0Pricing
Cyber Security Academy · Lesson

MITRE ATT&CK Mapping

Map findings to techniques.

MITRE ATT&CK Mapping is a free Cyber Security Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

What Is MITRE ATT&CK

MITRE ATT&CK is a freely available knowledge base of real-world attacker tactics and techniques, organized into a common language.

It lets defenders describe what an attacker did using shared, precise terms.

Tactics: The Why

Tactics are the attacker's goals, the why behind an action. They form the columns of the ATT&CK matrix.

  • Initial Access, Execution, Persistence.
  • Privilege Escalation, Defense Evasion.
  • Credential Access, Lateral Movement, Exfiltration.

Techniques: The How

Techniques are the specific ways an attacker achieves a tactic. Each has a unique ID.

Sub-techniques add finer detail under a parent technique.

Tactic:     Persistence
Technique:  T1053 Scheduled Task/Job
  Sub:      T1053.005 Scheduled Task

Procedures: The Specifics

Procedures are the concrete implementations a particular group uses to carry out a technique.

Together, Tactics, Techniques, and Procedures form the TTPs that sit at the top of the Pyramid of Pain.

Reading the Matrix

The ATT&CK matrix lays tactics across the top and techniques down each column. You read an attack as a path from left (initial access) to right (impact).

Mapping a hunt onto this matrix shows the attacker's journey.

Mapping a Finding

When a hunt finds suspicious activity, label it with the matching technique ID.

This makes the finding searchable, comparable, and instantly understood by any analyst.

Finding: word.exe spawned powershell.exe
Maps to: T1059.001 PowerShell
         (Tactic: Execution)

Building Attack Stories

Chain mapped techniques into a narrative of the intrusion across tactics.

A sequence of IDs tells the whole story from break-in to exfiltration in shared language.

T1566 Phishing (Initial Access)
T1059 Command Interpreter (Execution)
T1053 Scheduled Task (Persistence)
T1041 Exfil over C2 (Exfiltration)

ATT&CK Navigator

The ATT&CK Navigator is a visual tool for annotating the matrix. You can highlight techniques you can detect, those you cannot, and those seen in a hunt.

Color-coded coverage maps reveal your defensive blind spots.

Driving Detection Coverage

Map your existing detections onto ATT&CK to see which techniques you would catch and which you would miss.

Gaps in the matrix become your next hunting hypotheses and your next detection rules.

Prioritize With Threat Intel

You cannot cover every technique. Use threat intelligence to focus on the techniques used by groups that actually target your industry.

This concentrates effort where the real risk lives.

A Shared Language

The lasting value of ATT&CK is a common vocabulary across hunters, responders, and vendors.

When everyone says T1059.001, there is no ambiguity, and findings from different teams combine cleanly.

Quick Check

Test your understanding of ATT&CK mapping.

Recap

You learned to map findings to MITRE ATT&CK.

  • ATT&CK is a shared knowledge base of attacker behavior.
  • Tactics are the why, techniques the how, procedures the specifics.
  • Map findings to technique IDs and chain them into attack stories.
  • Use the Navigator to visualize detection coverage and gaps.
  • Prioritize techniques with threat intel; ATT&CK is a common language.

You have completed the Cyber Threat Hunting course.

Frequently asked questions

Is the “MITRE ATT&CK Mapping” lesson free?

Yes — the full text of “MITRE ATT&CK Mapping” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “MITRE ATT&CK Mapping”?

Map findings to techniques. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “MITRE ATT&CK Mapping” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Threat Hunting Mindset
  2. Hypothesis-Driven Hunting
  3. Using Logs and Telemetry
  4. MITRE ATT&CK Mapping
← Back to Cyber Security Academy