MITRE ATT&CK Lookup

What this skill does

Queries the MITRE ATT&CK knowledge base using mitrize — a Git-based static dataset that converts STIX 2.1 JSON into individual Markdown files with YAML frontmatter. Supports technique lookup, threat actor profiling, software analysis, mitigation mapping, full-text search, and group overlap comparison. Covers Enterprise, Mobile, and ICS domains (ATT&CK v18.1+, 898 techniques, 203 groups, 929 software entries).

When to use

• When you need to look up a specific ATT&CK technique by ID or name (e.g., T1059, "Command and Scripting Interpreter")
• When profiling a threat actor's TTPs (e.g., all techniques used by APT28 or Kimsuky)
• When mapping detected IOCs/behaviors to ATT&CK techniques during incident response
• When building detection rules and need to understand technique details and mitigations
• When comparing two threat groups to find overlapping and unique techniques
• When searching the ATT&CK knowledge base by keyword (e.g., "ransomware", "PowerShell")

Prerequisites