// tool reference · Monitoring & Detection

MITRE ATT&CK Technique Mapper Free

観測した挙動やログを MITRE ATT&CK のテクニックに対応付けます。

Open MITRE ATT&CK Technique Mapper →

What it does

Translates "what I saw" into ATT&CK tactics and techniques, so your write-up uses the vocabulary everyone else does.

When to use it

Writing an incident report; building detection coverage maps.

Inputs

Field names are the actual form parameters, verified against source.

Field	種類	Required	Notes
observation	textarea	required	What you observed, in plain language.

What you get back

Candidate techniques with tactic and rationale.

活用例

Input

A service account logged in interactively at 3am from a new IP,
then ran whoami and net group "domain admins"

Output (abridged)

MAPPED -- 3 techniques, 1 likely chain

T1078.002  Valid Accounts: Domain Accounts      (Initial Access)
           Service account + interactive login = misuse of a legitimate
           credential. Service accounts should never log in interactively.

T1033      System Owner/User Discovery          (Discovery)
           'whoami' -- orienting after landing.

T1069.002  Permission Groups Discovery: Domain  (Discovery)
           'net group "domain admins"' -- mapping the path to privilege.

CHAIN: valid credential -> orient -> enumerate privilege targets.
That is the opening of a hands-on-keyboard intrusion, not a script.

NEXT: T1021 Lateral Movement is the likely follow-on. Look there now.

How it works

Deterministic mapping against the ATT&CK matrix.

Limits

Read live from the platform configuration.

Rate limit

30 requests / 60s (platform default)

Limitations — what it does なし do

It maps a description to the matrix. Mapping quality depends on your description, and several techniques often fit one observation -- treat candidates as hypotheses.

プライバシー

Nothing is stored.

Standards

MITRE ATT&CK