Step 1 – Describe what Happened

Use observations rather than conclusions.

For example:

Observed activity:

- A user account executed PowerShell
- PowerShell launched another process
- The process downloaded a file
- The system made an outbound network connection

These events occurred on a Windows test machine.

Step 2 – Ask AI for possible mappings

Try:

Map these observed behaviors to the MITRE ATT&CK framework.

For each possible technique:
- Provide the technique ID
- Provide the technique name
- Explain which observation supports the mapping
- Identify what additional evidence would confirm it

Do not assume a technique occurred if the evidence is insufficient.

The important part is that AI should explain why it suggested each mapping.

Step 3 – Validate the Mapping

Don’t treat the generated mapping as proof.

Ask:

Review these ATT&CK mappings.

For each one, classify the evidence as:
- Strong
- Possible
- Insufficient

Explain what additional evidence would be needed.

This helps separate observed behavior from interpretation.

Step 4 – Connect Techniques to Detection

Now take the analysis one step further:

For each confirmed or strongly supported technique,
suggest defensive detection opportunities.

Include:
- useful log sources
- relevant events
- possible SIEM searches
- potential false positives

Now your investigation has moved from:

Event
 ↓
ATT&CK Technique
 ↓
Detection Opportunity

Why this is useful

ATT&CK provides a common language for describing adversary behavior. AI can help connect raw observations to that framework, especially when you’re still learning the technique names and IDs. Just remember that the evidence comes first. The ATT&CK mapping should describe what the evidence supports, not replace the investigation itself.