🚧 Under construction — VoTechWorks is being built. A free tech program — complimentary, as our commitment to get America working.
voTechWorksGrade 13 · a vocational technology learning center, by urbanicity
newSchoolWorks.com › VoTechWorks › Technology & Design › Cybersecurity › Security Information and Event Management (SIEM) › Lesson 6
TEC-CYBE44-06 · Lesson 6 · 12 clock hours · theory

MITRE ATT&CK Framework and Alert Mapping

Objective. Students map at least ten SIEM alert types to specific MITRE ATT&CK tactics and techniques and explain how the framework guides detection strategy.

⚠ Pending professional review

This lesson, its worked examples and its practice questions has not yet been verified by an industry-certified professional or by a certification or approval body. It is a study draft and may contain errors. Do not use it as instructions for work on a job site or on live equipment. Always follow your instructor, your supervising professional, and current official references and regulations.

VoTechWorks program approval and accreditation are still in progress. Credentials are issued only by the certifying bodies named in each program, after their own exams.

What Is the MITRE ATT&CK Framework?

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a publicly available knowledge base that catalogs the real-world behaviors of threat actors after they have gained access to a target environment. MITRE, a US federally funded research and development center, developed and maintains the framework. It is organized around three major matrices: Enterprise (Windows, macOS, Linux, cloud, containers, and network), Mobile, and ICS (Industrial Control Systems). In a SIEM context, the Enterprise matrix is the one you will use most.

Each row in the matrix represents a Tactic — the adversary's high-level goal, such as Initial Access, Persistence, Privilege Escalation, or Exfiltration. Within each tactic column sit Techniques (and where applicable, Sub-techniques), which describe how the goal is achieved. Every technique carries a unique ID (e.g., T1078 for Valid Accounts) and every sub-technique extends that ID with a decimal (e.g., T1078.002 for Domain Accounts).

As of the most recent ATT&CK releases, the Enterprise matrix contains hundreds of techniques and sub-techniques spread across fourteen tactics. Because the framework is based on threat intelligence drawn from real incidents, it gives defenders a shared, precise vocabulary for describing attack behavior.

Why the Framework Matters for SIEM Work

A SIEM generates alerts from correlation rules. Without a structured reference, those rules can pile up without any clear picture of what portion of the attack lifecycle you are actually detecting. ATT&CK solves that problem by giving every alert a home address in the adversary playbook.

When you map a correlation rule to an ATT&CK technique, you immediately know:

This practice aligns directly with the CompTIA CySA+ exam domain covering threat intelligence and detection engineering, and it supports the ISC2 CC objective of understanding security operations concepts.

The ATT&CK Navigator

The ATT&CK Navigator (available at attack.mitre.org) is a browser-based heat-map tool that displays the full matrix as a color-coded grid. You can:

1. Create a new layer and name it (e.g., "Current SIEM Coverage").

2. Select techniques that your existing correlation rules cover and assign them a color or score.

3. Instantly see blank (uncovered) areas — your detection gaps.

4. Export the layer as JSON or an image for documentation.

The Navigator does not require an account and runs entirely in your browser. No sensitive data from your environment is entered into the tool; you are simply annotating the public technique matrix.

Mapping SIEM Alerts to ATT&CK

The mapping process follows a consistent pattern:

1. Read the alert name and the log data it analyzes. For example, "Kerberoasting attempt" fires when a service ticket request is made for an account with a weak Service Principal Name (SPN).

2. Identify the adversary's goal. Stealing password hashes to crack offline = Credential Access.

3. Look up the technique. Search ATT&CK for "Kerberoasting" → T1558.003 (Steal or Forge Kerberos Tickets: Kerberoasting).

4. Record Tactic, Technique ID, and a brief description in your mapping table.

Common alert types you will encounter and their mappings include:

| Alert Name | Tactic | Technique ID |

|---|---|---|

| Kerberoasting attempt | Credential Access | T1558.003 |

| LSASS credential dumping | Credential Access | T1003.001 |

| Living-off-the-land binary (LOLBin) execution | Defense Evasion / Execution | T1218 (varies by binary) |

| Pass-the-Hash | Lateral Movement | T1550.002 |

| PowerShell encoded command | Execution | T1059.001 |

| Scheduled task creation | Persistence | T1053.005 |

| Data staged for exfiltration | Collection | T1074 |

| DNS tunneling | Command and Control | T1071.004 |

Detection Gap Analysis

Once you have colored your existing rules on the Navigator, look for tactic columns that are entirely blank or nearly blank. Common gaps in entry-level SIEM deployments include:

Identifying a gap leads directly to a new rule proposal: state what log source you would need, what event field or pattern to correlate, and which technique it would cover.

Safety and Professional Responsibility

Because SIEM work involves access to real security event data, you must handle that data according to your organization's data-handling and privacy policies. Never share raw log data, IP addresses, or user account details outside authorized channels. When using the public ATT&CK Navigator for training exercises, use only simulated or anonymized alert names — do not paste actual log content into external web tools. Maintaining the confidentiality of security operations data is an ethical and legal obligation and is tested on both Security+ and CySA+ exams under governance and compliance domains.

Key terms8

TacticIn MITRE ATT&CK, a tactic is the adversary's high-level goal or objective during an attack, such as Persistence, Lateral Movement, or Exfiltration.
TechniqueA specific method an adversary uses to achieve a tactic; identified by a unique ID (e.g., T1059) in the ATT&CK framework.
Sub-techniqueA more granular variation of a technique, identified by a decimal extension (e.g., T1059.001 for PowerShell under the Command and Scripting Interpreter technique).
ATT&CK NavigatorA free, browser-based tool provided by MITRE for visualizing and annotating the ATT&CK matrix as a color-coded heat map to show detection coverage and gaps.
Detection GapA tactic or technique area in the ATT&CK matrix for which an organization currently has no correlation rule or alert configured in its SIEM.
KerberoastingAn attack technique (T1558.003) in which an adversary requests Kerberos service tickets for accounts with Service Principal Names and then attempts to crack the tickets offline to recover plaintext passwords.
Living-off-the-Land Binary (LOLBin)A legitimate, pre-installed system binary (such as certutil.exe or mshta.exe) abused by adversaries to execute malicious actions while blending in with normal system activity, mapped under ATT&CK technique T1218 and its sub-techniques.
Credential DumpingThe act of extracting account credentials from an operating system or application; in ATT&CK, OS Credential Dumping is T1003, with LSASS memory access as sub-technique T1003.001.
In class: Framework familiarization: students navigate the MITRE ATT&CK Navigator (online tool) to locate five techniques relevant to the correlation rules they built in the previous lesson and document the Tactic, Technique ID, and a one-sentence description for each. · Alert-to-ATT&CK mapping table: students receive a list of twenty SIEM alert names (e.g., 'Kerberoasting attempt,' 'Living-off-the-land binary execution,' 'Credential dumping via LSASS') and complete a mapping table identifying the ATT&CK tactic and technique for each. · Detection gap analysis: using the ATT&CK Navigator heat-map feature, students color-code their three existing correlation rules against the full matrix and identify at least two tactic areas with no current coverage, then propose a new rule for one gap in a short written brief.
Materials: MITRE ATT&CK Navigator (att&ck.mitre.org, online), ATT&CK mapping worksheet, projector for instructor demo, CySA+ official study guide (threat intelligence chapter)
Check: Completed mapping table reviewed by instructor; at least 8 of 10 mappings correct, detection gap brief submitted. Pass = 80% mapping accuracy plus submitted brief.

Practice check8

Answer each question, then check it. Nothing is recorded; this is your own practice.

CompTIA CySA+ — Threat Intelligence and Detection Engineering
1. An analyst receives a SIEM alert labeled 'Scheduled task created by non-administrative user.' Which MITRE ATT&CK tactic does this behavior most directly support?
CompTIA CySA+ — Security Operations
2. A SOC analyst uses the ATT&CK Navigator and finds that the entire 'Exfiltration' tactic column is blank. What does this indicate?
CompTIA Security+ — Threats, Attacks and Vulnerabilities
3. Which ATT&CK sub-technique ID is associated with dumping credentials directly from the Windows LSASS process memory?
CompTIA CySA+ — Threat Intelligence and Detection Engineering
4. A Kerberoasting alert fires in the SIEM. Under which ATT&CK tactic should an analyst file this technique?
CompTIA Security+ — Threats, Attacks and Vulnerabilities
5. An adversary uses the built-in Windows tool certutil.exe to decode and drop a malicious payload. Which ATT&CK category best describes this activity?
CompTIA CySA+ — Security Operations
6. Which of the following best describes the primary purpose of mapping SIEM correlation rules to MITRE ATT&CK techniques?
CompTIA CySA+ — Threat Intelligence and Detection Engineering
7. A student's ATT&CK Navigator layer shows strong coverage in Execution and Persistence but nothing in the Reconnaissance tactic. What is the most appropriate next step?
ISC2 CC — Security Principles / CompTIA Security+ — Governance, Risk and Compliance
8. When using the public ATT&CK Navigator for a training exercise, which data handling practice is most appropriate?
Record this lesson on my transcript. Sign in with your key and enrollment email to record lessons (enroll free if you have no key). This page stays open to read and practise.
← Previous lessonProgram planNext lesson →