MITRE ATT&CK Mapping for Detection Engineers
Learn how to use MITRE ATT&CK as a practical detection coverage map, map detections to tactics and techniques, and spot coverage gaps.
In this lesson, you will learn to:
- By the end of this lesson, learners will be able to map detections to MITRE ATT&CK tactics and techniques correctly, and use coverage mapping to identify gaps and prioritize detection work.
MITRE ATT&CK Mapping for Detection Engineers
This lesson teaches students how to use the MITRE ATT&CK framework as a practical tool for detection coverage. They learn how tactics and techniques relate to detections, how to map a detection correctly, and how to use the framework to find coverage gaps and prioritize work.
Tactics and Techniques as a Coverage Map
MITRE ATT&CK is a knowledge base of adversary behavior. For a detection engineer, it is not just a reference document. It is a map of the terrain you must cover.
Tactics and techniques
ATT&CK organizes behavior into tactics and techniques. A tactic is the attacker’s goal, such as Initial Access, Execution, Persistence, Privilege Escalation, or Exfiltration. A technique is a specific way of achieving that goal. For example, under Execution, techniques include Command and Scripting Interpreter, PowerShell, and Windows Management Instrumentation.
Why tactics matter for detection
Tactics help you understand the attack lifecycle. You can ask: do we have detections for every tactic? If you have strong Execution coverage but no Exfiltration coverage, an attacker could enter and operate but you would miss the moment they steal data. Tactics give you a high-level coverage view.
Why techniques matter for detection
Techniques give you specific behavior to detect. Each technique has a description of how it works and often includes examples of tools and procedures. That detail is a starting point for the technique-to-observable translation you learned in the previous lesson.
The coverage map mindset
Think of ATT&CK as a grid. One axis is tactics, the other is techniques. Each detection you build covers one or more cells in that grid. Over time, you can visualize where your coverage is strong and where it is thin. This is far more powerful than simply counting how many rules you have.
How to Map a Detection Correctly
Mapping a detection to ATT&CK is simple in theory but often done poorly in practice. A correct mapping requires honesty about what the detection actually sees.
The golden rule
Map to the behavior the detection observes, not the behavior you hope it catches. If a detection watches for a process creating a scheduled task, it is observing a Persistence or Execution technique related to scheduled tasks. It is not observing every possible use of that technique.
Steps to map a detection
- Review the detection logic carefully. What events and fields does it actually match?
- Identify the attacker behavior those events represent.
- Find the ATT&CK technique that most directly describes that behavior.
- If multiple techniques are involved, choose the one that is the main focus.
- Record the technique ID, such as
T1053for Scheduled Task, in the detection metadata.
Common mapping mistakes
- Over-mapping. Claiming a detection covers ten techniques when it only really covers one.
- Under-mapping. Failing to map a detection at all, which makes coverage invisible.
- Mapping to a tool instead of a technique. ATT&CK techniques describe behavior, not specific tools.
- Ignoring sub-techniques. Some techniques have sub-techniques that are more specific. Use the most precise mapping available.
The value of honest mapping
Honest mapping produces a reliable coverage picture. Leaders can see where real gaps exist. Engineers know where to prioritize. Auditors can verify claims. Inflated mappings, on the other hand, create a false sense of security and hide serious weaknesses.
Using Coverage Mapping to Find Gaps
Coverage mapping turns your detections into a strategic view. Instead of wondering whether you are protected, you can see it.
Building a simple coverage map
Start with a list of your detections and their ATT&CK mappings. Then organize by tactic and technique. A simple spreadsheet can work:
| Detection Name | Tactic | Technique ID | Technique Name |
|---|---|---|---|
| Suspicious scheduled task creation | Persistence | T1053 | Scheduled Task |
| New service with unusual binary | Persistence | T1543 | Create or Modify System Process |
| PowerShell download cradle | Execution | T1059.001 | PowerShell |
Once you have this list, you can count how many detections cover each tactic and find techniques with zero coverage.
Finding the right gaps
Not every technique needs a detection. Some techniques are not relevant to your environment. Others may be covered by preventive controls instead. The goal is not 100 percent technique coverage. The goal is to make informed decisions about risk.
Ask three questions about each gap:
- Is this technique used by threat actors that target our industry?
- Could this technique work in our environment?
- Do we have preventive controls that reduce the risk?
If the answer to all three questions points to real risk, the gap is worth closing.
Prioritizing detection work
Coverage mapping helps you say no to shiny distractions and yes to meaningful work. When a vendor or blog post promotes a new detection, you can check your coverage map. If the relevant technique is already covered and the new detection adds little, you can skip it. If a high-risk technique has no coverage, it jumps to the top of your list.
This is how coverage mapping turns detection engineering from reactive rule-writing into a strategic security function.