Study guide
6.3 Mapping Real Attacks onto ATT&CK Techniques
TryHackMe Security Analyst Level 1 SAL1
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current SAL1 Exam Facts 1.2 24-Hour Window, Check-In, and Delivery 1.3 Scoring, Retakes, Validity, and Access 1.4 MCQ Section Strategy
2 SOC Simulator Exam Skills
2.1 Analyst VM, Splunk, and Dynamic Alerts 2.2 Classification and Escalation Scoring 2.3 Case Reports and Investigation Notes
3 Network Essentials
3.1 OSI, TCP/IP, Devices, and the Three-Way Handshake 3.2 HTTP, TLS, VPN, Web Browsing, and Email Transmission
4 Operating System Basics
4.1 Windows and Linux Architecture, Auth, Filesystems, Processes 4.2 Active Directory and Event Logs for Tracing Activity
5 Cryptography, Cloud, Web and Scripting Basics
5.1 Encoding, Encryption, Hashing, and Decoding Tools 5.2 VMs vs Hosts, Cloud vs Virtual Hosting, SaaS and IaaS 5.3 Web Apps, APIs, JSON/XML, Scripts vs Compiled Programs
6 Cybersecurity Fundamentals and MITRE ATT&CK
6.1 CIA, Least Privilege, Human Factors, Log4Shell, EternalBlue 6.2 Navigating MITRE ATT&CK: Tactics, Techniques, Sub-techniques 6.3 Mapping Real Attacks onto ATT&CK Techniques
7 Kill Chain, NIST CSF, and Attack Indicators
7.1 Cyber Kill Chain Stages vs MITRE ATT&CK 7.2 NIST CSF: Identify, Protect, Detect, Respond, Recover 7.3 IoC vs IoA and the Pyramid of Pain
8 Social Engineering and Network Attacks
8.1 Phishing: Impersonation, Typosquatting, Spoofing, Header Analysis 8.2 SPF, DKIM, DMARC, and Email Authentication Results 8.3 Port Scanning, DDoS, and Man-in-the-Middle 8.4 DNS Poisoning, ARP Spoofing, Exfiltration, and C2 Traffic Patterns
9 Web Exploitation and Endpoint Attacks
9.1 Client vs Server Vulnerabilities, XSS, and SQL Injection 9.2 Code Injection, Path Traversal, Input Validation, Patching, WAF 9.3 Initial Access (RDP/SSH), Persistence, Privilege Escalation 9.4 Credential Theft, Mimikatz, Sysmon, and Auditd
10 Command and Control, Malware, and LOLBAS
10.1 Forward vs Reverse Shells, Beaconing, Metasploit, Cobalt Strike 10.2 Malware Types, Static vs Dynamic Analysis, LOLBAS
11 EDR, Firewalls, and WAF
11.1 EDR vs AV, Telemetry, Containment, Remote Shell 11.2 Firewall Deployments, Limits, and Log Analysis 11.3 WAF Capabilities, Limits, and Rule Creation
12 SIEM and SOAR
12.1 SIEM Deployments, Parsing, and Raw Logs to Alerts 12.2 Alert Management, Threat Hunting, Triage, Reporting 12.3 SOAR Playbooks, Enrichment, and TI Integration
13 Threat Intelligence and Vulnerability Scanning
13.1 Feeds, Indicators, Classifying IPs, Domains, and Hashes 13.2 YARA and TI Integration with SIEM/SOAR 13.3 External vs Internal, Web vs Network Scanning
14 SOC Team, Activities, and Alert Triage
14.1 Blue/Red Teams, Hierarchy, and SOC Roles 14.2 Proactive vs Reactive: FP Remediation, Detection Engineering, Tabletop, DFIR, Threat Hunting 14.3 Workbooks; Ticket vs Alert vs Detection Rule 14.4 Triage Workflow, Severity, Status, and Verdicts
15 SOC Metrics, Escalation, and Communication
15.1 MTTA, MTTD, MTTR, SLA, and Lookups 15.2 Escalation Matrix, Urgent Remediation, and Cross-Team Communication
6.3 Mapping Real Attacks onto ATT&CK Techniques
Key Takeaways Explain This Topic AI
Map only what evidence supports: phishing email to T1566, malicious macro or PowerShell to T1059, LSASS dump to T1003, scheduled task persistence to T1053, C2 beacon to T1071.
The same incident can honestly carry more than one technique ID when more than one goal occurred, such as T1059 for the host process and T1003 for the dump.
Writing technique IDs improves handoffs, correlation, and detection-coverage reviews after the case.
Forcing every noisy alert into a technique without evidence creates false precision; unmapped / still investigating is a valid state.
ATT&CK is a technique matrix; the Cyber Kill Chain is a more linear stage model and is compared in the next chapter.
Last updated: September 2026
Knowing that ATT&CK exists is not the skill SAL1 training content is aiming at. The skill is mapping : taking a real behavior from an email, a process tree, or a SIEM event and placing it on a technique ID you can defend. This independent study section works five high-frequency mappings, then covers how mapping helps reporting and detection coverage, the trap of forcing IDs without evidence, and a short pointer to the Cyber Kill Chain in the next chapter.
Worked mappings from artefacts to IDs
Each mapping below has a story, a best-fit ID, evidence that supports it, and evidence that is not enough. Steal that structure for case notes.
Phishing email → T1566
Story. A user reports a shared-voicemail message. The sender display name matches finance, the link goes to a look-alike domain, and the message asks the user to sign in.
Mapping. T1566 Phishing (Initial Access). If you later prove a specific delivery method, you can drop to a sub-technique such as T1566.001 (Spearphishing Attachment) or T1566.002 (Spearphishing Link). Do not jump to a sub-technique until the evidence does.
Evidence that supports T1566. Message headers, a malicious URL or attachment, user click telemetry, a credential prompt on a spoofed site, or a payload that launched after the email.
Evidence that is not enough. A single blocked spam message with no user interaction and no payload does not mean an intrusion technique happened on the endpoint. You can still label the email campaign as phishing; you should not claim Execution techniques until something ran.
Malicious macro or PowerShell → T1059
Story. After the click, Word launches, a macro calls powershell.exe with a remote download, and Sysmon shows a child process.
Mapping. T1059 Command and Scripting Interpreter . If the interpreter is PowerShell, T1059.001 is the honest sub-technique. A macro-enabled document is often discussed alongside Visual Basic execution and T1059.001 when VBA is only the launcher. Record both steps if both ran: VBA execution, then PowerShell execution. That is two execution techniques in sequence, which is normal.
Evidence that supports T1059. Process-creation logs that name powershell.exe , cmd.exe , wscript.exe , or bash ; script-block logging; a command line that downloads or decodes a payload.
Evidence that is not enough. "The file is a document" is not Execution. Office opening a file is not, by itself, T1059.
LSASS dump → T1003
Story. EDR flags a tool opening LSASS (Local Security Authority Subsystem Service) and writing a dump file, or comparable access to LSASS memory.
Mapping. T1003 OS Credential Dumping , commonly T1003.001 LSASS Memory when the target is LSASS.
Evidence that supports T1003. Process access to LSASS, a minidump of lsass.exe, subsequent use of stolen hashes or tickets, or tools used to dump credentials—still describe the behavior , not just a brand name.
Evidence that is not enough. A random alert that mentions credential in the title with no LSASS handle, no dump file, and no follow-on logon. Legitimate crash dumps and some security products touch LSASS. Correlate with unusual parent processes and whether a dump landed on disk.
This mapping is Credential Access , not Execution, even if PowerShell hosted the dumper. You may also have T1059 for the host process. Dual mapping is correct when two goals occurred.
Scheduled task persistence → T1053
Story. After access, a task appears in Windows Task Scheduler that runs a script at logon or every five minutes.
Mapping. T1053 Scheduled Task/Job , on Windows often T1053.005 Scheduled Task .
Evidence that supports T1053. Event logs for task creation (for example Task Scheduler operational events, or Security 4698 when configured), a new task definition, Sysmon file or registry events under Task Scheduler paths, or schtasks command lines.
Evidence that is not enough. A built-in Microsoft task that has existed for years. Persistence mapping requires a change you can tie to the incident timeline, or a task whose action is clearly malicious.
Persistence is the tactic because the goal is to stay. The same scheduled task might later be the Execution mechanism when it fires; you can note T1053 as persistence and T1059 as what the task runs.
C2 beacon → T1071
Story. The host makes regular HTTPS connections to a newly registered domain, with jittered intervals, an unusual client fingerprint, or a known C2 path.
Mapping. T1071 Application Layer Protocol , often T1071.001 Web Protocols when the channel is HTTP or HTTPS. Other C2 techniques exist. Pick T1071 when the beacon rides a common application protocol to blend in.
Evidence that supports T1071. Recurring connections, beacon cadence, known-bad infrastructure, proxy logs showing encoded bodies to odd URIs, or EDR network telemetry that matches a documented C2 pattern.
Evidence that is not enough. One HTTPS connection to a content-delivery network. The internet is mostly HTTPS. Beaconing is a pattern, not a single packet.
- Behavior in the ticket Best-fit technique Common sub-technique Tactic you are naming
- Phishing email, link, or lure T1566 T1566.001 / T1566.002 when proven Initial Access
- Malicious macro or PowerShell T1059 T1059.001 for PowerShell Execution
- LSASS dump T1003 T1003.001 LSASS Memory Credential Access
- Scheduled task to stay T1053 T1053.005 on Windows Persistence
- C2 beacon over HTTP/S T1071 T1071.001 Web Protocols Command and Control
- How mapping helps reporting and detection coverage
Putting IDs in a case is not bureaucracy. It does three jobs:
Reporting. A shift handoff that says T1566 then T1059.001 then T1003.001 is shorter and less ambiguous than a paragraph of nicknames. Managers and incident commanders can see the intrusion's shape.
Correlation. You can search prior tickets and threat intel for the same technique IDs even when the malware family name differed.
Detection coverage. After the incident, list the techniques you observed and ask which of them had a dedicated detection. If LSASS dumping was caught by EDR but scheduled-task creation was found only during hunting, you have a coverage gap on T1053. That is how ATT&CK becomes a SOC improvement tool, not wallpaper.
A lightweight coverage table after a case might look like this:
- Observed technique Caught by existing alert? Telemetry that proved it Gap to file
- T1566 Email gateway catch plus user report Headers, URL, click log Add click-to-ticket automation
- T1059.001 Yes, script-block alert Script-block / Sysmon process create Tune encoding false positives
- T1003.001 Yes, EDR LSASS access None
- T1053.005 No Hunt found task-creation events New scheduled-task-from-Office detection
- T1071.001 Partial proxy anomaly Beacon cadence Dedicated periodic-beacon hunt
- Trap: forcing every alert into a technique without evidence
New analysts sometimes treat ATT&CK like a form that cannot be submitted blank. That produces false precision : a noisy IDS signature becomes Impact / Data Encrypted for Impact because ransomware is scary, or a failed logon burst becomes Credential Access / Brute Force when it was a misconfigured service.
Rules that keep mapping honest:
No evidence, no technique ID. Unmapped / still investigating is a valid state.
Vendor display names are not IDs. Translate only after you understand the behavior.
One alert can support zero, one, or several techniques. Several is fine; invented is not.
If two techniques fit equally well, write both and explain why, or pick the one the evidence speaks to most loudly and note the alternative.
Do not map a blocked attempt as successful Impact. A blocked exploit is often Initial Access attempted, and your report should say attempted.
False precision hurts the next shift. Someone will hunt the wrong technique, tune the wrong detection, and brief leadership with a confidence the packet capture cannot support.
Brief pointer: ATT&CK versus the Cyber Kill Chain
The Cyber Kill Chain (Lockheed Martin) is a linear stage model of an intrusion, from reconnaissance through actions on objectives. ATT&CK is a matrix of many techniques under each goal, and it does not require the intrusion to visit stages in a fixed order. You will use both as vocabularies; they answer different questions. The next chapter, on the Cyber Kill Chain, is where that comparison belongs. For this chapter, keep one distinction: when a question asks for a technique ID , it is asking for ATT&CK, not for a Kill Chain stage name.
If you leave this section with a habit, make it this one: map the behavior you can prove, write the ID, and leave blank what you cannot yet defend.