Lion Cipher Lab
Map an attack to MITRE ATT&CK
- Threat Intel Analyst
- Beginner
- ~30 min
- Free · no account required
Why it matters
When defenders describe an attack in their own words, everyone hears something slightly different, and detections, reports, and threat intelligence stop lining up. MITRE ATT&CK fixes that by giving adversary behaviour a shared, public vocabulary: a catalogue of the goals attackers pursue (Tactics) and the concrete ways they pursue them (Techniques), each with a stable ID. Once you can look at an incident and say 'that step is T1566 Phishing under the Initial Access tactic,' your notes, your alerts, and a report from a team on the other side of the world all snap to the same reference. Being…
What you'll learn
- what MITRE ATT&CK is
- Tactics vs Techniques
- reading a technique page (IDs like T1566)
- mapping incident steps to ATT&CK
- why a shared language for adversary behaviour matters
Steps in this lab
- What MITRE ATT&CK is, and the problem it solves
- The Matrix: how the whole thing is laid out
- Tactics = the WHY (the adversary's goal)
- Techniques = the HOW (and how to read a technique page)
- The incident we'll map
- Map the first two beats: getting in, then stealing credentials
- Map the last beat and read the finished chain
- Why a shared language is worth learning