attack-mapping

Solid

MITRE ATT&CK technique mapping for a CVE or every entry in `.vulnetix/memory.yaml`. Use when planning detection coverage gaps, mapping a CVE to defender controls, building an executive heatmap of repo risk by tactic, or correlating with internal D3FEND counter-techniques.

Data & Documents 9 stars 1 forks Updated 2 weeks ago Apache-2.0

Install

View on GitHub

Quality Score: 83/100

Stars 20%
33
Recency 20%
90
Frontmatter 20%
70
Documentation 15%
100
Issue Health 10%
80
License 10%
100
Description 5%
100

Skill Content

# Vulnetix ATT&CK Mapping Skill ## Use when - You need to know which ATT&CK techniques a CVE enables (Initial Access? Execution? Persistence?). - Building an executive heatmap: which tactics dominate this repo's risk profile. - Mapping current detection coverage gaps via ATT&CK → D3FEND. - Correlating multiple CVEs to a shared technique chain (e.g. T1190 + T1059). - Producing input for a purple-team exercise. ## Don't use for - Generating detection rules for the IDS — use `/vulnetix:detection-rules`. - Single-CVE deep-dive — use `/vulnetix:exploits`. - IOC pivots — use `/vulnetix:ioc-pivot`. ## Conventions This skill follows [`_lib/contract.md`](../_lib/contract.md): the Vulnetix CLI is auto-installed by hooks, `.vulnetix/capabilities.yaml` is always present, every `vulnetix vdb` call is piped through a verified `jq` filter from [`_lib/jq/`](../_lib/jq/), independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns. Produces an ATT&CK technique view of repo risk. Run with a single vuln-id for a focused mapping, or `--all-tracked` to roll up every entry in `.vulnetix/memory.yaml`. ## Step 1: Decide mode If `$ARGUMENTS` matches a vuln-id pattern → single mode. Else if it contains `--all-tracked` → roll-up mode reading every `vulnerabilities.*` entry in `.vulnetix/memory.yaml` (skip those with status `not_affected` or `fixed`). ## Step 2: Fetch ATT&...

Details

Author
Vulnetix
Repository
Vulnetix/pix-ai-coding-assistant
Created
6 months ago
Last Updated
2 weeks ago
Language
CSS
License
Apache-2.0

Similar Skills

Semantically similar based on skill content — not just same category

Data & Documents Listed

mitre-attack-mapping

Map observed adversary behaviour to MITRE ATT&CK tactics, techniques and sub-techniques with evidence, rationale, and confidence, then produce a mapping table and an ATT&CK Navigator layer JSON. Use it whenever someone asks "what ATT&CK techniques is this", "map this to ATT&CK", "tag this with TTPs", "build a Navigator layer / heat map", "which techniques does our detection coverage miss", or pastes an incident timeline, threat report, sandbox report, Sigma rule set, or purple-team results and wants them expressed in ATT&CK terms. Also use it to check an existing mapping for over-mapping, wrong tactics, or stale technique IDs, and to diff a threat-profile layer against a detection-coverage layer.

0 Updated 1 weeks ago
ftrout
Code & Development Solid

exploits

Exploit intelligence analysis for a single CVE — Metasploit, ExploitDB, Nuclei, VulnCheck XDB, GitHub PoCs, CrowdSec sightings, Snort, YARA, MISP-galaxy, nmap-nse, plus 10 more sources. Use when deciding patch urgency for a CVE, mapping a vulnerability to MITRE ATT&CK techniques, computing CWSS priority, fetching cached PoC source for static analysis (never executed), or producing a threat-model summary for incident response.

9 Updated 2 weeks ago
Vulnetix
Data & Documents Solid

vuln

Vulnerability intelligence lookup by CVE / GHSA / PYSEC / RUSTSEC / GO / SNYK / ZDI / MSCVE / RHSA / KEV / EUVD / OSV / 78+ ID formats — or by package name. Use when triaging a specific CVE, listing all known vulnerabilities for an installed dependency, checking CISA KEV status, reading SSVC decisions, fetching x_threatExposure rules, or assessing repo impact via lockfile cross-reference.

9 Updated 2 weeks ago
Vulnetix