[Practice] “What’s the Name of This Attack?” 🏷️ Converting (Mapping) Identified Malicious Behaviors to MITRE ATT&CK IDs

Jul 13, 2026

—

Hello, security analysts striving for global standards! 🌏

Over the past sessions, we’ve dissected, executed, and even drawn timelines for malware, meticulously uncovering its ‘criminal acts (Behavior)’.

Your analysis notes probably contain entries like these:

“Registered in the Registry Run key, so it executes even after reboot.”
“Bypassed UAC prompt to gain administrator privileges.”
“Executed an encoded script via PowerShell.”

However, when sharing this information with a foreign branch’s security team or a CTI (Cyber Threat Intelligence) platform, simply saying “it registered in the registry~” would sound unprofessional, wouldn’t it? 😅

What’s needed then is the MITRE ATT&CK framework, the global common language of security.

Today, we will conduct a practical exercise to input the ‘raw behavior information’ we’ve found into an AI and map it to ‘standardized attack technique IDs (T-Codes)’. Once this task is complete, your analysis results will become advanced information usable anywhere in the world! 📊

1. 🏳️ Why is ‘Mapping’ necessary?

It’s like a doctor not writing “stomach ache” on a patient’s chart, but rather using a disease code like “Gastritis (K29)”.

Standardization: Unifies “startup program registration” and “registry key addition” under a single ID, T1547.001.
Attacker Tracking: By comparing with T-Code combinations favored by specific hacker groups (e.g., Lazarus, APT37), we can infer “who the perpetrator is (Attribution)”.
Defense Posture Visualization: Provides an at-a-glance view of our company’s defensible and vulnerable techniques.

2. 📝 [Prerequisites] List of Identified Malicious Behaviors

You will need a specific list of behaviors obtained from previous practical exercises (static/dynamic analysis).

[Input Data: Observed Behavior List]

Persistence: Malware registers update.exe in the HKCUSoftwareMicrosoftWindowsCurrentVersionRun key.
Privilege Escalation: Exploits fodhelper.exe to gain administrator privileges without user knowledge (UAC Bypass).
Defense Evasion: Deletes event logs using the command cmd.exe /c del C:WindowsSystem32winevtLogs.
Execution: Executes Base64-obfuscated commands using the -Enc option in PowerShell.

Manually searching for these sentences on the MITRE website would take considerable time. Let’s leave it to AI! 🤖

3. 🗣️ [Practice] Asking AI to “Find the ID”

Instead of simply asking the AI to find IDs, you should request it to organize the information into a three-stage structure: Tactic – Technique – Procedure.

📋 Mapping Request Prompt

[Role]

You are a Cyber Threat Intelligence (CTI) analyst and a MITRE ATT&CK framework expert.

[Task]

Analyze the ‘Identified Malicious Behaviors (Observed Behaviors)’ listed below and map them to the appropriate MITRE ATT&CK v14 (or latest version) IDs.

[Requirements]

Organize the results into a table with the following columns:

1. Observed Behavior: (Summary of input data)

2. Tactic: Purpose of the attack (e.g., Persistence)

3. Technique ID: Includes parent ID and sub-ID (e.g., T1547.001)

4. Technique Name: Official technique name

5. Description: Brief justification for why this ID was mapped

[Identified Malicious Behavior Data]

1. Malware self-registers in the HKCU…Run registry key to automatically execute upon reboot.

2. Exploits fodhelper.exe to bypass UAC (User Account Control) and gain administrator privileges.

3. Deletes Windows event log files using wevtutil or del commands.

4. Executes obfuscated code using the -EncodedCommand option when running PowerShell.

4. 📤 [Result] AI-Converted Standard Mapping Table

AI understands the context and finds the correct T-Code. (Based on the latest version)

🤖 AI Analysis Result (Example)

🗺️ MITRE ATT&CK Mapping Result Report

Based on the malicious behaviors you analyzed, the mapping results are as follows:

| Observed Behavior | Tactic | Technique ID | Technique Name | Description |

| — | — | — | — | — |

| Registry Run Key Registration | Persistence | T1547.001 | Boot or Logon Autostart Execution: Registry Run Keys | This technique modifies Windows registry run keys to automatically execute malware upon system startup. |

| UAC Bypass (fodhelper) | Privilege Escalation | T1548.002 | Abuse Elevation Control Mechanism: Bypass User Account Control | Exploited trusted binaries like fodhelper.exe to gain administrator privileges without UAC elevation prompts. |

| Event Log Deletion | Defense Evasion | T1070.001 | Indicator Removal: Clear Windows Event Logs | This behavior involves deleting security or system logs to erase traces and evade detection. |

| PowerShell Obfuscated Execution | Execution | T1059.001 | Command and Scripting Interpreter: PowerShell | PowerShell was used as an attack tool, executing code hidden with the -Enc option. |

5. 💡 Utilizing Mapping Results (ATT&CK Navigator)

What happens if you input these IDs (T1547.001, T1548.002…) organized in a table into the website called MITRE ATT&CK Navigator?

[Image concept: A heat map showing colored cells on the MITRE ATT&CK matrix]

As shown in the image above, cells in an Excel-like matrix will be colored.

With just this one visualization (Heatmap), you can impressively brief management, stating, “This attack primarily focused on ‘Privilege Escalation’ and ‘Defense Evasion’.” 😎

6. ⚠️ Caution: The Dilemma of Duplicate Mapping

Sometimes, a single behavior can belong to multiple tactics.

Example: PowerShell Execution (T1059.001)
Since code was executed, it’s an Execution tactic, and
Since obfuscation was used, it’s also a Defense Evasion tactic.

In such cases, you must explicitly instruct the AI to either “choose only the primary goal” or to mark both tactics. Typically, in analysis reports, the most important objective is selected based on the context.

🎉 Conclusion: Now Understood Worldwide!

Congratulations! 👏

You can now translate the field language of “malicious behavior” into the standardized academic terminology of “MITRE ATT&CK”.

This task is not just a simple classification game.

It means that our analysis results have been transformed into ‘structured data’ that can be databased and integrated with other security tools (EDR, SIEM).

Now, all preparations are truly complete.

Code Analysis ✅
Behavior Analysis ✅
Timeline ✅
Intent Identification ✅
Standard Mapping (MITRE) ✅

Next time, we will gather all this data to conclude our grand journey with “[Final Practice] Automated Generation of Expert-Level Malware Analysis Reports”.

Let’s stay together until the end to make your analysis shine even brighter! Fighting! 🚀🛡️