This content is open to everyone — sign in to save your progress, earn points, and unlock module exams.

Topic 7.2 of Analyst Practice and Reporting

MITRE ATT&CK Technique Mapping

MITRE ATT&CK is the industry-standard taxonomy for adversary behaviour. This topic covers how to map observed malware actions to the correct tactics and techniques, the difference between technique inference and technique observation, and the use of ATT&CK Navigator to communicate findings to defenders.

~25 min total·4 quadrants of structured content

By the end of this topic, you will

Identify the 14 ATT&CK tactics and locate techniques within them
Map a set of observed malware behaviours to ATT&CK techniques with appropriate confidence
Distinguish between technique observation, inference, and assumption
Produce an ATT&CK Navigator layer summarising a sample analysis

Quadrant 1 · e-Tutorial

Video lectures and walkthroughs

Video content coming soon.

Quadrant 2 · e-Content

Articles and case studies

Analyst Practice

MITRE ATT&CK Technique Mapping

Mapping observed malware behaviour to MITRE ATT&CK techniques is now a standard deliverable in malware analysis. How to do it correctly — the 14 tactics, the confidence model, and using ATT&CK Navigator to communicate findings.

10 min read

Quadrant 3 · Web Resources

Downloadable material and curated external links

Downloadable reference material

EBook

REMA eBook 2026

v1.0

Open resource

Cheatsheet

REMA Cheatsheet 2026

v1.0

Open resource

MCQ Bank

REMA MCQ Bank 2026

v1.0

Open resource

Question Bank

REMA Question Bank 2026

v1.0

Open resource

External links

MITRE ATT&CK Enterprise Matrix

The full ATT&CK Enterprise matrix. Bookmark and use during every analysis.

ATT&CK Navigator

Web-based tool for creating and exporting ATT&CK layer visualisations. The standard output format.

ATT&CK Mapping Methodology (MITRE)

MITRE's own guidance on how to map behaviours to techniques with appropriate confidence.

Quadrant 4 · Self-Assessment

Test your knowledge — earn a certificate on first pass

Analyst Practice and Reporting

Final unit assessment covering IOC extraction and pivoting, MITRE ATT&CK technique mapping, and writing the malware analysis report. 20 questions, 60% to pass.

20 questions30 minPass: 60%

REMA Complete Assessment

A comprehensive 120-question assessment covering the entire Reverse Engineering and Malware Analysis curriculum: malware taxonomy and reverse engineering fundamentals, static and dynamic analysis, reversing malicious code, malicious web and document files, in-depth analysis of packed and fileless malware, and self-defending malware techniques.

120 questions90 minPass: 60%