MITRE ATT&CK Evidence Mapper
Paste incident notes; see the ATT&CK techniques, tactics and indicators they point to.
Candidate tactic map
tap a tactic to filterTechniques
How the ATT&CK mapper works
The mapper uses 80 phrase rules to suggest candidates from a pinned MITRE ATT&CK v20.0 catalogue. These rules are not comprehensive; add any active catalogue technique manually when the evidence supports it. Your text is split into lines and every phrase is matched on word boundaries, so "iex" does not match "review" while ".lnk" and "admin$" still match.
- Score = phrases matched × technique weight. This priority orders candidates only; confidence is assigned by an analyst after reviewing line evidence.
- Tactics: techniques that span several tactics are filed under their most common one, across the 14 Enterprise tactics.
- Collect next lists the evidence gaps: missing tactics such as initial access or persistence, and follow-ups such as resetting dumped credentials.
- Indicators are pulled out with patterns for URLs, domains, IPs, emails, hashes, CVEs, file paths and registry keys.
How to read the result
The tactic map distinguishes unreviewed suggestions from analyst assessments. It does not measure detection coverage. Open a technique to see candidate priority and the input lines that matched, with each phrase highlighted. Confidence reflects matched text only and makes no attribution claim, so validate each technique against primary telemetry before you report it.
ATT&CK mapper FAQ
Are my notes sent anywhere?
No. The rules, the scoring and the indicator extraction all run in this page. Your notes are not uploaded and are not saved in the browser, so they are gone when you close the tab.
How is confidence scored?
Phrase counts and weights set candidate priority only. Every candidate starts unreviewed. Accepting or rejecting a mapping requires an analyst rationale and valid input line references. Only analyst-accepted mappings enter Navigator exports.
Can I correct a mapping?
Yes. Each technique has a confidence menu. Set it to high, medium or low, or exclude it. The heatmap, the report, the CSV and the Navigator layer all follow your choice.
How do I open the Navigator layer?
Download the layer, open MITRE's ATT&CK Navigator, choose Open Existing Layer and then Upload from local. Only accepted mappings are included; scores encode the analyst’s low (1), medium (2) or high (3) assessment.
Which indicators does it extract?
URLs, domains, IPv4 and IPv6 addresses, email addresses, SHA256, SHA1 and MD5 hashes, CVE IDs, file paths and registry keys. Defanged values such as hxxp and [.] are refanged first.
Triage only. Validate against primary telemetry before reporting.
Pinned MITRE ATT&CK v20.0 · Release notes · Official dataset. Phrase matching is a review aid; no MITRE endorsement is implied.