MITRE ATT&CK for Practitioners: How to Map Real Findings to a Common Threat Language

Executive Summary

Penetration test reports, vulnerability scans, and incident investigations all produce findings. The challenge is translating those findings into a language that threat intelligence teams, security architects, and executive leadership can act on consistently. MITRE ATT&CK provides that common language.

This post is not a high-level overview of ATT&CK. It is a practical guide for security practitioners who need to take real findings from assessments, incidents, and scans, and map them to ATT&CK techniques in a way that drives measurable defensive improvement.

Key Takeaways:

• ATT&CK mapping transforms isolated findings into a structured view of adversary behavior across your environment
• Mapping to sub-technique level (e.g., T1059.001, not T1059) produces actionable results; tactic-level mapping does not
• Consistent mapping requires a repeatable methodology, not ad hoc interpretation
• Mapped findings enable gap analysis, detection prioritization, and trend tracking across engagements

Why Map Findings to ATT&CK?

The Problem with Unstructured Findings

Security assessments generate findings in varied formats:

• Penetration tests produce narrative-style findings: “Attacker obtained domain admin through Kerberoasting”
• Vulnerability scans produce CVE-based output: “CVE-2024-1234 – Critical – Remote Code Execution”
• Incident investigations produce timelines: “Malware executed via scheduled task at 02:14 UTC”
• Red team exercises produce kill chain narratives: “Initial access via spearphishing, lateral movement via PsExec”

Each format serves its purpose, but they create silos. A penetration test finding about Kerberoasting and an incident response case involving NTDS.dit extraction are both credential access techniques, but without ATT&CK mapping, that connection is invisible.

What ATT&CK Mapping Enables

ATT&CK turns findings into data. Data enables measurement. Measurement enables improvement.

The ATT&CK Framework: A Quick Orientation

For practitioners who need a refresher, ATT&CK organizes adversary behavior into three layers:

Tactics (The “Why”)

Tactics represent the adversary’s objective at each stage of an operation. There are 14 Enterprise tactics:

Techniques (The “How”)

Techniques describe the specific method used to achieve a tactic. For example, under Credential Access:

• T1003: OS Credential Dumping
• T1110: Brute Force
• T1558: Steal or Forge Kerberos Tickets
• T1552: Unsecured Credentials

Sub-Techniques (The “Specifically How”)

Sub-techniques provide granular detail. Under T1003 (OS Credential Dumping):

• T1003.001: LSASS Memory
• T1003.002: Security Account Manager (SAM)
• T1003.003: NTDS
• T1003.004: LSA Secrets
• T1003.006: DCSync

Mapping at sub-technique level is critical. “OS Credential Dumping” is too broad to drive specific defensive action. “DCSync” tells you exactly what to detect and how.

Mapping Methodology: A Repeatable Process

Step 1: Normalize the Finding

Before mapping, express the finding in terms of what the adversary (or tester) actually did, not what the vulnerability is.

Transformation Examples:

The normalized action describes adversary behavior. This is what maps to ATT&CK.

Step 2: Identify the Tactic

Ask: What was the adversary trying to accomplish?

Using the examples above:

Note: A single finding can map to multiple tactics. Creating a scheduled task is both Persistence (maintaining access) and Privilege Escalation (if the task runs as SYSTEM).

Step 3: Identify the Technique and Sub-Technique

Ask: How specifically did the adversary accomplish the objective?

Step 4: Document the Evidence

Every mapping needs supporting evidence. Without evidence, mappings are opinions.

Evidence Template:

Finding ID: PT-2025-017
ATT&CK Mapping: T1558.003 (Kerberoasting)
Tactic: Credential Access
Evidence:
  - Tool used: Rubeus (kerberoast command)
  - Target: 3 service accounts with SPNs registered
  - Result: TGS tickets extracted, 2 of 3 cracked within 4 hours
  - Impact: Cleartext passwords for svc_backup (Domain Admins member)
           and svc_sql (db_owner on finance database)
Detection Status: No SIEM alert triggered during extraction or cracking
Remediation: Enforce 25+ character managed passwords on all service accounts,
             implement Group Managed Service Accounts (gMSA) where supported,
             monitor Event ID 4769 for anomalous TGS requests

Step 5: Validate the Mapping

Cross-reference your mapping against the official ATT&CK technique page:

1. Read the technique description at attack.mitre.org
2. Verify the behavior matches the documented definition
3. Check the “Procedure Examples” section for similar real-world usage
4. Review the “Detection” section for monitoring guidance
5. Check the “Mitigations” section for remediation alignment

Common mapping mistakes:

• Mapping too broadly: Using T1059 (Command and Scripting Interpreter) when T1059.001 (PowerShell) is accurate
• Wrong tactic: Mapping lateral movement tools to Execution instead of Lateral Movement
• Missing multi-tactic mappings: A technique like T1053.005 (Scheduled Task) spans Persistence, Privilege Escalation, and Execution
• Confusing vulnerability with technique: CVE-2024-1234 is not an ATT&CK technique; the technique is what the CVE enables (e.g., T1190 Exploit Public-Facing Application)

Practical Application: Mapping a Full Penetration Test

Scenario: Internal Network Penetration Test

An internal penetration test produced 23 findings. Here is how the critical path maps to ATT&CK:

Attack Path:

ATT&CK Coverage Analysis:

From this single engagement, the tester exercised techniques across 8 of 14 tactics:

Key Insight: Zero detections fired across 11 techniques spanning 8 tactics. This is not a list of 23 random findings. It is a structured view of exactly where the organization’s detection capability failed, mapped to a framework the detection engineering team can act on directly.

Mapping Vulnerability Scan Results

Vulnerability scans produce CVE-based output, not behavior-based findings. Mapping requires an extra translation step.

The CVE-to-ATT&CK Translation

CVEs describe what is vulnerable. ATT&CK describes what an adversary can do with that vulnerability.

When Not to Map

Not every vulnerability scan finding maps meaningfully to ATT&CK:

• Informational findings (SSL certificate expiring, HTTP headers missing) – These are configuration weaknesses, not adversary techniques
• Denial of service only – If the CVE only enables DoS with no code execution, the ATT&CK value is limited
• False positives – Validate the finding exists before mapping it

Focus mapping efforts on findings that represent realistic adversary capabilities in your environment.

Mapping Incident Response Findings

Incident investigations produce the richest ATT&CK mapping data because they document actual adversary behavior.

Incident Timeline to ATT&CK

Post-Incident Value: This mapping tells the detection engineering team exactly which techniques succeeded. Each unmapped or undetected technique becomes a detection engineering backlog item with clear requirements.

Building a Findings-to-ATT&CK Database

Why Track Mappings Across Engagements

Individual mapping is useful. Aggregated mapping across multiple engagements reveals patterns.

Example: 12 Months of Penetration Test Data

Insights from aggregated data:

1. Kerberoasting appears in 80% of engagements – This is a systemic issue requiring organizational remediation (gMSA deployment, password policy for service accounts), not point fixes
2. LLMNR Poisoning has 0% detection rate – Disable LLMNR and NBT-NS network-wide via GPO
3. PowerShell detection is improving (44%) – Detection engineering investments in Script Block Logging and AMSI are paying off
4. LSASS protection is partially effective (60%) – Credential Guard or PPL deployment is working but incomplete

This is the difference between “we did 10 pentests” and “we have measurable improvement data across our most common attack vectors.”

Database Schema

For organizations building their own tracking:

Finding:
  - finding_id: Unique identifier
  - engagement_id: Which assessment
  - engagement_type: pentest | red_team | incident | vuln_scan
  - date: When discovered
  - description: What happened
  - attck_technique_id: T-number (e.g., T1558.003)
  - attck_tactic: Tactic name
  - tools_used: Tools or procedures observed
  - success: boolean (was the technique successful)
  - detected: boolean (did existing controls detect it)
  - detection_source: What detected it (if detected)
  - evidence: Supporting logs, screenshots, artifacts
  - remediation: Recommended fix
  - severity: Critical | High | Medium | Low

Common Mapping Challenges

Challenge 1: One Finding, Multiple Techniques

A single finding often involves multiple ATT&CK techniques. Map each technique separately.

Example: “Used Mimikatz to dump LSASS and extract Kerberos tickets”

This is two techniques:

• T1003.001: LSASS Memory (dumping credentials from LSASS process)
• T1558.003: Kerberoasting (if extracting TGS tickets) or T1550.003: Pass the Ticket (if reusing existing tickets)

Challenge 2: Custom Tools and Techniques

Not every technique maps neatly to an existing ATT&CK ID. When using custom tools or novel techniques:

1. Find the closest matching technique
2. Document the deviation in notes
3. If the behavior is genuinely new, consider submitting a contribution to MITRE

Challenge 3: Mapping Defensive Findings

Some findings are defensive gaps rather than offensive techniques:

• “No centralized logging for Active Directory” – This does not map to an ATT&CK technique directly. Instead, identify which techniques this gap leaves undetected (T1003, T1558, T1087, etc.) and map those.
• “Endpoint protection disabled on 15 servers” – Map the techniques that become possible when protection is absent.

Challenge 4: Granularity Decisions

Map at the most specific level supported by your evidence:

When in doubt, choose the most specific sub-technique your evidence supports.

Integrating ATT&CK Mapping Into Your Workflow

For Penetration Testers

1. During testing: Log each technique as you execute it with the ATT&CK ID
2. In the report: Include an ATT&CK mapping table alongside traditional findings
3. In the debrief: Walk the client through the ATT&CK Navigator heatmap showing which techniques were successful
4. Across engagements: Track technique frequency and detection rates over time

For Vulnerability Management Teams

1. Prioritize remediation by mapping CVEs to ATT&CK techniques and cross-referencing with your threat model
2. Focus on exploitable chains – A medium-severity CVE that enables T1190 (Initial Access) feeding into T1068 (Privilege Escalation) is higher priority than an isolated critical finding
3. Validate scanner output by confirming the mapped technique is actually achievable in your environment

For Detection Engineers

1. Use mapped findings as detection requirements – Each undetected technique from a pentest becomes a detection engineering ticket
2. Prioritize based on frequency – Techniques that appear in 80% of engagements need detection before techniques that appear in 10%
3. Validate detections – After building a detection rule for T1558.003, run Rubeus in a test environment and confirm the alert fires

For Security Leadership

1. Track coverage metrics – “We can detect X of Y ATT&CK techniques relevant to our threat model”
2. Measure improvement – “Detection coverage increased from 35% to 62% over 12 months”
3. Communicate risk – “Our last three pentests show recurring credential access gaps that map to the same 4 ATT&CK techniques”
4. Justify budget – “Investing in EDR capabilities addresses 15 currently undetected ATT&CK techniques across 3 critical tactics”

Tools for ATT&CK Mapping

ATT&CK Navigator

The ATT&CK Navigator is a web-based tool for creating layered heatmaps of ATT&CK coverage.

Practical Uses:

• Red layer: Techniques successfully exploited during a pentest (red)
• Blue layer: Techniques your SIEM has detection rules for (blue)
• Overlay: Where red has coverage but blue does not = detection gaps

This produces a visual gap analysis that communicates complex coverage data to technical and non-technical stakeholders.

STIX/TAXII

ATT&CK data is available in STIX (Structured Threat Information Expression) format. This enables:

• Programmatic access to technique definitions
• Automated mapping validation
• Integration with threat intelligence platforms
• Bulk operations across technique databases

Mapping Templates

Maintain a standard template for your organization. Consistency in mapping format is as important as mapping accuracy.

The Bottom Line

ATT&CK mapping is not academic exercise. It is the difference between a pile of disconnected findings and a structured, measurable view of your security posture.

The process is straightforward:

1. Normalize findings into adversary behavior descriptions
2. Map to sub-technique level using the five-step methodology
3. Document evidence for every mapping
4. Aggregate across engagements to identify patterns
5. Drive action through detection engineering, remediation prioritization, and coverage tracking

Organizations that systematically map findings to ATT&CK can answer questions that organizations without mapping cannot: Which techniques are we most vulnerable to? Are we getting better? Where should we invest next?

Those answers are worth the effort.

Next Steps

Immediate Actions:

1. Take your most recent penetration test report and map each finding to ATT&CK using the methodology above
2. Open the ATT&CK Navigator and create a heatmap of the mapped findings
3. Identify which mapped techniques your SIEM currently has detection rules for

Short-Term (30 Days):

1. Establish a mapping template for your organization
2. Map findings from your last three engagements to build an initial dataset
3. Identify the top 5 techniques by frequency and assess your detection coverage for each

Long-Term (90 Days):

1. Integrate ATT&CK mapping into your standard pentest reporting template
2. Build a findings database that tracks technique success and detection rates over time
3. Use aggregated data to drive quarterly detection engineering priorities

Need Help?

If your organization needs assistance mapping findings to ATT&CK or building a detection engineering program based on assessment data, contact us.

References and Further Reading

1. MITRE ATT&CK Framework – attack.mitre.org
2. ATT&CK Navigator – mitre-attack.github.io/attack-navigator
3. MITRE ATT&CK STIX Data – github.com/mitre-attack/attack-stix-data
4. NIST SP 800-53 to ATT&CK Mapping – center-for-threat-informed-defense.github.io
5. CISA Best Practices for MITRE ATT&CK Mapping – cisa.gov