MITRE ATT&CK Mapping
Definition
The process of classifying observed malware behaviours against the MITRE ATT&CK framework's taxonomy of adversary tactics and techniques. Sandbox platforms increasingly produce ATT&CK-tagged reports, allowing investigators to compare sample behaviour against known threat-actor TTPs.
- Framework
- MITRE ATT&CK
- Classifies
- Adversary tactics and techniques
- Source data
- Observed malware behaviour, often from sandbox reports
- Use
- Compares samples against known threat-actor TTPs
Common questions
How does ATT&CK mapping change what an investigator can conclude from a malware sample?+
Instead of describing isolated behaviours in isolation, tagging them against ATT&CK's shared taxonomy lets an investigator compare the sample's tactics and techniques directly against documented threat-actor profiles, which can support attribution hypotheses or reveal the likely stage of an intrusion.
Are ATT&CK tags generated by sandbox tools always accurate?+
No, automated tagging can misclassify ambiguous behaviours or miss techniques the sandbox environment did not trigger, so analysts should treat sandbox-generated ATT&CK mappings as an investigative starting point requiring manual verification, not a definitive classification.
Does MITRE ATT&CK mapping tell you who the attacker is?+
Not directly. It documents which techniques were used, and a technique overlap with a known group's known TTPs is only one piece of circumstantial evidence toward attribution, which typically also needs infrastructure, tooling, and other corroborating indicators.
Related terms
- API Hooking
- A monitoring technique in which the sandbox intercepts calls the malware makes to operating-system API functions. Each intercepted call is logged with...
- Behavioural Analysis
- The examination of what a program does at runtime rather than what its code says at rest. Behavioural analysis captures the actual...
- Evasion Detection
- Malware logic that checks whether the execution environment is a real host or an analysis sandbox. Checks may query hardware identifiers, count...
- Network Indicator
- A network-based artefact produced by malware at runtime, such as a DNS query, an IP address contacted, an HTTP request path, a...
- Sandbox
- An isolated execution environment, typically a virtual machine, where a malware sample runs under full instrumentation. The sandbox logs all system calls,...