6.3 Mapping Real Attacks onto ATT&CK Techniques
Key Takeaways
- Map only what evidence supports: phishing email to T1566, malicious macro or PowerShell to T1059, LSASS dump to T1003, scheduled task persistence to T1053, C2 beacon to T1071.
- The same incident can honestly carry more than one technique ID when more than one goal occurred, such as T1059 for the host process and T1003 for the dump.
- Writing technique IDs improves handoffs, correlation, and detection-coverage reviews after the case.
- Forcing every noisy alert into a technique without evidence creates false precision; unmapped / still investigating is a valid state.
- ATT&CK is a technique matrix; the Cyber Kill Chain is a more linear stage model and is compared in the next chapter.
Knowing that ATT&CK exists is not the skill SAL1 training content is aiming at. The skill is mapping: taking a real behavior from an email, a process tree, or a SIEM event and placing it on a technique ID you can defend. This independent study section works five high-frequency mappings, then covers how mapping helps reporting and detection coverage, the trap of forcing IDs without evidence, and a short pointer to the Cyber Kill Chain in the next chapter.
Worked mappings from artefacts to IDs
Each mapping below has a story, a best-fit ID, evidence that supports it, and evidence that is not enough. Steal that structure for case notes.
Phishing email → T1566
Story. A user reports a shared-voicemail message. The sender display name matches finance, the link goes to a look-alike domain, and the message asks the user to sign in.
Mapping. T1566 Phishing (Initial Access). If you later prove a specific delivery method, you can drop to a sub-technique such as T1566.001 (Spearphishing Attachment) or T1566.002 (Spearphishing Link). Do not jump to a sub-technique until the evidence does.
Evidence that supports T1566. Message headers, a malicious URL or attachment, user click telemetry, a credential prompt on a spoofed site, or a payload that launched after the email.
Evidence that is not enough. A single blocked spam message with no user interaction and no payload does not mean an intrusion technique happened on the endpoint. You can still label the email campaign as phishing; you should not claim Execution techniques until something ran.
Malicious macro or PowerShell → T1059
Story. After the click, Word launches, a macro calls powershell.exe with a remote download, and Sysmon shows a child process.
Mapping. T1059 Command and Scripting Interpreter. If the interpreter is PowerShell, T1059.001 is the honest sub-technique. A macro-enabled document is often discussed alongside Visual Basic execution and T1059.001 when VBA is only the launcher. Record both steps if both ran: VBA execution, then PowerShell execution. That is two execution techniques in sequence, which is normal.
Evidence that supports T1059. Process-creation logs that name powershell.exe, cmd.exe, wscript.exe, or bash; script-block logging; a command line that downloads or decodes a payload.
Evidence that is not enough. "The file is a document" is not Execution. Office opening a file is not, by itself, T1059.
LSASS dump → T1003
Story. EDR flags a tool opening LSASS (Local Security Authority Subsystem Service) and writing a dump file, or comparable access to LSASS memory.
Mapping. T1003 OS Credential Dumping, commonly T1003.001 LSASS Memory when the target is LSASS.
Evidence that supports T1003. Process access to LSASS, a minidump of lsass.exe, subsequent use of stolen hashes or tickets, or tools used to dump credentials—still describe the behavior, not just a brand name.
Evidence that is not enough. A random alert that mentions credential in the title with no LSASS handle, no dump file, and no follow-on logon. Legitimate crash dumps and some security products touch LSASS. Correlate with unusual parent processes and whether a dump landed on disk.
This mapping is Credential Access, not Execution, even if PowerShell hosted the dumper. You may also have T1059 for the host process. Dual mapping is correct when two goals occurred.
Scheduled task persistence → T1053
Story. After access, a task appears in Windows Task Scheduler that runs a script at logon or every five minutes.
Mapping. T1053 Scheduled Task/Job, on Windows often T1053.005 Scheduled Task.
Evidence that supports T1053. Event logs for task creation (for example Task Scheduler operational events, or Security 4698 when configured), a new task definition, Sysmon file or registry events under Task Scheduler paths, or schtasks command lines.
Evidence that is not enough. A built-in Microsoft task that has existed for years. Persistence mapping requires a change you can tie to the incident timeline, or a task whose action is clearly malicious.
Persistence is the tactic because the goal is to stay. The same scheduled task might later be the Execution mechanism when it fires; you can note T1053 as persistence and T1059 as what the task runs.
C2 beacon → T1071
Story. The host makes regular HTTPS connections to a newly registered domain, with jittered intervals, an unusual client fingerprint, or a known C2 path.
Mapping. T1071 Application Layer Protocol, often T1071.001 Web Protocols when the channel is HTTP or HTTPS. Other C2 techniques exist. Pick T1071 when the beacon rides a common application protocol to blend in.
Evidence that supports T1071. Recurring connections, beacon cadence, known-bad infrastructure, proxy logs showing encoded bodies to odd URIs, or EDR network telemetry that matches a documented C2 pattern.
Evidence that is not enough. One HTTPS connection to a content-delivery network. The internet is mostly HTTPS. Beaconing is a pattern, not a single packet.
| Behavior in the ticket | Best-fit technique | Common sub-technique | Tactic you are naming |
|---|---|---|---|
| Phishing email, link, or lure | T1566 | T1566.001 / T1566.002 when proven | Initial Access |
| Malicious macro or PowerShell | T1059 | T1059.001 for PowerShell | Execution |
| LSASS dump | T1003 | T1003.001 LSASS Memory | Credential Access |
| Scheduled task to stay | T1053 | T1053.005 on Windows | Persistence |
| C2 beacon over HTTP/S | T1071 | T1071.001 Web Protocols | Command and Control |
How mapping helps reporting and detection coverage
Putting IDs in a case is not bureaucracy. It does three jobs:
- Reporting. A shift handoff that says T1566 then T1059.001 then T1003.001 is shorter and less ambiguous than a paragraph of nicknames. Managers and incident commanders can see the intrusion's shape.
- Correlation. You can search prior tickets and threat intel for the same technique IDs even when the malware family name differed.
- Detection coverage. After the incident, list the techniques you observed and ask which of them had a dedicated detection. If LSASS dumping was caught by EDR but scheduled-task creation was found only during hunting, you have a coverage gap on T1053. That is how ATT&CK becomes a SOC improvement tool, not wallpaper.
A lightweight coverage table after a case might look like this:
| Observed technique | Caught by existing alert? | Telemetry that proved it | Gap to file |
|---|---|---|---|
| T1566 | Email gateway catch plus user report | Headers, URL, click log | Add click-to-ticket automation |
| T1059.001 | Yes, script-block alert | Script-block / Sysmon process create | Tune encoding false positives |
| T1003.001 | Yes, EDR | LSASS access | None |
| T1053.005 | No | Hunt found task-creation events | New scheduled-task-from-Office detection |
| T1071.001 | Partial proxy anomaly | Beacon cadence | Dedicated periodic-beacon hunt |
Trap: forcing every alert into a technique without evidence
New analysts sometimes treat ATT&CK like a form that cannot be submitted blank. That produces false precision: a noisy IDS signature becomes Impact / Data Encrypted for Impact because ransomware is scary, or a failed logon burst becomes Credential Access / Brute Force when it was a misconfigured service.
Rules that keep mapping honest:
- No evidence, no technique ID. Unmapped / still investigating is a valid state.
- Vendor display names are not IDs. Translate only after you understand the behavior.
- One alert can support zero, one, or several techniques. Several is fine; invented is not.
- If two techniques fit equally well, write both and explain why, or pick the one the evidence speaks to most loudly and note the alternative.
- Do not map a blocked attempt as successful Impact. A blocked exploit is often Initial Access attempted, and your report should say attempted.
False precision hurts the next shift. Someone will hunt the wrong technique, tune the wrong detection, and brief leadership with a confidence the packet capture cannot support.
Brief pointer: ATT&CK versus the Cyber Kill Chain
The Cyber Kill Chain (Lockheed Martin) is a linear stage model of an intrusion, from reconnaissance through actions on objectives. ATT&CK is a matrix of many techniques under each goal, and it does not require the intrusion to visit stages in a fixed order. You will use both as vocabularies; they answer different questions. The next chapter, on the Cyber Kill Chain, is where that comparison belongs. For this chapter, keep one distinction: when a question asks for a technique ID, it is asking for ATT&CK, not for a Kill Chain stage name.
If you leave this section with a habit, make it this one: map the behavior you can prove, write the ID, and leave blank what you cannot yet defend.
A user opened a malicious email and entered credentials on a look-alike site. No payload ran on the endpoint yet. Which ATT&CK technique is the best-supported mapping for that email-driven step?
Why is it a mistake to force every noisy alert into an ATT&CK technique ID?
EDR shows an unusual process opening LSASS and writing a dump file. Which mapping is the best fit?
How should an analyst treat ATT&CK versus the Cyber Kill Chain at this point in the study guide?