---
name: map-malware-behavior
description: Map observed or strongly evidenced malicious behavior to current MITRE ATT&CK techniques and platform context. Use when static or dynamic analysis, endpoint telemetry, incident evidence, or a malware report needs a behavior map for detection, response, comparison, or communication without inferring an actor, campaign, family, or complete attack chain from labels alone.
---

# Map Malware Behavior

## Overview

Translate evidence into current ATT&CK technique references while keeping the original observation primary. Map only behaviors supported by evidence and preserve platform/version context.

Read [references/behavior-mapping.md](references/behavior-mapping.md) for evidence and mapping fields.

## Workflow

1. Normalize observations.
   - Record actor/process, action, object, time, environment, privilege, source, and confidence.
2. Open current ATT&CK content.
   - Select the relevant Enterprise, Mobile, ICS, cloud, container, or platform matrix and record the version/date checked.
3. Match behavior, not keywords.
   - Read the technique definition and platform applicability.
   - Choose the most specific supported sub-technique; preserve multiple plausible mappings as alternatives when evidence is incomplete.
4. Record mapping evidence.
   - Link each technique to the exact observation and explain why it fits and where it does not.
5. Avoid attribution inflation.
   - Do not infer actor, malware family, campaign, intent, or sequence solely because ATT&CK pages list similar procedure examples.
6. Use the map.
   - Route to containment, hunting, or detection content and name telemetry gaps.

## Output

Return an evidence-to-technique table, platform and ATT&CK version/date, confidence, alternative mappings, telemetry gaps, and defensive use.