# MITRE ATT&CK and Adversary Behavior Analysis

> Read the ATT&CK knowledge base correctly, map real observations to tactics and techniques with evidence, and avoid the mapping mistakes that make intelligence unreliable.

Canonical: https://codelivly.com/rooms/cti-attack-behavior-analysis
Last updated: 2026-10-28

| | |
|---|---|
| Level | Intermediate |
| Category | Cybersecurity |
| Lessons | 5 |
| XP | 100 |

**Purpose.** Indicators change daily; adversary behaviour changes slowly. This module teaches you to describe intrusions in the shared language of MITRE ATT&CK so that your findings can be compared across incidents, handed to detection engineers, and used to profile threat actors later in this path.

**Prerequisites.** Completion of the learning paths *Threat Intelligence Foundations* (cti-foundations) and *OSINT and Indicator Analysis* (cti-osint-indicator-analysis), or equivalent familiarity with the intelligence lifecycle, confidence language and basic indicator analysis. Reading Windows process and authentication logs at a basic level helps.

**Measurable outcomes.** After this module you can:

- Name the object types in ATT&CK (tactics, techniques, sub-techniques, procedures, groups, software, campaigns, mitigations, data components, detection strategies and analytics) and explain how they relate.
- List the 15 Enterprise tactics of ATT&CK v20 and explain the v19 change that replaced Defense Evasion with Stealth and Defense Impairment.
- Map at least 10 raw observations to the correct technique or sub-technique, citing the evidence and a confidence level for each mapping.
- Identify keyword mapping, over-mapping and tactic confusion in someone else's mapping and correct it.
- Explain what an ATT&CK Navigator layer records and how layers are used to compare actors and detection coverage.

**Practical completion objective.** In the lab you map 13 synthetic observations from an intrusion at a fictional port operator to ATT&CK, reject one benign observation, and submit an evidence-backed mapping table.

## Lessons

1. How the ATT&CK Knowledge Base Is Structured (18 min)
2. Mapping Observations to Techniques with Evidence (20 min)
3. Common Mapping Mistakes and How to Catch Them (16 min)
4. From Mappings to Analysis: Navigator Layers, Comparison and the Kill Chain (17 min)
5. Lab: Map a Port Operator Intrusion to ATT&CK (50 min)

## Related

- [Learning path: Threat Actor and Campaign Investigation](https://codelivly.com/learning-paths/cti-threat-actor-investigation)
- [All rooms](https://codelivly.com/rooms)