Beginner·250 points·2 solves

MITRE ATT&CK Mapping

You learn to treat every ATT&CK technique in a report as a claim that must point at a citable log line, to recognise and fix the two commonest mapping errors (a plausible-but-contradicted technique, and a technique with no evidence at all), and to see that a missing tactic is itself a finding.

The vulnerability

Nothing is hidden in this lab. The whole intrusion is laid out across the evidence set, in order and with timestamps. What is defective is the report. A colleague three weeks into the job has already written the ATT&CK table in draft-report.md, and two of its ten rows do not survive checking, each wrong in a different way: one names a technique the evidence refutes and has to be replaced, the other asserts a stage no file records at all and has to be struck rather than corrected. attack-mapping-reference.md sets out the tactics and both failure modes; five further files hold the evidence, and the reference lists which tactic each of them speaks to. A technique in a report is a claim about evidence, so the work is to cite a real line for every row you keep, replace the row that cannot be defended, and remove the row that cannot be cited at all, including saying so when a tactic is left with nothing in the chain.

Your tasks

Read the draft and the author's notes

Open draft-report.md first, then attack-mapping-reference.md. The author's notes at the bottom of the draft justify two of the ten rows by what the incident resembled rather than by anything a log showed. Those two notes are your shortlist; the reference explains why each style of justification fails and how the two failures differ.

Disprove the contradicted row and find its replacement

Take the first suspect row and write down what would have to be true for the technique it names to hold: the mechanism itself somewhere in the logs, and the failed attempts that mechanism normally leaves behind. Search all five evidence files for those preconditions. Nothing supports them, which refutes the row rather than merely weakening it. Then determine from the evidence how the intrusion actually began, map that to a technique, and cite the line you are relying on. Decide as well whether the evidence carries the parent technique or a sub-technique, because claiming more precision than you observed is its own error.

Strike the unevidenced row

The second suspect row asserts a whole stage. Check every evidence file for any trace of the behaviour it claims and for the artefacts that behaviour always leaves on disk or in the logs. There are none, and there is no better technique to swap in, so this row comes out instead of being corrected. Then state in the report which tactic is left with nothing in the chain: an intrusion that stopped where this one stopped is a finding in its own right, not a gap in your write-up.

Confirm the remaining eight rows

Confirm the rest rather than assuming them, because rewriting a correct row is the same error as the author's, in the other direction. windows-events.json holds 125 events, of which 121 are logons and all but one of those are routine interactive sessions. Use the reference's tactic-to-event table to decide which events evidence which row, then read the parent process, the token and the object each one names — and do not write the logons off wholesale, because the single logon that is not routine is itself one of the rows you have to evidence. file-inventory.csv lists only two binaries; compare their signing and packer columns. proxy.log carries 26 short repeated POSTs to a single destination plus one upload of roughly 40 MB, and dns-queries.log shows the matching name resolved on the same rhythm. For the lateral-movement row, do not filter on which host shows activity: ordinary interactive logons are scattered across the estate, including on the host you are looking for, so a host-based filter alone will mislead you. The distinguishing features are the logon type and the address the session came from.

Answer the questions

Start the lab, investigate the evidence in the terminal, and answer the questions here.

Hints

Loading…

Official write-up

Loading…

Frequently Asked Questions

What is MITRE ATT&CK mapping?

ATT&CK mapping means labelling observed attacker behaviour with the matching tactic and technique IDs from the MITRE ATT&CK framework, so incidents can be described, compared and linked to detections in a common language.

What is the difference between a tactic and a technique?

A tactic is the attacker's goal at a stage, such as Persistence or Credential Access. A technique is the specific method used to reach that goal, such as Scheduled Task or OS Credential Dumping.

Is the ATT&CK mapping lab free?

Yes. It is free and beginner-friendly on Codelivly. You review an existing mapping against the evidence, which is good practice for the validation work analysts do in real reports.

NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a labCodelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us