Worked Example: Mapping a Real Intrusion to ATT&CK

Reading a CTI report and mapping it to ATT&CK is a core detection engineering skill. It turns a narrative — “the attacker did X then Y” — into a structured list of techniques you can build detections for.

This lesson walks through the process with a real intrusion. The DFIR Report published a Truebot analysis in 2023 that’s representative of how financially-motivated ransomware groups operate. We’ll map the key actions to ATT&CK, then build a Navigator layer.

The Process: Narrative → ATT&CK

The mapping process has four steps:

Extract actions — What did the adversary do? Use verbs: “executed,” “downloaded,” “moved laterally to,” “dumped credentials from.”
Identify the objective — What tactic does this serve? (Why did they do it?)
Find the technique — What method did they use?
Narrow to sub-technique — Is there a more specific variant?

Step 1: Read for Actions

From the Truebot intrusion, the key actions in the timeline:

- Phishing email with malicious .zip attachment received by user
- User opened attachment; Truebot DLL executed via regsvr32.exe
- PowerShell downloaded additional payload from C2
- Cobalt Strike beacon established persistent C2 channel
- Adversary ran net.exe commands to enumerate domain groups
- Adversary dumped LSASS process memory using ProcDump
- Adversary used SMB to move laterally to file server
- Clop ransomware deployed; files encrypted

Step 2 & 3: Map Actions to Techniques

Building the Navigator Layer

The full technique mapping for this intrusion:

Technique ID	Name	Tactic	Confidence
T1566.001	Spearphishing Attachment	Initial Access	High
T1218.010	Regsvr32	Defense Evasion	Medium
T1059.001	PowerShell	Execution	High
T1105	Ingress Tool Transfer	C2	Medium
T1055	Process Injection	Defense Evasion	Medium
T1007	System Service Discovery	Discovery	Low
T1087	Account Discovery	Discovery	Medium
T1003.001	LSASS Memory	Credential Access	High
T1021.002	SMB/Windows Admin Shares	Lateral Movement	Medium
T1486	Data Encrypted for Impact	Impact	Low

In Navigator, color these by your detection confidence:

Green (score 80–100): T1566.001, T1059.001, T1003.001
Yellow (score 40–79): T1218.010, T1105, T1087, T1021.002
Red (score 0–39): T1007, T1055, T1486

The resulting layer is a gap report for your detection program relative to this specific intrusion pattern.

Common Mapping Mistakes

Over-mapping to broad techniques. Don’t map every action to T1059 (all scripting). Find the specific sub-technique.
Missing dual-tactic techniques. A PowerShell download is both Execution (T1059.001) and C2 (T1105). Map both.
Confusing tool with technique. “They used Mimikatz” is a procedure. The technique is T1003.001. Map the technique, not the tool name.
Assigning high confidence without testing. “We have a rule for this” ≠ high confidence. High confidence requires the rule tested and firing.

The DFIR Report— DFIR Report blog — public incident post-mortems MITRE ATT&CK— MITRE ATT&CK Enterprise ATT&CK Navigator— MITRE ATT&CK