Threat reports often carry an ATT&CK mapping that looks precise but falls apart under scrutiny. A technique ID appears next to an alert, a slide gets a colored cell, and everyone moves on. Then the detection engineer tries to build a rule and finds the mapping describes a broad behavior, not the specific action in the report. The result is noisy alerts, missed coverage, and reports that decision-makers cannot act on. The fix is not more technique IDs. It is better evidence and a repeatable review process.

Mistake 1: Mapping a Tool Instead of a Behavior

Seeing PowerShell in a log does not automatically mean T1059.001. That sub-technique covers adversary use of PowerShell to execute commands and scripts. If the command is a scheduled inventory script from your own admin team, the mapping is wrong. The same logic applies to PsExec, WMI, or certutil. These are tools. ATT&CK maps behavior.

Ask what the adversary did, not what they used. A report that says “attacker used certutil to download a file” has two behaviors: command execution and ingress tool transfer. Map T1059.003 or T1059.001 if the parent interpreter is cmd or PowerShell, and T1105 for the download. If you only have “certutil ran,” that may be T1140 Deobfuscate/Decode Files or Information only if decoding is present. Otherwise, stay with the evidence.

Read the technique description and the procedure examples. If your scenario is not listed, check a sub-technique. If no sub-technique fits, use the parent technique and note the uncertainty.

Mistake 2: Treating the Matrix as a Scorecard

Some teams try to cover every technique in the ATT&CK matrix. That turns threat intelligence into a compliance exercise. It also produces reports that list forty techniques for a single intrusion, which makes prioritization impossible.

Use your threat model. A hospital, a SaaS company, and a manufacturer face different likely techniques. Start with the groups and software that target your sector. If ransomware is the main concern, focus on techniques such as T1486 Data Encrypted for Impact, T1490 Inhibit System Recovery, and T1562.001 Disable or Modify Tools. If you are a cloud-heavy company, prioritize techniques in the Cloud matrix.

A smaller, relevant set of techniques is more useful than a full matrix. Review coverage quarterly, not after every alert. When you do map, ask whether the technique changes a decision: detection, containment, or hunting. If it does not, cut it.

Mistake 3: Blurring Tactics and Techniques

Tactics are the why. Techniques are the how. A report that says “Tactic: Execution” has told the reader nothing they can detect. A report that says “Technique: Execution” is using the wrong term.

Correct pairings look like this:

• Tactic: Execution → Technique: T1059 Command and Scripting Interpreter → Sub-technique: T1059.001 PowerShell
• Tactic: Persistence → Technique: T1053 Scheduled Task/Job → Sub-technique: T1053.005 Scheduled Task
• Tactic: Defense Evasion → Technique: T1218 System Binary Proxy Execution → Sub-technique: T1218.011 Rundll32

A simple test: if you cannot name the action the adversary took, you have a tactic, not a technique. Use the tactic as a heading, then map the specific action underneath it.

Mistake 4: Over-Mapping and Under-Mapping

Over-mapping happens when one alert gets every possible technique. Under-mapping happens when a complex intrusion gets one vague technique. Both weaken the report.

Common over-mapping: a suspicious Word document that spawns PowerShell gets T1204.002, T1059.001, T1105, T1055, and T1027. If the evidence only shows document execution and PowerShell startup, map the first two. Do not add process injection unless you see it.

Under-mapping: “malware” mapped only to T1204 User Execution. That misses the persistence, defense evasion, and command-and-control behaviors that matter for response.

Use confidence levels. High confidence means the evidence directly shows the behavior. Medium means the behavior is likely but not fully visible. Low means it is a hypothesis for hunting. Put the confidence next to the technique ID in your report. That single habit prevents most over-mapping.

Mistake 5: Forgetting Data Sources and Detection Gaps

ATT&CK mappings are only useful if you can detect or hunt the behavior. Each technique lists data sources. For example, T1053.005 Scheduled Task relies on data such as Scheduled Job, Process Creation, and Command Execution. If you map that technique but do not collect scheduled task creation events, your report has a gap.

For every technique, add a short status:

• Detected: an alert exists and has been tested.
• Logged, no alert: the data is available but nobody reviews it.
• Not collected: the telemetry is missing.

This turns a threat report into a detection roadmap. It also stops the false comfort of a green matrix cell that has no supporting data. Share the status with detection engineering and log management. If a high-priority technique is not collected, that is a finding, not a footnote.

Mistake 6: Ignoring ATT&CK Versions, Platforms, and Context

ATT&CK is not static. Techniques get split, deprecated, or revoked. A report that uses an old ID can send detection engineers to the wrong page. Note the ATT&CK version you used, and check the current entry before publishing.

Platform matters. T1059.001 is Windows PowerShell. T1059.004 is Unix Shell. A cloud technique such as T1078.004 Valid Accounts: Cloud Accounts does not belong in an on-premises Windows report unless cloud identities are involved.

Context matters too. A technique that requires administrator rights is different from one that works as a standard user. Note the permissions and the environment. If you are mapping to a group, do it only when the tradecraft matches. Group names are useful for context, but they are not a substitute for behavior.

A Practical Workflow for Cleaner Mapping

Use this sequence for every report, incident, or detection idea:

1. Start with raw evidence. Write one sentence describing what actually happened.
2. Look up candidate techniques. Read the definition and procedure examples.
3. Choose the most specific sub-technique the evidence supports. If unsure, use the parent technique.
4. Record confidence and data source status next to the technique ID.
5. Ask a peer to challenge the mapping. A second reader catches tool-based mappings quickly.
6. Turn confirmed techniques into detection or hunting tasks. Update the report with the result.
7. Revisit the mapping after the incident closes. New evidence often changes the technique.

If a mapping cannot be explained in one sentence with evidence, it is not ready for the report.

Clean ATT&CK mapping is not about memorizing the matrix. It is about matching evidence to behavior and being honest about what you can see. Do that, and your threat reports become shorter, sharper, and far more useful to the people who defend the network.

Photo: Google DeepMind / Pexels