## Mapping Threats to ATT&CK\n\n### The Mapping Process\n\n```\n1. Read threat report/intel\n         ↓\n2. Identify behaviors described\n         ↓\n3. Break into atomic actions\n         ↓\n4. Map to ATT&CK techniques\n         ↓\n5. Validate mapping\n         ↓\n6. Document with sources\n```\n\n### Example: Mapping APT Activity\n\n**Report Excerpt**:\n> "The attacker sent a spearphishing email with a malicious Word document. When opened, the document executed a PowerShell command that downloaded a second-stage payload. The payload established persistence via a scheduled task and communicated over HTTPS to a C2 server."\n\n**Mapping**:\n\n| Behavior | ATT&CK Technique |\n|----------|------------------|\n| Spearphishing email with attachment | T1566.001 |\n| Macro executes PowerShell | T1059.001 |\n| Downloads second-stage | T1105 |\n| Scheduled task persistence | T1053.005 |\n| HTTPS C2 | T1071.001 |\n\n### Common Mapping Challenges\n\n⚠️ **Too specific**: Mapping to sub-techniques when only technique is justified\n⚠️ **Too broad**: Missing sub-techniques when details exist\n⚠️ **Assumptions**: Inferring techniques without evidence\n\n### Validation Questions\n\n- Is there evidence in the report for this technique?\n- Am I choosing the most accurate technique?\n- Have I captured all observed behaviors?\n- Would another analyst map this the same way?