Mapping to MITRE ATT&CK

MITRE ATT&CK is a knowledge base of real-world adversary behavior, organized into tactics (the why) and techniques (the how). Mapping detections to ATT&CK gives every rule a shared, structured label.

The payoff:

• Measure coverage against known adversary behavior
• Communicate findings in a common vocabulary
• Prioritize gaps by relevance to your threat model
• Correlate alerts along an attack chain

ATT&CK has three nested levels:

• Tactic — the adversary's goal, e.g. Credential Access (TA0006)
• Technique — a method to achieve it, e.g. OS Credential Dumping (T1003)
• Sub-technique — a specific variant, e.g. LSASS Memory (T1003.001)

Map as specifically as your detection logic supports. A rule that detects LSASS access should be tagged T1003.001, not just T1003.

Technique IDs follow a fixed pattern. The letter T plus four digits is a technique; a dotted suffix is a sub-technique.

Sigma carries ATT&CK references in the tags field using a lowercase convention. Tactics use the tactic name; techniques use the dotted ID.

Map based on what the log actually proves, not what you suspect. An encoded PowerShell command evidences T1059.001 (PowerShell) and often T1027 (Obfuscated Files or Information). It does not, by itself, prove the goal.

Avoid over-tagging. Each tag should be defensible from the detection logic alone, or a reviewer will not trust your coverage numbers.

ATT&CK defines data sources and data components that each technique can be observed through. This bridges detection ideas to telemetry you must collect.

For T1003.001 (LSASS Memory), relevant components include:

• Process: OS API Execution
• Process: Process Access
• File: File Access

If you lack the telemetry behind a technique, no rule can cover it. Map data sources to find collection gaps, not just rule gaps.

Aggregating your rules' tags produces a coverage view across the ATT&CK matrix. The ATT&CK Navigator renders this as a colored heatmap.

You can generate a Navigator layer from your Sigma tags programmatically and overlay it on the matrix to see covered, partially covered, and uncovered techniques at a glance.

Full-matrix coverage is neither achievable nor useful. Prioritize by threat intelligence: which techniques do the groups targeting your sector actually use?

ATT&CK group pages (e.g. APT29, FIN7) list associated techniques. Overlay the techniques used by your most relevant adversaries, then close detection gaps there first. This is the essence of a threat-informed defense.

One thin rule per technique creates false confidence. Adversaries vary procedures within a technique, so robust coverage means multiple, diverse detections for high-priority techniques.

Track both:

• Breadth — how many techniques you touch
• Depth — how many distinct, evasion-resistant detections per technique

A technique with one easily bypassed rule should not be counted the same as one with layered behavioral detections.

ATT&CK is versioned and evolves: techniques get added, renamed, deprecated, or restructured into sub-techniques across releases. Stale tags silently break your coverage view.

• Pin the ATT&CK version your tags target
• Review mappings when a new ATT&CK release ships
• Migrate deprecated IDs (e.g. when a technique splits into sub-techniques)
• Validate tags in CI against the current ATT&CK dataset

Treating mappings as living metadata keeps coverage metrics honest over time.

Because alerts carry tactic tags, you can correlate them into a narrative. A sequence of Initial Access then Execution then Credential Access then Lateral Movement on the same host tells a far stronger story than any single alert.

Mapping enables this stitching: a SOAR or correlation rule can elevate severity when multiple tactics fire against the same entity within a window.

Test your ATT&CK mapping judgment.

Mapping detections to MITRE ATT&CK turns rules into measurable coverage:

• ATT&CK nests tactics, techniques, sub-techniques
• Tag Sigma rules via tags (attack.tactic, attack.tXXXX.YYY)
• Map to the most specific defensible level
• Data sources/components reveal collection gaps, not just rule gaps
• Navigator heatmaps visualize coverage
• Prioritize with threat intelligence on relevant groups
• Pursue depth (diverse detections) on priority techniques, not just breadth
• Tactic tags enable kill-chain correlation

Next: testing and tuning to keep those detections trustworthy.