Threat › Module 5 › Lesson 1
Mapping Threats
Mapping threats literacy links lab IOCs and TTPs to ATT&CK technique IDs — build mapping table on YOUR $TI_LAB fictional campaign.
Visual · t33_mapping_threats
Threat mapping literacy. $TI_LAB only. Original Cyberlium.
Opening
From indicator to technique — literacy teaches threat mapping so detection content and TI reports speak the same ATT&CK language.
Threat mapping connects observables to ATT&CK — a lab domain maps to T1566.002 Spearphishing Link; a PowerShell log line maps to T1059.001. Mapping supports detection rule tagging, hunt hypotheses, and TI report consistency. Confidence and evidence notes belong beside each mapping row. Cyberlium builds mapping table on YOUR $TI_LAB — three lab IOCs or behaviors linked to ATT&CK IDs with confidence. Next: Navigator Named.
1. Mapping components (named)
Observable: lab IOC or logged behavior from fictional campaign. Technique ID: official ATT&CK ID with tactic context. Confidence: low/medium/high based on evidence quality. Source: $TI_LAB self-authored scenario — never live victim data without authorization.
On $TI_LAB, write mapping table — three rows linking observables to technique IDs with confidence notes.
Command guide
Try these commands — Mapping components (named)
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: grep, curl. Reference sites: MITRE ATT&CK mapping (https://attack.mitre.org/resources/); CISA advisories (https://www.cisa.gov/topics/cyber-threats-and-advisories); FIRST (https://www.first.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why mapping aligns SOC, hunt, and TI output
Inconsistent technique labels break coverage dashboards. Mapped TI reports let detection engineers prioritize rule gaps. IR timelines with ATT&CK tags speed handoff to hunt team.
Students map lab scenarios on notes — production mapping follows org taxonomy and evidence standards.
3. Lab boundary
Forbidden: mapping live victim observables without authorization and handling rules. Allowed: threat mapping table with $TI_LAB fictional observables and official ATT&CK IDs.
Ship: threat mapping table for YOUR lab campaign. Next: Navigator Named.
4. What you ship: threat mapping table for $TI_LAB
Three mapping rows with ATT&CK IDs and confidence. $TI_LAB named. chmod 600.
5. What you record before the next lesson
Date. Mapping table. $TI_LAB named. File t33-m05-l01-mapping-threats.txt chmod 600.
6. Wrong vs right: criminal markets vs YOUR lab IOCs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Map observables to fabricated technique IDs. Copy live victim mapping without scope.
Right
Write threat mapping table for YOUR $TI_LAB. Next: Navigator Named.
Mission: map threats to ATT&CK on YOUR lab
1) Link three lab observables to official ATT&CK IDs. 2) Add confidence and evidence note per row. 3) Name tactic for each technique. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Confidence column prevents overclaiming — label evidence quality on every mapping row.
Knowledge Check
APPLY: Threat mapping primarily links:
Multiple choice
Knowledge Check
APPLY: True or False: Confidence notes belong beside each ATT&CK mapping row.
True or False
Knowledge Check
APPLY: Mapping threats literacy on Cyberlium uses:
Multiple choice