# MITRE ATT&CK Mapping (lab)

> A junior analyst's ATT&CK mapping of a full intrusion is partly wrong. Correct the two defective rows and confirm the rest against the evidence.

Canonical: https://codelivly.com/labs/attack-mapping

| | |
|---|---|
| Type | Investigation |
| Difficulty | Beginner |
| Points | 250 |
| Session length | 30 min |
| Completions | 2 |

A junior analyst's ATT&CK mapping of a full intrusion is partly wrong. Correct the two defective rows and confirm the rest against the evidence.

## Objective

You learn to treat every ATT&CK technique in a report as a claim that must point at a citable log line, to recognise and fix the two commonest mapping errors (a plausible-but-contradicted technique, and a technique with no evidence at all), and to see that a missing tactic is itself a finding.

## Tasks

1. Read the draft and the author's notes
2. Disprove the contradicted row and find its replacement
3. Strike the unevidenced row
4. Confirm the remaining eight rows

## Related

- [All labs](https://codelivly.com/practice?type=lab)