/map-malware-behavior

name: map-malware-behavior
description: Map observed malicious behavior to MITRE ATT&CK techniques. Use when analysis, telemetry, incident evidence, or a report needs a behavior map for detection, response, or communication without inferring an actor or campaign.

Map Malware Behavior

Overview

Translate evidence into current ATT&CK technique references while keeping the original observation primary. Map only behaviors supported by evidence and preserve platform/version context.

Read [references/behavior-mapping.md](references/behavior-mapping.md) for evidence and mapping fields.

Workflow

1. Normalize observations.

• Record actor/process, action, object, time, environment, privilege, source, and confidence.

2. Open current ATT&CK content.

• Select the relevant Enterprise, Mobile, ICS, cloud, container, or platform matrix and record the version/date checked.

3. Match behavior, not keywords.

• Read the technique definition and platform applicability.
• Choose the most specific supported sub-technique; preserve multiple plausible mappings as alternatives when evidence is incomplete.

4. Record mapping evidence.

• Link each technique to the exact observation and explain why it fits and where it does not.

5. Avoid attribution inflation.

• Do not infer actor, malware family, campaign, intent, or sequence solely because ATT&CK pages list similar procedure examples.

6. Use the map.

• Route to containment, hunting, or detection content and name telemetry gaps.

Output

Return an evidence-to-technique table, platform and ATT&CK version/date, confidence, alternative mappings, telemetry gaps, and defensive use.