mitre-attack

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

MITRE ATT&CK — mapping discipline + technique reference

MITRE ATT&CK — 映射规范 + 技术参考

This skill encodes the discipline of mapping adversary behaviour to ATT&CK and back, plus a locally searchable technique index. Every OpenTide object type carries ATT&CK references; getting them right is a quality gate.

Current baseline: ATT&CK v19 (April 2026, Enterprise domain: 15 tactics, 222 techniques, 475 sub-techniques).

v19 breaking change: Defense Evasion was split into Stealth (TA0005) and Defense Impairment (TA0112). Any existing mappings referencing TA0005 as "Defense Evasion" must be reviewed and re-assigned.

Online version check: If this skill may be outdated, verify the current ATT&CK version at:

Release notes: https://attack.mitre.org/resources/updates/

Version history: https://attack.mitre.org/versions/

Machine-readable STIX: https://github.com/mitre/cti (enterprise-attack branch)

Blog announcements: https://medium.com/mitre-attack

此 skill 固化了将对手行为映射到 ATT&CK 并进行反向映射的规范，同时提供一个可在本地检索的技术索引。每种 OpenTide 对象类型都带有 ATT&CK 引用；准确处理这些引用是一项质量门槛。

当前基线：ATT&CK v19（2026 年 4 月，Enterprise 域：15 个战术、222 项技术、475 项子技术）。

v19 破坏性变更：Defense Evasion 已拆分为 Stealth（TA0005）和 Defense Impairment（TA0112）。任何将 TA0005 引用为“Defense Evasion”的现有映射都必须经过审查并重新分配。

在线版本检查：如果此 skill 可能已过时，请在以下位置核实当前 ATT&CK 版本：

发布说明：https://attack.mitre.org/resources/updates/

版本历史：https://attack.mitre.org/versions/

机器可读的 STIX：https://github.com/mitre/cti（enterprise-attack 分支）

博客公告：https://medium.com/mitre-attack

1. Tactic, technique, sub-technique — when to use which

1. 战术、技术、子技术——何时使用哪一级

Level	Use when	Example
Tactic only	Early TVM drafting where the specific technique is unknown or the intelligence is vague	"Adversary seeks credential access" → `TA0006`
Technique	The behaviour class is clear but the specific implementation is not documented	"Adversary uses credential dumping" → `T1003`
Sub-technique	The specific implementation is documented in the intelligence	"Adversary dumps LSASS memory" → `T1003.001`

级别	使用场景	示例
仅战术	TVM 初步起草阶段，具体技术未知或情报内容模糊	“对手寻求获取凭据” → `TA0006`
技术	行为类别明确，但没有记录具体实现	“对手使用凭据转储” → `T1003`
子技术	情报中记录了具体实现	“对手转储 LSASS 内存” → `T1003.001`

Decision rules

决策规则

Always prefer the most specific level the evidence supports. If the source says "Mimikatz sekurlsa::logonpasswords", map to
```
T1003.001
```
, not
```
T1003
```
.
Never map to a sub-technique without also implying the parent. The parent is implicit in ATT&CK's hierarchy — do not list both
```
T1003
```
and
```
T1003.001
```
for the same behaviour.
Map to the parent technique only when the source describes the behaviour class but not the specific method, or when multiple sub-techniques apply and you cannot distinguish which.
Do not over-tag. If a detection rule catches one specific sub-technique, map to that sub-technique only. LLMs tend to list every plausible sub-technique — resist this.

始终选择证据所支持的最具体级别。 如果来源明确写着“Mimikatz sekurlsa::logonpasswords”，则映射到
```
T1003.001
```
，而不是
```
T1003
```
。
映射到子技术时，不要同时列出父技术。 父技术在 ATT&CK 层级结构中会被隐含表示——对于同一种行为，不要同时列出
```
T1003
```
和
```
T1003.001
```
。
仅在以下情况下映射到父技术：来源描述了行为类别但没有说明具体方法，或者多个子技术都适用且无法区分具体是哪一个。
不要过度标注。 如果某条检测规则只能捕获一个特定的子技术，则只映射到该子技术。LLM 往往会列出所有看似合理的子技术——应避免这种做法。

2. Tactic assignment

2. 战术分配

A technique can appear under multiple tactics. Select the tactic that matches the adversary's goal in context, not every tactic the technique could theoretically serve.

Scenario	Correct tactic	Wrong
Adversary uses `schtasks` to persist	Persistence (TA0003)	Execution (TA0002) — even though schtasks executes
Adversary uses `schtasks` to run a payload once	Execution (TA0002)	Persistence (TA0003) — no persistence intent
Adversary uses PowerShell to download a payload	Command and Scripting Interpreter (T1059.001) under Execution	Don't also tag Initial Access

一种技术可能出现在多个战术之下。应选择与特定情境下对手目标相匹配的战术，而不是选择该技术在理论上可以支持的所有战术。

场景	正确战术	错误做法
对手使用 `schtasks` 建立持久化	Persistence（TA0003）	Execution（TA0002）——即使 `schtasks` 会执行代码
对手使用 `schtasks` 单次运行 payload	Execution（TA0002）	Persistence（TA0003）——不存在持久化意图
对手使用 PowerShell 下载 payload	Execution 下的 Command and Scripting Interpreter（T1059.001）	不应同时标记 Initial Access

v19 tactic split

v19 战术拆分

Old tactic	New tactics (v19)	Action
Defense Evasion (TA0005)	Stealth (TA0005) — hiding artefacts, obfuscation, masquerading	Review existing TA0005 mappings
	Defense Impairment (TA0112) — disabling tools, clearing logs, firewall modification	Re-assign where the goal is impairing defences

旧战术	新战术（v19）	操作
Defense Evasion（TA0005）	Stealth（TA0005）——隐藏痕迹、混淆、伪装	审查现有 TA0005 映射
	Defense Impairment（TA0112）——禁用工具、清除日志、修改防火墙	当目标是削弱防御时重新分配

3. Multi-technique chaining

3. 多技术链式映射

A single TVM or MDR may reference multiple techniques when the intelligence documents a behavioural chain. Rules:

Each technique in the chain must be independently evidenced. Do not infer intermediate steps.
Order matters in TVMs. The
```
chaining
```
field should reflect the temporal sequence documented in the intelligence.
MDR rules typically map to 1-2 techniques. A detection rule that claims to cover 5+ techniques is almost certainly an AP-H2 Kitchen Sink (see
```
threat-hunting
```
skill).
DOM signals map to the technique(s) the signal can actually detect, not the full chain the parent TVM describes.

当情报记录了行为链时，单个 TVM 或 MDR 可以引用多种技术。规则如下：

链中的每项技术都必须有独立证据支持。 不要推断中间步骤。
顺序在 TVM 中很重要。
```
chaining
```
字段应反映情报中记录的时间顺序。
MDR 规则通常映射到 1～2 项技术。 如果一条检测规则声称覆盖 5 项以上技术，几乎可以肯定是一个 AP-H2 Kitchen Sink（参见
```
threat-hunting
```
skill）。
DOM 信号应映射到该信号实际能够检测的技术，而不是父级 TVM 所描述的完整技术链。

4. Version pinning and revocation handling

4. 版本锁定与撤销处理

Version pinning

版本锁定

OpenTide content should reference ATT&CK technique IDs without version suffixes (e.g.
```
T1059.001
```
, not
```
T1059.001 v2.0
```
).
The repository-level ATT&CK version is declared in the content repo's metadata or schema configuration. Individual objects inherit this.
When ATT&CK releases a new version, review objects whose mapped techniques had major version changes or revocations.

OpenTide 内容应引用不带版本后缀的 ATT&CK 技术 ID，例如使用
```
T1059.001
```
，而不是
```
T1059.001 v2.0
```
。
仓库级 ATT&CK 版本在内容仓库的元数据或 schema 配置中声明。各对象继承该版本。
ATT&CK 发布新版本时，应审查映射技术发生重大版本变更或撤销的相关对象。

Revocations

撤销

ATT&CK periodically revokes techniques, replacing them with new IDs. v19 examples:

```
Impair Defenses
```
→ revoked, replaced by
```
Disable or Modify Tools
```
(T1685)
```
Disable or Modify System Firewall
```
→ revoked, replaced by T1686

Handling revocations in OpenTide:

Search the content repo for the revoked technique ID.
Update to the replacement technique ID.
Review the description — the replacement may have a narrower or broader scope.
Log the change in the PR narrative.

ATT&CK 会定期撤销技术，并使用新的 ID 替代它们。v19 示例：

```
Impair Defenses
```
→ 已撤销，替换为
```
Disable or Modify Tools
```
（T1685）
```
Disable or Modify System Firewall
```
→ 已撤销，替换为 T1686

在 OpenTide 中处理撤销：

在内容仓库中搜索被撤销的技术 ID。
将其更新为替代技术 ID。
审查说明——替代技术的适用范围可能更窄或更广。
在 PR 说明中记录此次变更。

Deprecations

弃用

Deprecated techniques have no replacement. Remove the mapping and document the gap.

已弃用的技术没有替代项。移除相应映射并记录由此产生的缺口。

5. Mapping in OpenTide objects

5. OpenTide 对象中的映射

TVM (Threat Vector)

TVM（Threat Vector）

Field	ATT&CK content
`threat.att&ck`	Array of technique/sub-technique IDs with tactic context
`terrain`	Narrative references to ATT&CK behaviours with evidence
`chaining`	Ordered technique sequence when the TVM describes a multi-step chain

Quality bar: Every technique ID in

threat.att&ck

must trace to a specific claim in the source intelligence. Unmapped techniques are preferable to speculative mappings.

字段	ATT&CK 内容
`threat.att&ck`	包含技术或子技术 ID 及其战术上下文的数组
`terrain`	对有证据支持的 ATT&CK 行为的叙述性引用
`chaining`	当 TVM 描述多步骤链时，采用有序的技术序列

质量标准：

threat.att&ck

中的每个技术 ID 都必须能够追溯到来源情报中的具体论断。与其进行推测性映射，不如保留未映射状态。

DOM (Detection Objective)

DOM（Detection Objective）

Field	ATT&CK content
`objective.signals[].att&ck`	Technique(s) the signal can detect
Coverage narrative	Which sub-techniques are covered vs gaps

Quality bar: A DOM signal should map to the technique(s) it can actually observe, not the full TVM chain. If a signal detects

T1003.001

(LSASS dump) but not

T1003.003

(NTDS), map only

.001

字段	ATT&CK 内容
`objective.signals[].att&ck`	信号能够检测的技术
覆盖说明	已覆盖的子技术以及存在的缺口

质量标准：DOM 信号应映射到其实际能够观测的技术，而不是完整的 TVM 技术链。如果某信号可检测

T1003.001

（LSASS dump），但无法检测

T1003.003

（NTDS），则只映射

.001

。

MDR (Detection Rule)

MDR（Detection Rule）

Field	ATT&CK content
Rule metadata / `configurations.*.mitre`	Technique IDs for the platform rule
`description`	Technique context in prose

Quality bar: The MDR technique mapping must match what the query actually detects. A KQL query filtering on

FileName =~ "ntdsutil.exe"

maps to

T1003.003

, not the parent

T1003

字段	ATT&CK 内容
规则元数据 / `configurations.*.mitre`	平台规则对应的技术 ID
`description`	以自然语言描述技术上下文

质量标准：MDR 技术映射必须与查询实际检测到的内容一致。过滤

FileName =~ "ntdsutil.exe"

的 KQL 查询应映射到

T1003.003

，而不是父技术

T1003

。

6. Coverage analysis (inverse mapping)

6. 覆盖分析（反向映射）

ATT&CK mapping also works in reverse: given a set of detection rules, which techniques are covered?

ATT&CK 映射也可以反向使用：给定一组检测规则，哪些技术已被覆盖？

Coverage matrix construction

构建覆盖矩阵

Extract all technique IDs from MDR objects in the content repo.
Map against the ATT&CK Enterprise matrix (222 techniques, 475 sub-techniques in v19).
Classify coverage:

Level	Definition
Detected	At least one production MDR rule maps to this technique
Hunted	A validated hunt query exists but no production rule
Theoretical	A DOM signal is defined but no query exists
Gap	No coverage at any level

从内容仓库中的 MDR 对象中提取所有技术 ID。
与 ATT&CK Enterprise 矩阵进行映射（v19 中包含 222 项技术和 475 项子技术）。
对覆盖情况进行分类：

级别	定义
Detected	至少有一条生产环境 MDR 规则映射到此技术
Hunted	存在经过验证的 threat hunting 查询，但没有生产规则
Theoretical	已定义 DOM 信号，但不存在对应查询
Gap	任何层级都不存在覆盖

Coverage anti-patterns

覆盖反模式

Anti-pattern	Description
Breadth without depth	Mapping to parent techniques only, claiming "T1059 covered" when only PowerShell (T1059.001) has a rule
Phantom coverage	Mapping a rule to a technique it cannot actually detect (e.g. a network rule claiming to detect a registry technique)
Stale coverage	Rules mapped to revoked technique IDs that no longer exist in the current ATT&CK version
Platform mismatch	Claiming Linux technique coverage with a Windows-only detection rule

反模式	说明
广度有余而深度不足	仅映射到父技术；实际上只有 PowerShell（T1059.001）存在规则，却声称“T1059 已覆盖”
虚假覆盖	将规则映射到其无法实际检测的技术，例如使用网络规则声称检测注册表技术
过期覆盖	规则仍映射到已被撤销、且不再存在于当前 ATT&CK 版本中的技术 ID
平台不匹配	使用仅适用于 Windows 的检测规则，却声称覆盖 Linux 专属技术

7. Common mapping mistakes

7. 常见映射错误

Mistake	Fix
Listing both parent and sub-technique for the same behaviour	Use the most specific level only
Mapping to every tactic a technique supports	Select the tactic matching the adversary's goal in context
Copying technique lists from CTI reports without validation	Verify each mapping against the actual behaviour described
Using deprecated/revoked technique IDs	Check against current ATT&CK version
Mapping a detection rule to techniques it cannot observe	Map only to what the query's data source can see
Over-tagging MDR rules with 5+ techniques	One rule typically detects 1-2 specific behaviours

错误	修正方式
对同一种行为同时列出父技术和子技术	只使用最具体的级别
映射到某项技术支持的所有战术	选择与特定情境下对手目标相匹配的战术
未经验证便从 CTI 报告复制技术列表	根据实际描述的行为验证每个映射
使用已弃用或已撤销的技术 ID	对照当前 ATT&CK 版本进行检查
将检测规则映射到其无法观测的技术	只映射到查询数据源能够看到的内容
为 MDR 规则过度标注 5 项以上技术	一条规则通常仅检测 1～2 个具体行为

8. ATT&CK data sources and data components

8. ATT&CK 数据源与 Data Component

ATT&CK v19 includes Data Components (e.g. Process Creation, File Modification, Network Connection Creation) that link techniques to observable telemetry. Use these to validate that your detection platform actually has visibility into the mapped technique.

Data component	Telemetry type	Example sources
Process Creation	Process execution logs	EDR process events, Security EID 4688, Sysmon EID 1
File Creation / Modification	File system activity logs	EDR file events, Sysmon EID 11, Security EID 4663
Network Connection Creation	Network connection logs	EDR network events, Sysmon EID 3, firewall logs
User Account Authentication	Authentication logs	SIEM sign-in logs, Security EID 4624/4625
Windows Registry Key Modification	Registry change logs	EDR registry events, Sysmon EID 12/13/14, Security EID 4657
Module Load	DLL/image load logs	EDR image load events, Sysmon EID 7
Command Execution	Command-line / script logs	PowerShell 4104, EDR command events
Scheduled Job Creation	Task/job creation logs	Security EID 4698, Sysmon EID (via WMI), cron logs
Service Creation	Service installation logs	System EID 7045, Security EID 4697
Active Directory Object Access	Directory service logs	SIEM audit logs, Security EID 4662

Consult your platform skill for exact table/index names. If the data component required by a technique is not available on your platform, the mapping is theoretical — document the gap.

ATT&CK v19 包含 Data Component，例如 Process Creation、File Modification 和 Network Connection Creation，用于将技术与可观测遥测数据关联起来。应使用这些 Data Component 验证检测平台是否确实能够观测到所映射的技术。

Data Component	遥测类型	示例来源
Process Creation	进程执行日志	EDR 进程事件、Security EID 4688、Sysmon EID 1
File Creation / Modification	文件系统活动日志	EDR 文件事件、Sysmon EID 11、Security EID 4663
Network Connection Creation	网络连接日志	EDR 网络事件、Sysmon EID 3、防火墙日志
User Account Authentication	身份验证日志	SIEM 登录日志、Security EID 4624/4625
Windows Registry Key Modification	注册表变更日志	EDR 注册表事件、Sysmon EID 12/13/14、Security EID 4657
Module Load	DLL 或映像加载日志	EDR 映像加载事件、Sysmon EID 7
Command Execution	命令行或脚本日志	PowerShell 4104、EDR 命令事件
Scheduled Job Creation	任务或作业创建日志	Security EID 4698、Sysmon EID（通过 WMI）、cron 日志
Service Creation	服务安装日志	System EID 7045、Security EID 4697
Active Directory Object Access	目录服务日志	SIEM 审计日志、Security EID 4662

请查阅对应的平台 skill，以获取准确的表名或索引名称。如果平台缺少某项技术所需的 Data Component，则该映射属于 Theoretical，应记录这一缺口。

9. Platform matrix awareness

9. 平台矩阵适配

ATT&CK Enterprise covers multiple platform domains. Ensure technique mappings align with the target platform:

Platform	Scope	Notes
Windows	Desktop + Server	Largest technique coverage; most sub-techniques
Linux	Servers, containers, IoT	Growing coverage; includes container-specific techniques
macOS	Desktop	Smaller but distinct technique set (TCC, launchd, etc.)
Cloud (AWS, Azure, GCP)	IaaS / PaaS	Cloud-specific techniques (T1578, T1580, T1535, etc.)
SaaS	Office 365, Google Workspace, etc.	Identity and data-focused techniques
Network	Routers, switches, firewalls	Network device-specific techniques
Containers	Docker, Kubernetes	Container escape, orchestration abuse
ICS	Industrial control systems	Separate ATT&CK for ICS matrix (not covered here)

Rule: When mapping a detection rule to a technique, verify the technique applies to the platform the rule targets. A Windows-only detection cannot claim coverage of a Linux-only technique.

ATT&CK Enterprise 涵盖多个平台域。必须确保技术映射与目标平台一致：

平台	范围	注意事项
Windows	桌面端与服务器	技术覆盖面最广，包含大多数子技术
Linux	服务器、容器、IoT	覆盖面持续增长，包含容器专属技术
macOS	桌面端	覆盖范围较小，但具有独立的技术集合（TCC、launchd 等）
Cloud（AWS、Azure、GCP）	IaaS / PaaS	云专属技术（T1578、T1580、T1535 等）
SaaS	Office 365、Google Workspace 等	侧重身份和数据的技术
Network	路由器、交换机、防火墙	网络设备专属技术
Containers	Docker、Kubernetes	容器逃逸、编排系统滥用
ICS	工业控制系统	使用独立的 ATT&CK for ICS 矩阵，此处不涉及

规则：将检测规则映射到技术时，必须验证该技术适用于规则所面向的平台。Windows 专属检测不能声称覆盖 Linux 专属技术。

10. Tactic reference (v19 Enterprise)

10. 战术参考（v19 Enterprise）

ID	Tactic	Description
TA0043	Reconnaissance	Gathering information to plan future operations
TA0042	Resource Development	Establishing resources to support operations
TA0001	Initial Access	Gaining an initial foothold
TA0002	Execution	Running adversary-controlled code
TA0003	Persistence	Maintaining access across restarts/credential changes
TA0004	Privilege Escalation	Gaining higher-level permissions
TA0005	Stealth	Hiding artefacts, obfuscation, masquerading (v19: split from Defense Evasion)
TA0112	Defense Impairment	Disabling tools, clearing logs, firewall modification (v19: split from Defense Evasion)
TA0006	Credential Access	Stealing credentials
TA0007	Discovery	Exploring the environment
TA0008	Lateral Movement	Moving through the environment
TA0009	Collection	Gathering data of interest
TA0011	Command and Control	Communicating with compromised systems
TA0010	Exfiltration	Stealing data
TA0040	Impact	Manipulating, interrupting, or destroying systems and data

ID	战术	说明
TA0043	Reconnaissance	收集信息以规划未来行动
TA0042	Resource Development	建立支持行动所需的资源
TA0001	Initial Access	取得初始立足点
TA0002	Execution	运行对手控制的代码
TA0003	Persistence	在重启或凭据变更后保持访问
TA0004	Privilege Escalation	获取更高层级的权限
TA0005	Stealth	隐藏痕迹、混淆、伪装（v19：从 Defense Evasion 中拆分）
TA0112	Defense Impairment	禁用工具、清除日志、修改防火墙（v19：从 Defense Evasion 中拆分）
TA0006	Credential Access	窃取凭据
TA0007	Discovery	探索环境
TA0008	Lateral Movement	在环境中横向移动
TA0009	Collection	收集关注的数据
TA0011	Command and Control	与已入侵系统进行通信
TA0010	Exfiltration	窃取数据
TA0040	Impact	篡改、干扰或破坏系统及数据

11. Quality checklist

11. 质量检查清单

Every technique ID is valid in the current ATT&CK version.
Sub-technique used when the specific implementation is documented; parent when not.
Parent and sub-technique not both listed for the same behaviour.
Tactic matches the adversary's goal in context, not every possible tactic.
MDR technique mapping matches what the query actually detects.
DOM signal mapping covers only the techniques the signal can observe.
TVM technique mapping traces to specific source intelligence claims.
No revoked or deprecated technique IDs remain.
Coverage claims validated against available data sources / data components.
Multi-technique chains are independently evidenced per step.
Platform matrix alignment verified (technique applies to the target platform).
v19 tactic split handled: TA0005 = Stealth, TA0112 = Defense Impairment (not "Defense Evasion").
Technique index (
```
references/Enterprise-Techniques.md
```
) consulted for ID validation.
Online ATT&CK version checked if skill may be outdated.

每个技术 ID 在当前 ATT&CK 版本中都有效。
已记录具体实现时使用子技术，否则使用父技术。
对同一种行为不同时列出父技术和子技术。
战术与特定情境下的对手目标相匹配，而不是涵盖所有可能的战术。
MDR 技术映射与查询实际检测到的内容一致。
DOM 信号映射仅涵盖该信号能够观测到的技术。
TVM 技术映射能够追溯到来源情报中的具体论断。
不存在任何已撤销或已弃用的技术 ID。
已根据可用的数据源或 Data Component 验证覆盖声明。
多技术链中的每个步骤都有独立证据支持。
已验证平台矩阵一致性，即技术适用于目标平台。
已正确处理 v19 战术拆分：TA0005 = Stealth，TA0112 = Defense Impairment，而非“Defense Evasion”。
已查阅技术索引（
```
references/Enterprise-Techniques.md
```
）以验证 ID。
如果此 skill 可能已过时，则已在线检查 ATT&CK 版本。