Mapping Attacks to Detections

MITRE ATT&CK is a curated knowledge base of adversary tactics, techniques, and procedures observed in the real world. It gives red and blue a shared vocabulary.

Mapping every test and every detection to an ATT&CK ID lets you answer one question precisely: which adversary behaviors can we actually see?

• Tactics = the adversary's goal (the 'why')
• Techniques = how they achieve it (the 'how')
• Procedures = the specific implementation (the 'what')

Each technique has a stable identifier you will use everywhere in purple teaming.

• T1059 — Command and Scripting Interpreter (technique)
• T1059.001 — PowerShell (sub-technique)
• TA0002 — Execution (the tactic it belongs to)

A single technique can serve multiple tactics. For example, valid accounts (T1078) support Initial Access, Persistence, Privilege Escalation, and Defense Evasion simultaneously.

To detect a technique you must know what data source reveals it. ATT&CK lists data sources and components for each technique.

For PowerShell execution (T1059.001), relevant telemetry includes:

• Script block logging (Event ID 4104)
• Module logging (Event ID 4103)
• Process creation with command line (Event ID 4688 / Sysmon 1)

If none of these are collected, the technique is a guaranteed blind spot regardless of how good your rules are.

A technique is abstract; you detect concrete procedures. Choose a realistic implementation an adversary actually uses.

For T1059.001, a common encoded-command procedure looks like:

Once you know the artifact, you express detection logic. The encoded-command example above produces a process-creation event whose command line contains suspicious flags.

A pseudo-rule for it:

Sigma is a generic, vendor-neutral detection format that compiles into Splunk, Elastic, Sentinel, and others. Mapping rules to ATT&CK keeps coverage trackable.

A Sigma snippet for suspicious encoded PowerShell:

For each technique in scope, record what telemetry exists and whether a detection fires. A coverage row captures the full picture:

• Technique: T1059.001 PowerShell
• Data source available: Yes (Sysmon 1, 4104)
• Detection exists: Yes (Sigma rule)
• Last validated: date of the purple test
• Result: Detected / Logged / Blind

This table, kept in a tool like VECTR, becomes your authoritative detection coverage record.

A common trap is mapping a detection to a technique but building it on a fragile, easily evaded artifact. Detecting one specific tool name is brittle; detecting the behavior is robust.

• Brittle: alert on a single hard-coded malware filename
• Better: alert on the behavior, e.g. a process spawning from winword.exe into cmd.exe

The Pyramid of Pain captures this: hashes and filenames are trivial for an attacker to change, while TTPs are costly. Aim detections high on the pyramid.

Real intrusions are chains, not single events. A detection on the full chain is far stronger than any one link.

An emulated chain might be:

• T1566.001 Spearphishing Attachment (Initial Access)
• T1059.001 PowerShell (Execution)
• T1547.001 Registry Run Key (Persistence)
• T1003.001 LSASS Memory dumping (Credential Access)

Mapping each step lets you see exactly where in the kill chain your visibility starts and stops.

A mapping is only a claim until tested. During the purple session, red executes the procedure and blue confirms the mapped detection actually fires on the mapped data source.

• Execute the procedure in a controlled window
• Confirm the expected event ID appears in telemetry
• Confirm the rule generates an alert (not just a log)
• Record the validation date and outcome

Only after this loop do you mark a technique as genuinely covered.

The ATT&CK Navigator lets you render coverage as a colored heatmap over the matrix. Green for detected, yellow for logged-only, red for blind spots.

• Export results from your tracking tool as a Navigator layer
• Overlay multiple layers (tested vs. threat-intel priorities)
• Share the heatmap with leadership to justify investment

This visual makes an abstract concept like 'detection coverage' immediately understandable to non-technical stakeholders.

Test your understanding of mapping attacks to detections.

You can now align attacks to detections systematically:

• Use ATT&CK IDs (tactic, technique, sub-technique) as shared language
• Identify the data source that exposes each technique
• Choose a realistic procedure, then write behavior-based logic
• Express portable rules in Sigma tagged with the technique
• Aim high on the Pyramid of Pain to avoid brittle detections
• Validate every mapping live, then visualize coverage in the Navigator

Next you will plan and run an actual purple team exercise end to end.