Maps code patterns, vulnerabilities, and security findings to MITRE ATT&CK techniques. Use when classifying security issues by ATT&CK ID.
How this skill is triggered — by the user, by Claude, or both
Slash command
/security-compliance-pro:mitre-attack-mapperThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
This skill maps security vulnerabilities, vulnerability patterns, and defenseless code structures in the codebase directly to MITRE ATT&CK techniques (T1190, T1574.002, etc.). Every detected issue is reported along with an actionable ATT&CK ID, relevant mitigation (M-ID) IDs, and detection suggestions. The goal is to anchor security findings to an international standard taxonomy, ensuring teams...
This skill maps security vulnerabilities, vulnerability patterns, and defenseless code structures in the codebase directly to MITRE ATT&CK techniques (T1190, T1574.002, etc.). Every detected issue is reported along with an actionable ATT&CK ID, relevant mitigation (M-ID) IDs, and detection suggestions. The goal is to anchor security findings to an international standard taxonomy, ensuring teams speak the same language and prioritize defense systematically.
Core principle: Every security finding receives an ATT&CK ID. A finding without an ATT&CK ID is a finding that doesn't exist.
NO SECURITY FINDING CAN BE CLOSED WITHOUT BEING MAPPED TO AT LEAST ONE MITRE ATT&CK TECHNIQUE.
IF YOU CANNOT ASSIGN AN ATT&CK ID TO A FINDING, YOU DO NOT UNDERSTAND THE FINDING WELL ENOUGH.
Use this when:
Use this ESPECIALLY when:
Don't skip when:
BEFORE proceeding:
Obtain the raw finding (log, code snippet, error message). Do not attempt threat mapping without understanding the technical details.
# Example: Mapping a SQL injection finding to ATT&CK
# Finding: User input is concatenated directly into a SQL query without parameterization
finding = {
"type": "sql_injection",
"file": "app/routes/users.py:45",
"severity": "critical"
}
# Mapping: T1190 (Exploit Public-Facing Application)
# Sub-technique: T1190.001 (SQL Injection)
technique_id = "T1190.001"
technique_name = "SQL Injection through Public-Facing Application"
mitigation = "M1050: Exploit Protection, M1048: Application Isolation and Sandboxing"
BEFORE proceeding:
Verify the ATT&CK ID and sub-technique details for each technique.
Technique: T1190.001 (SQL Injection)
├── Mitigation: M1040 (Input Validation) → Are parameterized queries used? → No: GAP
├── Mitigation: M1050 (Exploit Protection) → Is a WAF present? → No: GAP
└── Detection: Sigma sql_injection_error.yml → Splunk sourcetype=sql_error | search ...
BEFORE proceeding:
Ensure all findings have been mapped, with mitigations and detections assigned.
Example Heatmap (CSV format):
Tactic,Technique ID,Finding Count,Mitigation Active?,Detection Active?,Priority
Initial Access,T1190.001,5,NO,YES,CRITICAL
Execution,T1203,2,YES,YES,LOW
Persistence,T1547.001,1,NO,NO,CRITICAL
Before marking complete:
If you catch yourself thinking:
ALL OF THESE MEAN: STOP. Return to the relevant phase.
Watch for these redirections:
When you see these: STOP. Return to the relevant phase.
| Excuse | Reality |
|---|---|
| "This vulnerability is trivial, it doesn't need ATT&CK mapping." | Trivial vulnerabilities are often overlooked; mapping keeps them visible. |
| "Sub-techniques are too detailed, the parent technique is enough." | Parent techniques often lead to incorrect mitigation suggestions; sub-techniques are critical. |
| "We will write detection rules later; let's finish the report first." | A report without detection suggestions is obsolete from day one. |
| "Everyone knows this vulnerability already." | Assumptions lead to false positives and overlooked risks. |
| "There is already a general rule, we don't need a new one." | Verify if the existing rule actually triggers on this specific technique. |
| "We have mitigations in place, so detection is unnecessary." | Defense-in-depth requires both mitigation and detection. |
After completing this process:
npx claudepluginhub haj1t/senior-dev-squad-skills --plugin security-compliance-proProvides CDSS development patterns for drug interaction checking, dose validation, clinical scoring (NEWS2, qSOFA), and alert classification integrated into EMR workflows.