Lion Cipher Lab
Walk from a weakness (CWE) to attack patterns (CAPEC) to adversary techniques (ATT&CK) in Python
- Threat Intel Analyst
- Intermediate
- ~75 min
- Free · no account required
Why it matters
A vulnerability report tells you WHAT is broken: 'CWE-427, uncontrolled search path element'. A defender needs to know what an attacker will DO with it, and what that looks like in the logs. MITRE maintains three catalogues that, chained together, promise exactly that answer: CWE names the weakness, CAPEC describes the attack patterns that exploit weaknesses, and ATT&CK describes the adversary techniques you hunt and detect. The chain is genuinely useful: for a search-path weakness it lands you on DLL search-order hijacking techniques in a few seconds, and from there on specific telemetry.…
What you'll learn
- Explaining what CWE, CAPEC and ATT&CK each catalogue, and why they answer different questions
- Downloading and PINNING a specific CAPEC release and recording its version, date and hash
- Parsing the namespaced CAPEC XML with Python's standard library (xml.etree.ElementTree)
- Following Related_Weaknesses and Taxonomy_Mappings to chain a CWE through CAPEC into ATT&CK
- Measuring how much of a mapping actually exists before trusting it (coverage, dead ends)
- Checking cross-references against the CURRENT ATT&CK release and translating revoked IDs with revoked-by
- Turning a mapped technique into a testable detection hypothesis, and knowing when the chain says nothing
Steps in this lab
- Three catalogues, three different questions
- Download CAPEC and pin the exact version
- Read the shape of a CAPEC attack pattern
- Measure the catalogue before you trust it
- Walk four real weaknesses through the chain
- Why SQL injection reaches nothing (and what to write instead)
- Check every mapping against the current ATT&CK release
- Turn a live mapping into a detection hypothesis
- What you built, and where it goes next