coverage-matrix.md`        |
| Navigator layer JSON          | `_rtexit-output/docs/reports/attack-navigator-layer.json`     |
| Annotated findings CSV        | `_rtexit-output/docs/findings/findings-master.csv`            |
| Timeline entry                | `_rtexit-output/docs/engagement/timeline.md`                  |

---

## 5. Quality Checklist

Before finalizing the MITRE mapping deliverable, verify each item:

### Mapping Accuracy
- [ ] Every confirmed finding (status=CONFIRMED) has at least one technique ID
- [ ] All technique IDs are verified against ATT&CK Enterprise v16 (not v14 or earlier)
- [ ] Sub-techniques are used where they exist and fit (e.g., T1110.003 not just T1110)
- [ ] Tactic assignment matches the technique's listed tactic in the ATT&CK matrix
- [ ] Findings mapped to multiple techniques list each one (comma-separated in CSV)

### Navigator Layer Quality
- [ ] All technique IDs appear both as parent technique and sub-technique entries
- [ ] Colors correctly reflect severity (red=critical, orange=high, amber=medium, grey=low)
- [ ] Comments in each technique entry reference the finding ID and title
- [ ] Layer metadata includes engagement reference, client name, and ATT&CK version
- [ ] JSON is valid (no trailing commas, all brackets closed)

### Coverage Matrix Quality
- [ ] Matrix is organized by tactic in kill-chain order (not alphabetically)
- [ ] Each row includes: Technique ID, Technique Name, Finding Ref, Severity, Validated
- [ ] Tactics with zero findings are omitted (do not list empty tactic sections)
- [ ] Summary statistics match the actual finding count

### Report Integration
- [ ] Executive summary references the number of tactics and techniques demonstrated
- [ ] Each finding's technical write-up includes the ATT&CK mapping block
- [ ] Navigator layer JSON file is referenced and included as a deliverable
- [ ] Threat actor alignment section names at least one APT group relevant to the client's sector

### Documentation
- [ ] Timeline updated via `autodoc_engine.py log`
- [ ] Navigator layer logged to chain of custody via `autodoc_engine.py custody`

---

## 6. Example Finished Output

### Example: Coverage Matrix Section (Markdown, full)

```markdown
# MITRE ATT&CK Coverage Matrix
**Engagement:** RT-2025-031 — ACME Corporation External + Internal Red Team
**Period:** 2025-05-15 to 2025-05-31
**ATT&CK Version:** Enterprise v16
**Techniques Demonstrated:** 6 unique across 4 tactics

---

## TA0043 — Reconnaissance

| Technique ID | Technique Name                             | Finding | Severity | Validated |
|--------------|--------------------------------------------|---------|----------|-----------|
| T1592.002    | Gather Victim Host Information: Software   | F-006   | LOW      | Yes       |

> **Tactic Total:** 1 technique | Highest severity: LOW

---

## TA0001 — Initial Access

| Technique ID | Technique Name                          | Finding | Severity | Validated |
|--------------|-----------------------------------------|---------|----------|-----------|
| T1190        | Exploit Public-Facing Application       | F-001   | CRITICAL | Yes       |

> **Tactic Total:** 1 technique | Highest severity: CRITICAL

---

## TA0006 — Credential Access

| Technique ID | Technique Name                                                  | Finding | Severity | Validated |
|--------------|-----------------------------------------------------------------|---------|----------|-----------|
| T1557.001    | Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay  | F-002   | HIGH     | Yes       |
| T1558.003    | Steal or Forge Kerberos Tickets: Kerberoasting                  | F-003   | HIGH     | Yes       |
| T1110.003    | Brute Force: Password Spraying                                  | F-005   | MEDIUM   | Yes       |

> **Tactic Total:** 3 techniques | Highest severity: HIGH

---

## TA0005 — Defense Evasion

| Technique ID | Technique Name  | Finding | Severity | Validated |
|--------------|-----------------|---------|----------|-----------|
| T1078        | Valid Accounts  | F-004   | MEDIUM   | Yes       |

> **Tactic Total:** 1 technique | Highest severity: MEDIUM

---

## Coverage Summary

| Metric                          | Value               |
|---------------------------------|---------------------|
| Total findings mapped           | 6                   |
| Unique techniques demonstrated  | 6                   |
| Tactics covered                 | 4 of 14 (29%)       |
| Techniques with sub-technique   | 3 (T1557.001, T1558.003, T1110.003) |
| Findings with no mapping        | 0                   |
| ATT&CK Navigator layer          | attack-navigator-layer.json |
```

### Example: Executive Summary Paragraph (drop-in)

```
The Red Team demonstrated six adversary techniques across four MITRE ATT&CK tactics,
including Initial Access, Credential Access, Defense Evasion, and Reconnaissance.
The most critical path involved exploiting a SQL injection vulnerability to gain
initial access (T1190), followed by credential theft via LLMNR poisoning (T1557.001)
and Kerberoasting (T1558.003) to obtain domain credentials. These techniques are
actively used by FIN7 and APT41, both of which have a documented history of targeting
organizations in the financial services sector. A full ATT&CK Navigator layer is
provided as a companion deliverable for integration with the client's SOC detection
engineering workflow.
```

---

## 7. Common Mistakes to Avoid

### Mistake 1: Mapping to the tactic, not the technique
**Wrong:** Listing "Credential Access" as the technique identifier.
**Right:** List the specific technique `T1558.003` and note that it belongs to tactic `TA0006 — Credential Access`.

### Mistake 2: Using outdated technique IDs
ATT&CK retires and renumbers techniques across versions. For example, `T1003` (Credential Dumping) was restructured into sub-techniques in v7. Always verify against the current version (v16 as of this writing).
**Check:** https://attack.mitre.org/techniques/enterprise/ before finalizing any ID.

### Mistake 3: Mapping information disclosure as "Collection"
Verbose error messages, banner grabbing, and directory listings feed the attacker's knowledge but are not Collection (TA0009). They belong to Reconnaissance (TA0043) — specifically T1592 or T1590 depending on what information is gathered.

### Mistake 4: Omitting the parent technique from the Navigator layer
Navigator uses both parent and sub-technique entries. If you add `T1558.003` without also adding `T1558`, the parent row will be blank in the Navigator and clients will see an incomplete visualization. Always add both.

### Mistake 5: Using the wrong tactic for Valid Accounts (T1078)
T1078 appears under four tactics: Initial Access, Persistence, Privilege Escalation, and Defense Evasion. Choose the tactic that matches how it was used in the finding. Using stolen credentials to log into a portal is Initial Access. Using them to avoid detection by blending into legitimate traffic is Defense Evasion.

### Mistake 6: Generating the Navigator layer manually without verifying JSON validity
A single misplaced comma makes the entire layer unimportable. Always validate the JSON:
```bash
python3 -m json.tool attack-navigator-layer.json > /dev/null && echo "JSON valid" || echo "JSON invalid"
```

### Mistake 7: Mapping unvalidated findings
Only map findings with status `CONFIRMED` in the tracker. Suspected or unconfirmed findings should not appear in the ATT&CK matrix, as clients and threat intelligence teams treat this data as factual adversary behavior evidence.

### Mistake 8: Skipping the threat actor alignment section
The mapping exercise without threat actor alignment leaves value on the table. Even a one-paragraph comparison to a known APT group relevant to the client's sector transforms the deliverable from a technical artifact into a business risk narrative.
