SDF-AN02

MITRE ATT&CK Correlation

intermediateDetection Value: highCost: minimalTime: 2-5 days per engagement⚙ Applications & Services

Description

Map observed adversary behaviors to the MITRE ATT&CK framework to create a standardized representation of adversary activity. This mapping enables comparison with known threat actor profiles, identification of detection gaps, and communication with the broader security community.

Rationale

MITRE ATT&CK provides a shared language for describing adversary behavior. Mapping deception observations to ATT&CK enables cross-referencing with known threat actor profiles, identifying which ATT&CK techniques your detection rules cover and which they miss, and communicating findings in a format that the global security community understands.

Supporting Basis

Literature-informed design

ATT&CK provides the knowledge base and relationship model, while the specific correlation workflow is defined by ShadowMatrix.

Strom, B.E. et al. MITRE ATT&CK: Design and Philosophy. The MITRE Corporation, revised 2020.Technical report

These sources establish design lineage and scope. They do not validate this record's operational effectiveness, planning estimates, environment labels, or ATT&CK relationships.

Implementation Steps

Review extracted TTPs

Start with the TTP catalog from SDF-AN01. For each extracted technique, identify the most appropriate MITRE ATT&CK technique mapping.

Validate mappings

Ensure mappings are accurate by comparing the observed procedure details with the ATT&CK technique descriptions. Use sub-technique mappings where they provide better specificity.

Generate ATT&CK Navigator layer

Create an ATT&CK Navigator layer that visualizes the adversary coverage. This provides an immediate visual summary of adversary capabilities.

Perform gap analysis

Compare the adversary ATT&CK coverage with your organization detection rule coverage. Identify techniques the adversary used that are not covered by existing detection.

Technical Implementation Examples(1)

ATT&CK Navigator Layer Generator

Generate a MITRE ATT&CK Navigator layer file from observed adversary TTPs for visual gap analysis

python

"""
Generate ATT&CK Navigator layer from deception intelligence.
Creates a JSON layer file that can be imported into the ATT&CK
Navigator (https://mitre-attack.github.io/attack-navigator/).
"""
import json
from typing import List, Dict

def generate_navigator_layer(
    ttps: List[Dict],
    layer_name: str = "ShadowMatrix CDF - Observed TTPs",
) -> Dict:
    """Create an ATT&CK Navigator layer from extracted TTPs."""

    # Count observations per technique
    technique_counts = {}
    for ttp in ttps:
        tid = ttp["technique_id"]
        technique_counts[tid] = technique_counts.get(tid, 0) + 1

    # Map count to color intensity
    max_count = max(technique_counts.values()) if technique_counts else 1

    techniques = []
    for tid, count in technique_counts.items():
        # Normalize score 1-100 based on observation frequency
        score = int((count / max_count) * 100)
        techniques.append({
            "techniqueID": tid,
            "tactic": "",   # Navigator auto-maps
            "color": "",    # Let score determine color
            "comment": f"Observed {count} times in deception environment",
            "score": score,
            "enabled": True,
            "metadata": [
                {"name": "observation_count", "value": str(count)},
                {"name": "source", "value": "shadow-cdf-deception"},
            ],
        })

    layer = {
        "name": layer_name,
        "versions": {
            "attack": "15",
            "navigator": "5.0",
            "layer": "4.5",
        },
        "domain": "enterprise-attack",
        "description": (
            "Adversary techniques observed through ShadowMatrix CDF "
            "deception operations. Color intensity indicates "
            "observation frequency."
        ),
        "gradient": {
            "colors": ["#ffffff", "#ffeb3b", "#ff9800", "#f44336"],
            "minValue": 0,
            "maxValue": 100,
        },
        "legendItems": [
            {"label": "Not observed", "color": "#ffffff"},
            {"label": "Low frequency", "color": "#ffeb3b"},
            {"label": "Medium frequency", "color": "#ff9800"},
            {"label": "High frequency", "color": "#f44336"},
        ],
        "techniques": techniques,
        "showTacticRowBackground": True,
        "tacticRowBackground": "#205b8f",
        "selectTechniquesAcrossTactics": True,
    }

    return layer

if __name__ == "__main__":
    # Example: load TTPs from extraction report
    with open("ttp_report.json") as f:
        report = json.load(f)

    ttps = []
    for tech in report["techniques"]:
        for _ in range(tech["observation_count"]):
            ttps.append({"technique_id": tech["technique_id"]})

    layer = generate_navigator_layer(ttps)

    with open("shadow-cdf-navigator-layer.json", "w") as f:
        json.dump(layer, f, indent=2)

    print(f"Navigator layer generated with "
          f"{len(layer['techniques'])} techniques.")
    print("Import at: https://mitre-attack.github.io/attack-navigator/")

Considerations

Not every observed behavior maps cleanly to a single ATT&CK technique. Use multiple mappings where behavior spans technique boundaries.
ATT&CK mappings should include confidence levels. Some behaviors clearly map to specific techniques. Others are ambiguous.
Use the ATT&CK correlation to identify potential threat actor attribution, but treat attribution as a hypothesis rather than a conclusion without corroborating evidence.

Supported Environments

🏢On-Premise

☁Amazon Web Services

☁Microsoft Azure

☁Google Cloud Platform

🔄Hybrid Environment

🏭OT/ICS Environment

Tools & Resources

MITRE ATT&CK Navigator
ATT&CK knowledge base
Detection rule inventory
Threat intelligence platforms

Related Techniques

SDF-AN01TTP Extraction and Cataloging

SDF-AN03IOC Harvesting

Quick Stats

Phase: Analyze
Difficulty: intermediate
Detection Value: high
Cost: minimal
Time: 2-5 days per engagement
ATT&CK Mappings: 0