Mapping SIEM Capabilities to MITRE ATT&CK Across the Kill Chain

Most SIEM programs fail for one simple reason: they collect everything, but they do not prove what they can actually detect. 

Leadership asks, Are we covered? The SOC answers with dashboards, ingestion numbers, and a long list of rules. But none of that explains whether your SIEM platform can spot real attacker behavior from first touch to impact. 

That’s where MITRE ATT&CK comes in. When you map your SIEM capabilities to the MITRE ATT&CK framework and line it up across the cyber kill chain, you move from “we have detections” to “we can stop these techniques at these points, with this evidence, at this speed.” 

You are not here to learn what SIEM is. You are here to pressure test your threat detection, expose gaps, and turn your security incident and event management program into a measurable detection engine. 

What ATT&CK mapping actually means in a SIEM 

ATT&CK mapping is the discipline of tying each detection, alert, correlation rule, analytic, or hunting query to: 

• A specific ATT&CK technique (and ideally sub-technique) 

• The telemetry your SIEM needs to see it 

• The logic that turns telemetry into a signal 

• The response path after it fires 

When done right, it becomes your coverage contract. It tells you what your SIEM capabilities can catch, what they cannot, and what to do next. 

The SIEM capabilities you need before mapping is even worth it 

If your SIEM platform cannot do the basics below, mapping becomes theater. 

Core SIEM capabilities that matter for ATT&CK alignment: 

Normalized ingestion across control planes
Logs, endpoint telemetry, identity events, cloud audit trails, DNS, proxy, email, network telemetry, vulnerability context. 

Entity context and enrichment
Asset criticality, user risk, geolocation, threat intel, known bad infrastructure, vulnerability exposure. 

Correlation across time and sources
Single events are rarely enough. ATT&CK techniques often show up as sequences. 

Behavioral analytics and baselining
Many techniques are “normal” until you see them in the wrong context. 

Investigation workflow and case management
Detections without investigation paths create alert fatigue. 

Automation hooks
Ticketing, SOAR actions, containment, blocking, isolation, access revocation. 

This is also where cybersecurity awareness and cybersecurity risk assessment intersect with detection. Mapping does not replace training or governance. It makes your operational controls measurable. 

Map ATT&CK to the kill chain so your coverage reads like an attacker story 

ATT&CK is organized by tactics and techniques. The kill chain is organized by attacker progression. Combining them gives you a practical view: where can we detect and disrupt, and how early? 

Below is a kill chain view with the most common ATT&CK-aligned detection opportunities and what your SIEM should be doing at each stage. 

1) Reconnaissance: weak signals, strong context 

What attackers do: scan, enumerate, research identities and exposed services. 

ATT&CK tactics often involved: Reconnaissance (TA0043), Resource Development (TA0042) 

SIEM capabilities that matter: 

• Internet-facing telemetry plus identity context 

• Rate and anomaly detection 

• External exposure context from your cybersecurity risk assessment program 

Detection examples to map: 

• Abnormal spikes in authentication attempts against a specific app 

• Enumeration patterns in VPN, SSO, or cloud identity logs 

• Unexpected discovery activity from newly seen IP ranges 

Best practice: treat recon detections as risk signals, not “incidents.” They should raise visibility, tighten controls, and inform prioritization. 

2) Weaponization and Resource Development: catch the setup 

What attackers do: register domains, acquire infrastructure, build payloads, stage phishing kits. 

ATT&CK tactics often involved: Resource Development (TA0042) 

SIEM capabilities that matter: 

• Threat intel enrichment 

• Domain and certificate reputation context 

• Email and web telemetry correlation 

Detection examples to map: 

• Newly registered domains communicating with employees 

• Lookalike domains sending email to high value roles 

• Repeated connections to suspicious hosting providers 

This is where cybersecurity awareness pays off. If users report suspicious emails and your SIEM can connect that report to telemetry, you cut time to detection dramatically. 

3) Delivery: make “initial touch” visible 

What attackers do: deliver the lure via email, drive-by, supply chain, remote services. 

ATT&CK tactics often involved: Initial Access (TA0001) 

SIEM capabilities that matter: 

• Email security logs, proxy logs, DNS, endpoint events 

• Correlation that connects message to click to execution 

Detection examples to map: 

• Email with malicious indicators followed by URL click, then new process creation 

• Download of an executable from a suspicious domain followed by privilege prompts 

• Rare file types delivered to specific departments 

If you cannot correlate email to endpoint behavior, your SIEM security capabilities are not complete for BOFU-grade threat detection. 

4) Exploitation: focus on behavior, not only signatures 

What attackers do: exploit a vulnerability, abuse misconfigurations, execute code. 

ATT&CK tactics often involved: Execution (TA0002), Privilege Escalation (TA0004) 

SIEM capabilities that matter: 

• Vulnerability exposure context 

• Endpoint process telemetry and command line visibility 

• Cloud control plane visibility for misconfig abuse 

Detection examples to map: 

• Suspicious parent-child process chains after a known vulnerable service is touched 

• Abnormal PowerShell usage tied to a user that never runs it 

• Cloud role assumption from unusual devices or impossible travel patterns 

This is where ATT&CK mapping forces honesty. If you have no endpoint telemetry, you cannot claim meaningful coverage for execution and escalation techniques. 

5) Installation and Persistence: the part attackers bet you will miss 

What attackers do: plant persistence, create accounts, add services, schedule tasks, deploy backdoors. 

ATT&CK tactics often involved: Persistence (TA0003), Defense Evasion (TA0005) 

SIEM capabilities that matter: 

• Endpoint changes, registry events, service creation 

• Identity governance logs 

• Baselines for administrative behavior 

Detection examples to map: 

• New scheduled task created shortly after a suspicious login 

• Service installation from temp directories 

• Creation of new admin accounts outside approved workflows 

• Endpoint security tampering attempts 

A clean ATT&CK mapping here should include both detection logic and response logic, because persistence is where containment matters more than classification. 

6) Command and Control: prove you can see covert communication 

What attackers do: beacon, tunnel, use proxies, blend into common protocols. 

ATT&CK tactics often involved: Command and Control (TA0011) 

SIEM capabilities that matter: 

• DNS, proxy, firewall, network metadata, and ideally packet context 

• Detection of beaconing patterns and rare destinations 

• TLS and certificate visibility where possible 

Detection examples to map: 

• Periodic outbound connections with fixed intervals 

• Rare JA3  & JA4 like client fingerprints across multiple hosts (if you have that telemetry) 

• DNS requests with high entropy subdomains 

• Long lived outbound connections to new infrastructure 

This is where many SIEM platforms look good on paper and fail in practice. If you are missing network context, your C2 detection becomes guesswork.