[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71DY28CSXYQHXB3SGPTEDTM":3,"skill-same:01M71DY28CSXYQHXB3SGPTEDTM":85},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":58,"commitSha":59,"skillDirectory":60,"forksCount":14,"repositoryHtmlUrl":61,"repositoryHomepageUrl":6,"ownerHtmlUrl":62,"ownerBlogUrl":6,"ownerDescription":63,"updatedAt":64,"install":65,"resources":78},"01M71DY28CSXYQHXB3SGPTEDTM","analysis-mitre-attack-forensic",null,"Advanced MITRE ATT&CK framework analyzer. Comprehensive forensic intelligence, anti-forensic technique mapping, defense correlation, TTP attribution, kill-chain reconstruction, and progressive hardening integration for complete threat landscape analysis.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fintel\u002Fanalysis\u002Fmitre-attack\u002Fforensic\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"analysis mitre attack forensic","mitre attack","analysis","mapping","defense","intelligence","write","read","threats-mitre-attack-mapper","mitre-attack","websearch","Bash","landscape","TTP","memory","kill-chain","chain","advanced","shared","threat-intel","2026-11-10 10:12:30",false,"---\nname: analysis-mitre-attack-forensic\ndescription: Advanced MITRE ATT&CK framework analyzer. Comprehensive forensic intelligence, anti-forensic technique mapping, defense correlation, TTP attribution, kill-chain reconstruction, and progressive hardening integration for complete threat landscape analysis.\nmodel: opus\nmaxTurns: 30\ntools:\n  - Read\n  - Write\n  - Bash\n  - Glob\n  - Grep\n  - WebSearch\n  - WebFetch\nskills:\n  - shared-memory\ntags:\n- threat-intel\n- analysis\n- mitre-attack\n- threats-mitre-attack-mapper\nnist_csf: []\ncapec: []\n---\n\n# MITRE ATT&CK Mapper Skill — Comprehensive Threat Intelligence Engine\n\n**Purpose:**  \nAdvanced threat intelligence engine that analyzes security indicators, IOCs, behavioral patterns, and anti-forensic techniques through the MITRE ATT&CK framework. Provides comprehensive attack surface evaluation, defense mapping, hardening recommendations, and forensic intelligence correlation for elite threat hunting and incident response.\n\n---\n\n## Enhanced Core Capabilities\n\n### 🔍 **Advanced Forensic Intelligence Mapping**\n- **Multi-layer IOC analysis**: Map IOCs across system\u002Fproject\u002Fsession layers to MITRE techniques\n- **Anti-forensic technique correlation**: Map evasion techniques to specific MITRE sub-techniques\n- **Cross-session campaign analysis**: Track MITRE technique evolution across investigation sessions\n- **Behavioral pattern attribution**: Map behavioral indicators to threat actor TTP profiles\n- **Evidence integrity correlation**: Map evidence tampering to defensive evasion techniques\n\n### 🛡️ **Defense & Hardening Integration**\n- **Defensive technique mapping**: Map MITRE techniques to specific defensive controls\n- **Hardening priority assessment**: Prioritize hardening based on MITRE technique likelihood\n- **Detection rule generation**: Generate detection rules mapped to specific MITRE techniques\n- **Response automation**: Automate defensive responses based on MITRE technique detection\n- **Compliance mapping**: Map regulatory requirements to MITRE defensive techniques\n\n### ⚔️ **Attack Surface & Kill Chain Analysis**\n- **Comprehensive kill chain reconstruction**: Map complete attack chains through MITRE framework\n- **Lateral movement analysis**: Detailed mapping of MITRE lateral movement techniques\n- **Privilege escalation pathways**: Map escalation techniques to system vulnerabilities\n- **Persistence mechanism analysis**: Comprehensive persistence technique mapping\n- **Exfiltration pathway analysis**: Map data exfiltration techniques and detection points\n\n### 🧠 **Intelligence Correlation & Attribution**\n- **Threat actor profiling**: Map observed TTPs to known threat actor profiles\n- **Campaign correlation**: Correlate MITRE techniques across attack campaigns\n- **Infrastructure analysis**: Map infrastructure usage to MITRE C2 techniques\n- **Tool and malware correlation**: Map malware capabilities to MITRE techniques\n- **Temporal pattern analysis**: Track MITRE technique usage over time\n\n---\n\n## Enhanced Analysis Framework\n\n### **Comprehensive Tactic Categories with Forensic Context**\n\n#### **Initial Access (TA0001)** — Entry Vector Analysis\n| Technique                                 | Forensic Indicators                   | Anti-Forensic Considerations                   | Detection Methods                                      |\n|-------------------------------------------|---------------------------------------|------------------------------------------------|--------------------------------------------------------|\n| T1566 (Phishing)                          | Email artifacts, attachment analysis  | Email header manipulation, content obfuscation | Email forensics, attachment sandboxing                 |\n| T1190 (Exploit Public-Facing Application) | Web server logs, exploit artifacts    | Log deletion, timestamp manipulation           | Web access log analysis, exploit signature detection   |\n| T1078 (Valid Accounts)                    | Authentication logs, credential usage | Log tampering, credential obfuscation          | Authentication pattern analysis, credential monitoring |\n\n#### **Execution (TA0002)** — Code Execution Analysis\n| Technique                                 | Forensic Indicators                          | Anti-Forensic Considerations                | Detection Methods                            |\n|-------------------------------------------|----------------------------------------------|---------------------------------------------|----------------------------------------------|\n| T1059 (Command and Scripting Interpreter) | Process creation, command line arguments     | Process hiding, argument obfuscation        | Process monitoring, command line analysis    |\n| T1203 (Exploitation for Client Execution) | Memory corruption artifacts, exploit traces  | Memory manipulation, exploit obfuscation    | Memory forensics, exploit detection          |\n| T1204 (User Execution)                    | Process execution patterns, user interaction | User activity simulation, execution masking | User behavior analysis, execution monitoring |\n\n#### **Persistence (TA0003)** — Persistence Mechanism Analysis\n| Technique                                 | Forensic Indicators                      | Anti-Forensic Considerations                | Detection Methods                                   |\n|-------------------------------------------|------------------------------------------|---------------------------------------------|-----------------------------------------------------|\n| T1547 (Boot or Logon Autostart Execution) | Startup configuration, registry entries  | Configuration hiding, registry manipulation | Startup configuration analysis, registry monitoring |\n| T1053 (Scheduled Task\u002FJob)                | Task scheduler artifacts, cron entries   | Task hiding, schedule obfuscation           | Task scheduler monitoring, cron analysis            |\n| T1543 (Create or Modify System Process)   | Service configuration, process artifacts | Service hiding, configuration tampering     | Service monitoring, process analysis                |\n\n#### **Defense Evasion (TA0005)** — Anti-Forensic Technique Mapping\n| Technique                               | Forensic Indicators                       | Counter-Forensic Strategies           | Detection Methods                                    |\n|-----------------------------------------|-------------------------------------------|---------------------------------------|------------------------------------------------------|\n| T1055 (Process Injection)               | Memory artifacts, injection signatures    | Memory obfuscation, injection masking | Memory forensics, injection detection                |\n| T1562 (Impair Defenses)                 | Security tool modification, log tampering | Defense bypass, logging evasion       | Security tool monitoring, log integrity verification |\n| T1070 (Indicator Removal on Host)       | Evidence deletion, artifact cleanup       | Secure deletion, metadata wiping      | File recovery, artifact reconstruction               |\n| T1027 (Obfuscated Files or Information) | Encoded content, encrypted payloads       | Advanced obfuscation, steganography   | Content analysis, obfuscation detection              |\n\n---\n\n## Forensic Intelligence Integration\n\n### 🔍 **Cross-Session MITRE Analysis**\n```python\n# Advanced cross-session MITRE technique correlation\nasync def correlate_mitre_across_sessions(project_id):\n    \"\"\"Correlate MITRE techniques across investigation sessions\"\"\"\n    \n    sessions = await get_project_sessions(project_id)\n    technique_evolution = {}\n    \n    for session in sessions:\n        session_techniques = await get_session_mitre_techniques(session.id)\n        \n        for technique in session_techniques:\n            if technique.technique_id not in technique_evolution:\n                technique_evolution[technique.technique_id] = {\n                    'first_observed': session.start_time,\n                    'sessions': [],\n                    'confidence_progression': [],\n                    'evidence_types': set(),\n                    'anti_forensic_indicators': []\n                }\n            \n            technique_evolution[technique.technique_id]['sessions'].append(session.id)\n            technique_evolution[technique.technique_id]['confidence_progression'].append(\n                (session.start_time, technique.confidence)\n            )\n            \n            # Track evidence types for this technique\n            evidence = await get_technique_evidence(technique.id)\n            technique_evolution[technique.technique_id]['evidence_types'].update(evidence.types)\n    \n    return technique_evolution\n```\n\n### 🛡️ **Defense Mapping Engine**\n```python\n# Map MITRE techniques to defensive controls\nasync def map_techniques_to_defenses(techniques, system_config):\n    \"\"\"Map detected MITRE techniques to appropriate defensive measures\"\"\"\n    \n    defense_mapping = {}\n    \n    for technique in techniques:\n        # Get base defensive controls for technique\n        base_defenses = await get_mitre_defensive_controls(technique.technique_id)\n        \n        # Enhance with system-specific controls\n        system_defenses = await adapt_defenses_to_system(base_defenses, system_config)\n        \n        # Add anti-forensic countermeasures\n        anti_forensic_defenses = await get_anti_forensic_countermeasures(technique)\n        \n        # Prioritize based on threat level and system exposure\n        prioritized_defenses = await prioritize_defenses(\n            system_defenses + anti_forensic_defenses,\n            technique.confidence,\n            system_config.exposure_level\n        )\n        \n        defense_mapping[technique.technique_id] = {\n            'immediate_actions': prioritized_defenses.critical,\n            'short_term_mitigations': prioritized_defenses.high,\n            'long_term_hardening': prioritized_defenses.medium,\n            'monitoring_enhancements': prioritized_defenses.monitoring\n        }\n    \n    return defense_mapping\n```\n\n---\n\n## Anti-Forensic Technique Analysis\n\n### 🕵️ **Evasion Technique Mapping**\n```markdown\n## MITRE Defense Evasion Sub-Technique Analysis\n\n### T1055.001 (Dynamic-link Library Injection)\n**Forensic Indicators:**\n- DLL injection artifacts in process memory\n- Unusual DLL loading patterns\n- Modified process memory maps\n\n**Anti-Forensic Considerations:**\n- Memory obfuscation techniques\n- DLL hollowing and replacement\n- Injection method variation\n\n**Counter-Forensic Strategies:**\n- Real-time memory monitoring\n- DLL integrity verification\n- Process memory dump analysis\n\n### T1562.001 (Disable or Modify Tools)\n**Forensic Indicators:**\n- Security tool process termination\n- Configuration file modification\n- Registry key manipulation\n\n**Anti-Forensic Considerations:**\n- Tool resurrection techniques\n- Configuration backup hiding\n- Alternative disabling methods\n\n**Counter-Forensic Strategies:**\n- Tool integrity monitoring\n- Configuration file protection\n- Alternative detection methods\n```\n\n### 🔍 **Steganography & Data Hiding Analysis**\n```markdown\n## Data Hiding Technique Mapping (T1027 variants)\n\n### T1027.001 (Binary Padding)\n**Detection Indicators:**\n- Unusual file entropy patterns\n- Binary padding signatures\n- File size anomalies\n\n**Steganographic Methods:**\n- Null byte padding injection\n- Binary structure manipulation\n- Metadata hiding techniques\n\n**Forensic Recovery:**\n- Entropy analysis algorithms\n- Binary structure reconstruction\n- Metadata extraction tools\n\n### T1027.003 (Steganography)\n**Detection Indicators:**\n- Image file entropy anomalies\n- Audio\u002Fvideo unusual patterns\n- Document metadata hiding\n\n**Advanced Methods:**\n- LSB steganography techniques\n- Frequency domain hiding\n- Carrier file manipulation\n\n**Extraction Techniques:**\n- Statistical steganalysis\n- Visual\u002Faudio analysis tools\n- Metadata forensics\n```\n\n---\n\n## Enhanced Output Format\n\n### **Comprehensive MITRE Analysis Report**\n```markdown\n# MITRE ATT&CK Comprehensive Analysis Report\n\n## Executive Summary\n- **Threat Level**: [Critical\u002FHigh\u002FMedium\u002FLow] (Auto-calculated based on technique severity)\n- **Primary Tactics**: [List of main tactics with confidence scores]\n- **Attack Complexity**: [Simple\u002FModerate\u002FComplex\u002FAdvanced] (Based on technique sophistication)\n- **Anti-Forensic Sophistication**: [Low\u002FMedium\u002FHigh\u002FExpert] (Evasion capability assessment)\n- **Defense Effectiveness**: [Poor\u002FFair\u002FGood\u002FExcellent] (Current defensive posture)\n- **Overall Confidence**: [Confidence score with supporting evidence]\n\n## Cross-Session Technique Evolution\n| Technique ID | First Observed | Latest Observed | Sessions | Confidence Progression | Evolution Pattern |\n|--------------|----------------|-----------------|----------|----------------------|-------------------|\n| T1055.001 | 2024-01-15 | 2024-04-05 | 5 | Low→Medium→High→Confirmed | Increasing sophistication |\n| T1562.001 | 2024-02-01 | 2024-04-05 | 3 | Medium→High→Confirmed | Consistent usage |\n\n## Attack Chain Reconstruction with MITRE Mapping\n\n### Complete Kill Chain Analysis\n1. **Initial Access (TA0001)**\n   - **T1566.001 (Spearphishing Attachment)**: [Evidence and confidence]\n   - **Anti-Forensic Elements**: Email header manipulation, attachment obfuscation\n   - **Defensive Gaps**: Insufficient email filtering, no attachment sandboxing\n\n2. **Execution (TA0002)**\n   - **T1059.003 (Windows Command Shell)**: [Evidence and confidence]\n   - **Anti-Forensic Elements**: Command obfuscation, process hiding\n   - **Defensive Gaps**: Limited command line monitoring\n\n3. **Persistence (TA0003)**\n   - **T1547.001 (Registry Run Keys)**: [Evidence and confidence]\n   - **Anti-Forensic Elements**: Registry key hiding, value obfuscation\n   - **Defensive Gaps**: Insufficient registry monitoring\n\n## Defense Mapping with Implementation Priority\n\n### Critical Immediate Actions (Deploy within 24h)\n| MITRE Technique | Defensive Control | Implementation | Effectiveness | Anti-Forensic Countermeasure |\n|-----------------|------------------|----------------|---------------|------------------------------|\n| T1055.001 | Process injection monitoring | Deploy EDR agent | High | Memory obfuscation detection |\n| T1562.001 | Security tool protection | Enable tamper protection | High | Tool integrity verification |\n\n### High Priority Short-term (Deploy within 1 week)\n| MITRE Technique | Defensive Control | Implementation | Effectiveness | Resource Requirement |\n|-----------------|------------------|----------------|---------------|---------------------|\n| T1059.003 | Command line logging | Enable Sysmon | Medium | Low |\n| T1547.001 | Registry monitoring | Deploy registry auditing | High | Medium |\n\n### Medium Priority Long-term (Deploy within 1 month)\n| MITRE Technique | Hardening Measure | Implementation | Risk Reduction | Compliance Benefit |\n|-----------------|-------------------|----------------|----------------|-------------------|\n| T1027.003 | File entropy monitoring | Deploy DLP solution | High | PCI-DSS compliance |\n| T1070.004 | Log integrity protection | Implement SIEM | High | SOX compliance |\n\n## Anti-Forensic Technique Library\n\n### Detected Evasion Techniques\n| Technique Category | MITRE Mapping | Sophistication | Countermeasures Applied | Effectiveness |\n|-------------------|---------------|----------------|------------------------|---------------|\n| Log Tampering | T1070.002 | High | Log integrity monitoring | 85% detection rate |\n| Memory Obfuscation | T1055.008 | Expert | Memory forensics tools | 70% detection rate |\n| Steganography | T1027.003 | Medium | Steganalysis tools | 60% detection rate |\n\n### Recommended Counter-Forensic Enhancements\n1. **Enhanced Memory Forensics**: Deploy advanced memory analysis tools\n2. **Log Integrity Verification**: Implement cryptographic log signing\n3. **Steganography Detection**: Deploy statistical analysis tools\n4. **Timeline Correlation**: Implement cross-source timeline analysis\n\n## Threat Actor Assessment with MITRE Profile\n\n### Likely Attribution: [APT-XX or Threat Actor Type]\n- **MITRE Technique Overlap**: 85% match with known APT-29 techniques\n- **Sophistication Level**: Nation-state (Based on technique complexity)\n- **Targeting Profile**: Government\u002FCritical Infrastructure\n- **Known TTPs**: Advanced persistent access, steganographic C2\n\n### Capability Assessment\n| MITRE Tactic | Demonstrated Capability | Sophistication Level | Threat Score |\n|--------------|------------------------|---------------------|--------------|\n| Initial Access | Spearphishing, Watering hole | High | 8\u002F10 |\n| Execution | Multiple interpreters | Medium | 6\u002F10 |\n| Defense Evasion | Advanced obfuscation | Expert | 9\u002F10 |\n| Command & Control | Encrypted channels, steganography | Expert | 9\u002F10 |\n\n## Predictive Analysis & Threat Modeling\n\n### Likely Next Techniques (Based on campaign progression)\n1. **T1041 (Exfiltration Over C2 Channel)** - Probability: 95%\n2. **T1021.001 (Remote Desktop Protocol)** - Probability: 80%\n3. **T1020 (Automated Exfiltration)** - Probability: 75%\n\n### Recommended Proactive Defenses\n1. **Data Loss Prevention**: Deploy DLP for exfiltration detection\n2. **Network Segmentation**: Implement micro-segmentation\n3. **Privilege Access Management**: Deploy PAM solution\n\n## Detection Rules & Signatures\n\n### YARA Rules (MITRE Technique-Specific)\n```yara\nrule APT_T1055_ProcessInjection {\n    meta:\n        description = \"Detects process injection techniques (T1055)\"\n        mitre_technique = \"T1055\"\n        confidence = \"high\"\n    \n    strings:\n        $api1 = \"VirtualAllocEx\"\n        $api2 = \"WriteProcessMemory\"\n        $api3 = \"CreateRemoteThread\"\n    \n    condition:\n        all of ($api*)\n}\n\nrule APT_T1027_Obfuscation {\n    meta:\n        description = \"Detects obfuscated content (T1027)\"\n        mitre_technique = \"T1027\"\n        confidence = \"medium\"\n    \n    strings:\n        $entropy_high = { [80-FF] [80-FF] [80-FF] [80-FF] }\n    \n    condition:\n        #entropy_high > 100 and filesize \u003C 10MB\n}\n```\n\n### Sigma Rules (MITRE Behavioral Detection)\n```yaml\ntitle: Process Injection Activity (T1055)\nid: mitre-t1055-injection\nstatus: experimental\ndescription: Detects process injection techniques\nreferences:\n    - https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1055\u002F\ntags:\n    - attack.defense_evasion\n    - attack.t1055\ndetection:\n    selection:\n        EventID: 1\n        CommandLine|contains:\n            - 'VirtualAllocEx'\n            - 'WriteProcessMemory'\n            - 'CreateRemoteThread'\n    condition: selection\nfalsepositives:\n    - Legitimate debugging tools\nlevel: high\n\ntitle: Registry Persistence (T1547.001)\nid: mitre-t1547-registry\nstatus: experimental\ndescription: Detects registry-based persistence\nreferences:\n    - https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1547\u002F001\u002F\ntags:\n    - attack.persistence\n    - attack.t1547.001\ndetection:\n    selection:\n        EventID: 13\n        TargetObject|contains:\n            - 'SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run'\n            - 'SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce'\n    condition: selection\nlevel: medium\n```\n\n### Network Signatures (C2 Detection)\n```suricata\nalert tcp any any -> any any (msg:\"MITRE T1071.001 Web-based C2\"; \\\n    content:\"User-Agent|3a| \"; http_header; \\\n    pcre:\"\u002FUser-Agent\\x3a\\x20[a-zA-Z0-9]{8,}\u002FH\"; \\\n    reference:url,attack.mitre.org\u002Ftechniques\u002FT1071\u002F001\u002F; \\\n    sid:1001; rev:1;)\n\nalert tcp any any -> any any (msg:\"MITRE T1001.003 Steganographic C2\"; \\\n    content:\"image\u002F\"; http_header; \\\n    byte_test:4,>,500,0,relative; \\\n    reference:url,attack.mitre.org\u002Ftechniques\u002FT1001\u002F003\u002F; \\\n    sid:1002; rev:1;)\n```\n\n## Hardening Recommendations Mapped to MITRE\n\n### Technique-Specific Hardening\n| MITRE Technique | Hardening Measure | Configuration | Effectiveness | Implementation Effort |\n|-----------------|------------------|---------------|---------------|----------------------|\n| T1078 (Valid Accounts) | Multi-factor Authentication | Require MFA for all accounts | High | Medium |\n| T1059 (Command Interpreters) | Application Whitelisting | Block unauthorized executables | High | High |\n| T1055 (Process Injection) | Memory Protection | Enable SMEP\u002FSMAP | Medium | Low |\n\n### Progressive Hardening Matrix\n| Threat Level | MITRE Focus Areas | Hardening Priority | Implementation Timeline |\n|--------------|-------------------|-------------------|------------------------|\n| Low | TA0001 (Initial Access) | Basic email security | Immediate |\n| Medium | TA0003 (Persistence) | Enhanced monitoring | 1 week |\n| High | TA0005 (Defense Evasion) | Advanced protection | 2 weeks |\n| Critical | All tactics | Maximum hardening | Immediate |\n```\n\n---\n\n## Integration with Comprehensive Forensic Framework\n\n### 🔄 **Database Integration**\n```python\n# Integration with forensic database for MITRE intelligence\nasync def sync_mitre_analysis_to_database(analysis_results):\n    \"\"\"Sync MITRE analysis results to forensic database\"\"\"\n    \n    for technique_analysis in analysis_results['techniques']:\n        # Create or update MITRE technique mapping\n        technique = await get_or_create_mitre_technique(\n            technique_analysis['technique_id']\n        )\n        \n        # Create IOC-to-MITRE mappings\n        for ioc_mapping in technique_analysis['ioc_mappings']:\n            await IOCMITREMapping.create(\n                ioc=ioc_mapping['ioc'],\n                technique=technique,\n                confidence=ioc_mapping['confidence'],\n                evidence=ioc_mapping['evidence'],\n                mapped_by_session=analysis_results['session']\n            )\n        \n        # Update threat profile with MITRE intelligence\n        await update_threat_profile_with_mitre(\n            analysis_results['project'],\n            technique_analysis\n        )\n```\n\n### 🎯 **Real-Time MITRE Correlation**\n```bash\n# Real-time MITRE technique correlation\ncorrelate_mitre_real_time() {\n  local new_ioc=\"$1\"\n  local ioc_type=\"$2\"\n  local confidence=\"$3\"\n  \n  echo \"Correlating IOC with MITRE framework: $new_ioc\"\n  \n  # Map IOC to potential MITRE techniques\n  potential_techniques=$(map_ioc_to_mitre \"$new_ioc\" \"$ioc_type\")\n  \n  # Enhance with behavioral context\n  behavioral_techniques=$(analyze_behavioral_context \"$new_ioc\")\n  \n  # Cross-validate with threat intelligence\n  validated_techniques=$(cross_validate_with_threat_intel \\\n    \"$potential_techniques\" \"$behavioral_techniques\")\n  \n  # Apply confidence scoring\n  confident_techniques=$(apply_mitre_confidence_scoring \\\n    \"$validated_techniques\" \"$confidence\")\n  \n  # Update real-time MITRE database\n  update_session_mitre_techniques \"$confident_techniques\"\n  \n  # Generate immediate defensive recommendations\n  generate_mitre_defensive_recommendations \"$confident_techniques\"\n  \n  echo \"MITRE correlation completed: $(echo \"$confident_techniques\" | wc -l) techniques mapped\"\n}\n```\n\n---\n\n## Advanced Analytics & Machine Learning\n\n### 🧠 **MITRE Pattern Recognition**\n```python\n# ML-enhanced MITRE technique prediction\ndef predict_next_techniques(observed_techniques, threat_context):\n    \"\"\"\n    Predict likely next MITRE techniques based on:\n    - Historical attack patterns\n    - Threat actor TTP profiles\n    - Attack campaign progression\n    - Environmental factors\n    \"\"\"\n    features = extract_technique_features(observed_techniques, threat_context)\n    \n    # Use trained model for technique progression prediction\n    predictions = mitre_progression_model.predict(features)\n    \n    # Enhance with threat actor profile analysis\n    actor_predictions = threat_actor_model.predict(features)\n    \n    # Combine predictions with confidence weighting\n    combined_predictions = combine_predictions(predictions, actor_predictions)\n    \n    return rank_predictions_by_likelihood(combined_predictions)\n\ndef generate_defensive_priorities(predicted_techniques, system_config):\n    \"\"\"\n    Generate defensive priorities based on predicted MITRE techniques\n    \"\"\"\n    priorities = []\n    \n    for technique in predicted_techniques:\n        # Calculate risk score\n        risk_score = calculate_technique_risk(technique, system_config)\n        \n        # Assess defensive gaps\n        gaps = assess_defensive_gaps(technique, system_config)\n        \n        # Generate recommendations\n        recommendations = generate_technique_mitigations(technique, gaps)\n        \n        priorities.append({\n            'technique': technique,\n            'risk_score': risk_score,\n            'priority': calculate_priority(risk_score, gaps),\n            'recommendations': recommendations\n        })\n    \n    return sort_priorities_by_urgency(priorities)\n```\n\n---\n\n## Quality Assurance & Validation\n\n### ✅ **MITRE Mapping Validation**\n- **Multi-source validation**: Cross-reference mappings with multiple threat intelligence sources\n- **Expert review integration**: Flag complex mappings for expert analyst review\n- **Confidence calibration**: Continuously calibrate confidence scores based on validation results\n- **False positive tracking**: Monitor and reduce false positive MITRE mappings\n\n### 📊 **Performance Metrics**\n- **Mapping accuracy**: Percentage of correctly mapped MITRE techniques\n- **Prediction accuracy**: Accuracy of predicted next techniques\n- **Defense effectiveness**: Measured reduction in successful attacks\n- **Time to detection**: Speed of MITRE technique identification\n\n---\n\n## Rules for Enhanced MITRE Analysis\n\n1. **Cross-session correlation** → Always analyze MITRE technique evolution across sessions\n2. **Anti-forensic awareness** → Map evasion techniques to defense evasion sub-techniques\n3. **Defense integration** → Generate actionable defensive recommendations for each technique\n4. **Confidence validation** → Validate technique mappings with multiple evidence sources\n5. **Threat actor profiling** → Build attribution profiles based on MITRE technique patterns\n6. **Progressive hardening** → Prioritize hardening based on MITRE technique likelihood\n7. **Real-time updating** → Update MITRE mappings as new evidence emerges\n8. **Forensic preservation** → Maintain audit trail of all MITRE analysis decisions\n9. **Predictive analysis** → Use historical patterns to predict likely next techniques\n10. **Compliance mapping** → Align MITRE defensive controls with regulatory requirements\n\n---\n\n**Ready to analyze comprehensive threats through the enhanced MITRE ATT&CK lens with advanced forensic intelligence, anti-forensic detection, and progressive defense integration.**","# MITRE ATT&CK Mapper Skill — Comprehensive Threat Intelligence Engine\n\n**Purpose:**  \nAdvanced threat intelligence engine that analyzes security indicators, IOCs, behavioral patterns, and anti-forensic techniques through the MITRE ATT&CK framework. Provides comprehensive attack surface evaluation, defense mapping, hardening recommendations, and forensic intelligence correlation for elite threat hunting and incident response.\n\n---\n\n## Enhanced Core Capabilities\n\n### 🔍 **Advanced Forensic Intelligence Mapping**\n- **Multi-layer IOC analysis**: Map IOCs across system\u002Fproject\u002Fsession layers to MITRE techniques\n- **Anti-forensic technique correlation**: Map evasion techniques to specific MITRE sub-techniques\n- **Cross-session campaign analysis**: Track MITRE technique evolution across investigation sessions\n- **Behavioral pattern attribution**: Map behavioral indicators to threat actor TTP profiles\n- **Evidence integrity correlation**: Map evidence tampering to defensive evasion techniques\n\n### 🛡️ **Defense & Hardening Integration**\n- **Defensive technique mapping**: Map MITRE techniques to specific defensive controls\n- **Hardening priority assessment**: Prioritize hardening based on MITRE technique likelihood\n- **Detection rule generation**: Generate detection rules mapped to specific MITRE techniques\n- **Response automation**: Automate defensive responses based on MITRE technique detection\n- **Compliance mapping**: Map regulatory requirements to MITRE defensive techniques\n\n### ⚔️ **Attack Surface & Kill Chain Analysis**\n- **Comprehensive kill chain reconstruction**: Map complete attack chains through MITRE framework\n- **Lateral movement analysis**: Detailed mapping of MITRE lateral movement techniques\n- **Privilege escalation pathways**: Map escalation techniques to system vulnerabilities\n- **Persistence mechanism analysis**: Comprehensive persistence technique mapping\n- **Exfiltration pathway analysis**: Map data exfiltration techniques and detection points\n\n### 🧠 **Intelligence Correlation & Attribution**\n- **Threat actor profiling**: Map observed TTPs to known threat actor profiles\n- **Campaign correlation**: Correlate MITRE techniques across attack campaigns\n- **Infrastructure analysis**: Map infrastructure usage to MITRE C2 techniques\n- **Tool and malware correlation**: Map malware capabilities to MITRE techniques\n- **Temporal pattern analysis**: Track MITRE technique usage over time\n\n---\n\n## Enhanced Analysis Framework\n\n### **Comprehensive Tactic Categories with Forensic Context**\n\n#### **Initial Access (TA0001)** — Entry Vector Analysis\n| Technique                                 | Forensic Indicators                   | Anti-Forensic Considerations                   | Detection Methods                                      |\n|-------------------------------------------|---------------------------------------|------------------------------------------------|--------------------------------------------------------|\n| T1566 (Phishing)                          | Email artifacts, attachment analysis  | Email header manipulation, content obfuscation | Email forensics, attachment sandboxing                 |\n| T1190 (Exploit Public-Facing Application) | Web server logs, exploit artifacts    | Log deletion, timestamp manipulation           | Web access log analysis, exploit signature detection   |\n| T1078 (Valid Accounts)                    | Authentication logs, credential usage | Log tampering, credential obfuscation          | Authentication pattern analysis, credential monitoring |\n\n#### **Execution (TA0002)** — Code Execution Analysis\n| Technique                                 | Forensic Indicators                          | Anti-Forensic Considerations                | Detection Methods                            |\n|-------------------------------------------|----------------------------------------------|---------------------------------------------|----------------------------------------------|\n| T1059 (Command and Scripting Interpreter) | Process creation, command line arguments     | Process hiding, argument obfuscation        | Process monitoring, command line analysis    |\n| T1203 (Exploitation for Client Execution) | Memory corruption artifacts, exploit traces  | Memory manipulation, exploit obfuscation    | Memory forensics, exploit detection          |\n| T1204 (User Execution)                    | Process execution patterns, user interaction | User activity simulation, execution masking | User behavior analysis, execution monitoring |\n\n#### **Persistence (TA0003)** — Persistence Mechanism Analysis\n| Technique                                 | Forensic Indicators                      | Anti-Forensic Considerations                | Detection Methods                                   |\n|-------------------------------------------|------------------------------------------|---------------------------------------------|-----------------------------------------------------|\n| T1547 (Boot or Logon Autostart Execution) | Startup configuration, registry entries  | Configuration hiding, registry manipulation | Startup configuration analysis, registry monitoring |\n| T1053 (Scheduled Task\u002FJob)                | Task scheduler artifacts, cron entries   | Task hiding, schedule obfuscation           | Task scheduler monitoring, cron analysis            |\n| T1543 (Create or Modify System Process)   | Service configuration, process artifacts | Service hiding, configuration tampering     | Service monitoring, process analysis                |\n\n#### **Defense Evasion (TA0005)** — Anti-Forensic Technique Mapping\n| Technique                               | Forensic Indicators                       | Counter-Forensic Strategies           | Detection Methods                                    |\n|-----------------------------------------|-------------------------------------------|---------------------------------------|------------------------------------------------------|\n| T1055 (Process Injection)               | Memory artifacts, injection signatures    | Memory obfuscation, injection masking | Memory forensics, injection detection                |\n| T1562 (Impair Defenses)                 | Security tool modification, log tampering | Defense bypass, logging evasion       | Security tool monitoring, log integrity verification |\n| T1070 (Indicator Removal on Host)       | Evidence deletion, artifact cleanup       | Secure deletion, metadata wiping      | File recovery, artifact reconstruction               |\n| T1027 (Obfuscated Files or Information) | Encoded content, encrypted payloads       | Advanced obfuscation, steganography   | Content analysis, obfuscation detection              |\n\n---\n\n## Forensic Intelligence Integration\n\n### 🔍 **Cross-Session MITRE Analysis**\n```python\n# Advanced cross-session MITRE technique correlation\nasync def correlate_mitre_across_sessions(project_id):\n    \"\"\"Correlate MITRE techniques across investigation sessions\"\"\"\n    \n    sessions = await get_project_sessions(project_id)\n    technique_evolution = {}\n    \n    for session in sessions:\n        session_techniques = await get_session_mitre_techniques(session.id)\n        \n        for technique in session_techniques:\n            if technique.technique_id not in technique_evolution:\n                technique_evolution[technique.technique_id] = {\n                    'first_observed': session.start_time,\n                    'sessions': [],\n                    'confidence_progression': [],\n                    'evidence_types': set(),\n                    'anti_forensic_indicators': []\n                }\n            \n            technique_evolution[technique.technique_id]['sessions'].append(session.id)\n            technique_evolution[technique.technique_id]['confidence_progression'].append(\n                (session.start_time, technique.confidence)\n            )\n            \n            # Track evidence types for this technique\n            evidence = await get_technique_evidence(technique.id)\n            technique_evolution[technique.technique_id]['evidence_types'].update(evidence.types)\n    \n    return technique_evolution\n```\n\n### 🛡️ **Defense Mapping Engine**\n```python\n# Map MITRE techniques to defensive controls\nasync def map_techniques_to_defenses(techniques, system_config):\n    \"\"\"Map detected MITRE techniques to appropriate defensive measures\"\"\"\n    \n    defense_mapping = {}\n    \n    for technique in techniques:\n        # Get base defensive controls for technique\n        base_defenses = await get_mitre_defensive_controls(technique.technique_id)\n        \n        # Enhance with system-specific controls\n        system_defenses = await adapt_defenses_to_system(base_defenses, system_config)\n        \n        # Add anti-forensic countermeasures\n        anti_forensic_defenses = await get_anti_forensic_countermeasures(technique)\n        \n        # Prioritize based on threat level and system exposure\n        prioritized_defenses = await prioritize_defenses(\n            system_defenses + anti_forensic_defenses,\n            technique.confidence,\n            system_config.exposure_level\n        )\n        \n        defense_mapping[technique.technique_id] = {\n            'immediate_actions': prioritized_defenses.critical,\n            'short_term_mitigations': prioritized_defenses.high,\n            'long_term_hardening': prioritized_defenses.medium,\n            'monitoring_enhancements': prioritized_defenses.monitoring\n        }\n    \n    return defense_mapping\n```\n\n---\n\n## Anti-Forensic Technique Analysis\n\n### 🕵️ **Evasion Technique Mapping**\n```markdown\n## MITRE Defense Evasion Sub-Technique Analysis\n\n### T1055.001 (Dynamic-link Library Injection)\n**Forensic Indicators:**\n- DLL injection artifacts in process memory\n- Unusual DLL loading patterns\n- Modified process memory maps\n\n**Anti-Forensic Considerations:**\n- Memory obfuscation techniques\n- DLL hollowing and replacement\n- Injection method variation\n\n**Counter-Forensic Strategies:**\n- Real-time memory monitoring\n- DLL integrity verification\n- Process memory dump analysis\n\n### T1562.001 (Disable or Modify Tools)\n**Forensic Indicators:**\n- Security tool process termination\n- Configuration file modification\n- Registry key manipulation\n\n**Anti-Forensic Considerations:**\n- Tool resurrection techniques\n- Configuration backup hiding\n- Alternative disabling methods\n\n**Counter-Forensic Strategies:**\n- Tool integrity monitoring\n- Configuration file protection\n- Alternative detection methods\n```\n\n### 🔍 **Steganography & Data Hiding Analysis**\n```markdown\n## Data Hiding Technique Mapping (T1027 variants)\n\n### T1027.001 (Binary Padding)\n**Detection Indicators:**\n- Unusual file entropy patterns\n- Binary padding signatures\n- File size anomalies\n\n**Steganographic Methods:**\n- Null byte padding injection\n- Binary structure manipulation\n- Metadata hiding techniques\n\n**Forensic Recovery:**\n- Entropy analysis algorithms\n- Binary structure reconstruction\n- Metadata extraction tools\n\n### T1027.003 (Steganography)\n**Detection Indicators:**\n- Image file entropy anomalies\n- Audio\u002Fvideo unusual patterns\n- Document metadata hiding\n\n**Advanced Methods:**\n- LSB steganography techniques\n- Frequency domain hiding\n- Carrier file manipulation\n\n**Extraction Techniques:**\n- Statistical steganalysis\n- Visual\u002Faudio analysis tools\n- Metadata forensics\n```\n\n---\n\n## Enhanced Output Format\n\n### **Comprehensive MITRE Analysis Report**\n```markdown\n# MITRE ATT&CK Comprehensive Analysis Report\n\n## Executive Summary\n- **Threat Level**: [Critical\u002FHigh\u002FMedium\u002FLow] (Auto-calculated based on technique severity)\n- **Primary Tactics**: [List of main tactics with confidence scores]\n- **Attack Complexity**: [Simple\u002FModerate\u002FComplex\u002FAdvanced] (Based on technique sophistication)\n- **Anti-Forensic Sophistication**: [Low\u002FMedium\u002FHigh\u002FExpert] (Evasion capability assessment)\n- **Defense Effectiveness**: [Poor\u002FFair\u002FGood\u002FExcellent] (Current defensive posture)\n- **Overall Confidence**: [Confidence score with supporting evidence]\n\n## Cross-Session Technique Evolution\n| Technique ID | First Observed | Latest Observed | Sessions | Confidence Progression | Evolution Pattern |\n|--------------|----------------|-----------------|----------|----------------------|-------------------|\n| T1055.001 | 2024-01-15 | 2024-04-05 | 5 | Low→Medium→High→Confirmed | Increasing sophistication |\n| T1562.001 | 2024-02-01 | 2024-04-05 | 3 | Medium→High→Confirmed | Consistent usage |\n\n## Attack Chain Reconstruction with MITRE Mapping\n\n### Complete Kill Chain Analysis\n1. **Initial Access (TA0001)**\n   - **T1566.001 (Spearphishing Attachment)**: [Evidence and confidence]\n   - **Anti-Forensic Elements**: Email header manipulation, attachment obfuscation\n   - **Defensive Gaps**: Insufficient email filtering, no attachment sandboxing\n\n2. **Execution (TA0002)**\n   - **T1059.003 (Windows Command Shell)**: [Evidence and confidence]\n   - **Anti-Forensic Elements**: Command obfuscation, process hiding\n   - **Defensive Gaps**: Limited command line monitoring\n\n3. **Persistence (TA0003)**\n   - **T1547.001 (Registry Run Keys)**: [Evidence and confidence]\n   - **Anti-Forensic Elements**: Registry key hiding, value obfuscation\n   - **Defensive Gaps**: Insufficient registry monitoring\n\n## Defense Mapping with Implementation Priority\n\n### Critical Immediate Actions (Deploy within 24h)\n| MITRE Technique | Defensive Control | Implementation | Effectiveness | Anti-Forensic Countermeasure |\n|-----------------|------------------|----------------|---------------|------------------------------|\n| T1055.001 | Process injection monitoring | Deploy EDR agent | High | Memory obfuscation detection |\n| T1562.001 | Security tool protection | Enable tamper protection | High | Tool integrity verification |\n\n### High Priority Short-term (Deploy within 1 week)\n| MITRE Technique | Defensive Control | Implementation | Effectiveness | Resource Requirement |\n|-----------------|------------------|----------------|---------------|---------------------|\n| T1059.003 | Command line logging | Enable Sysmon | Medium | Low |\n| T1547.001 | Registry monitoring | Deploy registry auditing | High | Medium |\n\n### Medium Priority Long-term (Deploy within 1 month)\n| MITRE Technique | Hardening Measure | Implementation | Risk Reduction | Compliance Benefit |\n|-----------------|-------------------|----------------|----------------|-------------------|\n| T1027.003 | File entropy monitoring | Deploy DLP solution | High | PCI-DSS compliance |\n| T1070.004 | Log integrity protection | Implement SIEM | High | SOX compliance |\n\n## Anti-Forensic Technique Library\n\n### Detected Evasion Techniques\n| Technique Category | MITRE Mapping | Sophistication | Countermeasures Applied | Effectiveness |\n|-------------------|---------------|----------------|------------------------|---------------|\n| Log Tampering | T1070.002 | High | Log integrity monitoring | 85% detection rate |\n| Memory Obfuscation | T1055.008 | Expert | Memory forensics tools | 70% detection rate |\n| Steganography | T1027.003 | Medium | Steganalysis tools | 60% detection rate |\n\n### Recommended Counter-Forensic Enhancements\n1. **Enhanced Memory Forensics**: Deploy advanced memory analysis tools\n2. **Log Integrity Verification**: Implement cryptographic log signing\n3. **Steganography Detection**: Deploy statistical analysis tools\n4. **Timeline Correlation**: Implement cross-source timeline analysis\n\n## Threat Actor Assessment with MITRE Profile\n\n### Likely Attribution: [APT-XX or Threat Actor Type]\n- **MITRE Technique Overlap**: 85% match with known APT-29 techniques\n- **Sophistication Level**: Nation-state (Based on technique complexity)\n- **Targeting Profile**: Government\u002FCritical Infrastructure\n- **Known TTPs**: Advanced persistent access, steganographic C2\n\n### Capability Assessment\n| MITRE Tactic | Demonstrated Capability | Sophistication Level | Threat Score |\n|--------------|------------------------|---------------------|--------------|\n| Initial Access | Spearphishing, Watering hole | High | 8\u002F10 |\n| Execution | Multiple interpreters | Medium | 6\u002F10 |\n| Defense Evasion | Advanced obfuscation | Expert | 9\u002F10 |\n| Command & Control | Encrypted channels, steganography | Expert | 9\u002F10 |\n\n## Predictive Analysis & Threat Modeling\n\n### Likely Next Techniques (Based on campaign progression)\n1. **T1041 (Exfiltration Over C2 Channel)** - Probability: 95%\n2. **T1021.001 (Remote Desktop Protocol)** - Probability: 80%\n3. **T1020 (Automated Exfiltration)** - Probability: 75%\n\n### Recommended Proactive Defenses\n1. **Data Loss Prevention**: Deploy DLP for exfiltration detection\n2. **Network Segmentation**: Implement micro-segmentation\n3. **Privilege Access Management**: Deploy PAM solution\n\n## Detection Rules & Signatures\n\n### YARA Rules (MITRE Technique-Specific)\n```yara\nrule APT_T1055_ProcessInjection {\n    meta:\n        description = \"Detects process injection techniques (T1055)\"\n        mitre_technique = \"T1055\"\n        confidence = \"high\"\n    \n    strings:\n        $api1 = \"VirtualAllocEx\"\n        $api2 = \"WriteProcessMemory\"\n        $api3 = \"CreateRemoteThread\"\n    \n    condition:\n        all of ($api*)\n}\n\nrule APT_T1027_Obfuscation {\n    meta:\n        description = \"Detects obfuscated content (T1027)\"\n        mitre_technique = \"T1027\"\n        confidence = \"medium\"\n    \n    strings:\n        $entropy_high = { [80-FF] [80-FF] [80-FF] [80-FF] }\n    \n    condition:\n        #entropy_high > 100 and filesize \u003C 10MB\n}\n```\n\n### Sigma Rules (MITRE Behavioral Detection)\n```yaml\ntitle: Process Injection Activity (T1055)\nid: mitre-t1055-injection\nstatus: experimental\ndescription: Detects process injection techniques\nreferences:\n    - https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1055\u002F\ntags:\n    - attack.defense_evasion\n    - attack.t1055\ndetection:\n    selection:\n        EventID: 1\n        CommandLine|contains:\n            - 'VirtualAllocEx'\n            - 'WriteProcessMemory'\n            - 'CreateRemoteThread'\n    condition: selection\nfalsepositives:\n    - Legitimate debugging tools\nlevel: high\n\ntitle: Registry Persistence (T1547.001)\nid: mitre-t1547-registry\nstatus: experimental\ndescription: Detects registry-based persistence\nreferences:\n    - https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1547\u002F001\u002F\ntags:\n    - attack.persistence\n    - attack.t1547.001\ndetection:\n    selection:\n        EventID: 13\n        TargetObject|contains:\n            - 'SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run'\n            - 'SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce'\n    condition: selection\nlevel: medium\n```\n\n### Network Signatures (C2 Detection)\n```suricata\nalert tcp any any -> any any (msg:\"MITRE T1071.001 Web-based C2\"; \\\n    content:\"User-Agent|3a| \"; http_header; \\\n    pcre:\"\u002FUser-Agent\\x3a\\x20[a-zA-Z0-9]{8,}\u002FH\"; \\\n    reference:url,attack.mitre.org\u002Ftechniques\u002FT1071\u002F001\u002F; \\\n    sid:1001; rev:1;)\n\nalert tcp any any -> any any (msg:\"MITRE T1001.003 Steganographic C2\"; \\\n    content:\"image\u002F\"; http_header; \\\n    byte_test:4,>,500,0,relative; \\\n    reference:url,attack.mitre.org\u002Ftechniques\u002FT1001\u002F003\u002F; \\\n    sid:1002; rev:1;)\n```\n\n## Hardening Recommendations Mapped to MITRE\n\n### Technique-Specific Hardening\n| MITRE Technique | Hardening Measure | Configuration | Effectiveness | Implementation Effort |\n|-----------------|------------------|---------------|---------------|----------------------|\n| T1078 (Valid Accounts) | Multi-factor Authentication | Require MFA for all accounts | High | Medium |\n| T1059 (Command Interpreters) | Application Whitelisting | Block unauthorized executables | High | High |\n| T1055 (Process Injection) | Memory Protection | Enable SMEP\u002FSMAP | Medium | Low |\n\n### Progressive Hardening Matrix\n| Threat Level | MITRE Focus Areas | Hardening Priority | Implementation Timeline |\n|--------------|-------------------|-------------------|------------------------|\n| Low | TA0001 (Initial Access) | Basic email security | Immediate |\n| Medium | TA0003 (Persistence) | Enhanced monitoring | 1 week |\n| High | TA0005 (Defense Evasion) | Advanced protection | 2 weeks |\n| Critical | All tactics | Maximum hardening | Immediate |\n```\n\n---\n\n## Integration with Comprehensive Forensic Framework\n\n### 🔄 **Database Integration**\n```python\n# Integration with forensic database for MITRE intelligence\nasync def sync_mitre_analysis_to_database(analysis_results):\n    \"\"\"Sync MITRE analysis results to forensic database\"\"\"\n    \n    for technique_analysis in analysis_results['techniques']:\n        # Create or update MITRE technique mapping\n        technique = await get_or_create_mitre_technique(\n            technique_analysis['technique_id']\n        )\n        \n        # Create IOC-to-MITRE mappings\n        for ioc_mapping in technique_analysis['ioc_mappings']:\n            await IOCMITREMapping.create(\n                ioc=ioc_mapping['ioc'],\n                technique=technique,\n                confidence=ioc_mapping['confidence'],\n                evidence=ioc_mapping['evidence'],\n                mapped_by_session=analysis_results['session']\n            )\n        \n        # Update threat profile with MITRE intelligence\n        await update_threat_profile_with_mitre(\n            analysis_results['project'],\n            technique_analysis\n        )\n```\n\n### 🎯 **Real-Time MITRE Correlation**\n```bash\n# Real-time MITRE technique correlation\ncorrelate_mitre_real_time() {\n  local new_ioc=\"$1\"\n  local ioc_type=\"$2\"\n  local confidence=\"$3\"\n  \n  echo \"Correlating IOC with MITRE framework: $new_ioc\"\n  \n  # Map IOC to potential MITRE techniques\n  potential_techniques=$(map_ioc_to_mitre \"$new_ioc\" \"$ioc_type\")\n  \n  # Enhance with behavioral context\n  behavioral_techniques=$(analyze_behavioral_context \"$new_ioc\")\n  \n  # Cross-validate with threat intelligence\n  validated_techniques=$(cross_validate_with_threat_intel \\\n    \"$potential_techniques\" \"$behavioral_techniques\")\n  \n  # Apply confidence scoring\n  confident_techniques=$(apply_mitre_confidence_scoring \\\n    \"$validated_techniques\" \"$confidence\")\n  \n  # Update real-time MITRE database\n  update_session_mitre_techniques \"$confident_techniques\"\n  \n  # Generate immediate defensive recommendations\n  generate_mitre_defensive_recommendations \"$confident_techniques\"\n  \n  echo \"MITRE correlation completed: $(echo \"$confident_techniques\" | wc -l) techniques mapped\"\n}\n```\n\n---\n\n## Advanced Analytics & Machine Learning\n\n### 🧠 **MITRE Pattern Recognition**\n```python\n# ML-enhanced MITRE technique prediction\ndef predict_next_techniques(observed_techniques, threat_context):\n    \"\"\"\n    Predict likely next MITRE techniques based on:\n    - Historical attack patterns\n    - Threat actor TTP profiles\n    - Attack campaign progression\n    - Environmental factors\n    \"\"\"\n    features = extract_technique_features(observed_techniques, threat_context)\n    \n    # Use trained model for technique progression prediction\n    predictions = mitre_progression_model.predict(features)\n    \n    # Enhance with threat actor profile analysis\n    actor_predictions = threat_actor_model.predict(features)\n    \n    # Combine predictions with confidence weighting\n    combined_predictions = combine_predictions(predictions, actor_predictions)\n    \n    return rank_predictions_by_likelihood(combined_predictions)\n\ndef generate_defensive_priorities(predicted_techniques, system_config):\n    \"\"\"\n    Generate defensive priorities based on predicted MITRE techniques\n    \"\"\"\n    priorities = []\n    \n    for technique in predicted_techniques:\n        # Calculate risk score\n        risk_score = calculate_technique_risk(technique, system_config)\n        \n        # Assess defensive gaps\n        gaps = assess_defensive_gaps(technique, system_config)\n        \n        # Generate recommendations\n        recommendations = generate_technique_mitigations(technique, gaps)\n        \n        priorities.append({\n            'technique': technique,\n            'risk_score': risk_score,\n            'priority': calculate_priority(risk_score, gaps),\n            'recommendations': recommendations\n        })\n    \n    return sort_priorities_by_urgency(priorities)\n```\n\n---\n\n## Quality Assurance & Validation\n\n### ✅ **MITRE Mapping Validation**\n- **Multi-source validation**: Cross-reference mappings with multiple threat intelligence sources\n- **Expert review integration**: Flag complex mappings for expert analyst review\n- **Confidence calibration**: Continuously calibrate confidence scores based on validation results\n- **False positive tracking**: Monitor and reduce false positive MITRE mappings\n\n### 📊 **Performance Metrics**\n- **Mapping accuracy**: Percentage of correctly mapped MITRE techniques\n- **Prediction accuracy**: Accuracy of predicted next techniques\n- **Defense effectiveness**: Measured reduction in successful attacks\n- **Time to detection**: Speed of MITRE technique identification\n\n---\n\n## Rules for Enhanced MITRE Analysis\n\n1. **Cross-session correlation** → Always analyze MITRE technique evolution across sessions\n2. **Anti-forensic awareness** → Map evasion techniques to defense evasion sub-techniques\n3. **Defense integration** → Generate actionable defensive recommendations for each technique\n4. **Confidence validation** → Validate technique mappings with multiple evidence sources\n5. **Threat actor profiling** → Build attribution profiles based on MITRE technique patterns\n6. **Progressive hardening** → Prioritize hardening based on MITRE technique likelihood\n7. **Real-time updating** → Update MITRE mappings as new evidence emerges\n8. **Forensic preservation** → Maintain audit trail of all MITRE analysis decisions\n9. **Predictive analysis** → Use historical patterns to predict likely next techniques\n10. **Compliance mapping** → Align MITRE defensive controls with regulatory requirements\n\n---\n\n**Ready to analyze comprehensive threats through the enhanced MITRE ATT&CK lens with advanced forensic intelligence, anti-forensic detection, and progressive defense integration.**",{"name":5,"tags":44,"capec":45,"model":46,"tools":47,"skills":54,"maxTurns":56,"nist_csf":57,"description":7},[38,21,28,27],[],"opus",[48,49,30,50,51,52,53],"Read","Write","Glob","Grep","WebSearch","WebFetch",[55],"shared-memory",30,[],"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fintel\u002Fanalysis\u002Fmitre-attack\u002Fforensic","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":66,"prompt":76,"zipAvailable":77},[67,70,73],{"tool":68,"command":69},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill analysis-mitre-attack-forensic",{"tool":71,"command":72},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill analysis-mitre-attack-forensic",{"tool":74,"command":75},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill analysis-mitre-attack-forensic","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fintel\u002Fanalysis\u002Fmitre-attack\u002Fforensic\u002FSKILL.md",true,[79],{"path":80,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":83,"sourceHtmlUrl":84},"index.json","REFERENCE","参考文档",699,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fintel\u002Fanalysis\u002Fmitre-attack\u002Fforensic\u002Findex.json",[86,112,132,154,176,191],{"skillNo":87,"name":88,"nameZh":6,"description":89,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":90,"categories":91,"keywords":92,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","cybersecurity","process-forensics",{"skillNo":113,"name":114,"nameZh":6,"description":115,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":116,"categories":117,"keywords":118,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[119,93,120,96,121,122,123,110,30,21,124,125,126,127,98,128,129,26,130,131],"exploit","services wmi exec exploit","exec","remote","traffic","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":133,"name":134,"nameZh":6,"description":135,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":136,"categories":137,"keywords":138,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[139,140,141,142,143,144,110,30,145,21,146,147,98,26,148,149,150,151,152,153],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":160,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[94,161,162,163,164,165,166,99,167,110,111,168,169,170,171,172,173,174,175,98],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":177,"name":178,"nameZh":6,"description":179,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":180,"categories":181,"keywords":182,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[183,184,94,185,163,165,33,99,186,167,110,111,21,187,188,189,190,175,98,100],"thread","processes thread injection detect","injection","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":192,"name":193,"nameZh":6,"description":194,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":195,"categories":196,"keywords":197,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[198,94,163,199,33,99,200,201,110,111,202,203,204,205,206,207,98,100,208,209],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]