ATT&CK Heatmap

What it does

Threat feeds give you hashes, URLs, IPs, and malware names. Useful, but they leave a practical question open: which ATT&CK techniques are showing up in the data, and do your detections cover them?

ATT&CK Heatmap closes that gap in one CLI run. It pulls current feed data, maps malware families to ATT&CK techniques, checks coverage across Sigma rules and detection lists, and writes two files:

$ python main.py --feeds feodo malwarebazaar --kev --detection-lists --d3fend

outputs/gaps.md
outputs/layer.json

gaps.md gives a ranked view of uncovered techniques with source-feed context, priority labels, detection-list attribution, and D3FEND countermeasure suggestions. layer.json loads directly into ATT&CK Navigator.

Pipeline

Live feeds (ThreatFox, Feodo, MalwareBazaar, URLhaus, YARAify)
    + CISA KEV (ATT&CK IDs direct from CTID mapping)
    + optional VirusTotal enrichment
         ↓
ATT&CK Mapper (malware family → technique IDs via STIX)
         ↓
Coverage diff:
  Sigma rules (sigma/rules/**/*.yml)
  + mthcht detection lists (15 curated lists, no API key)
         ↓
TIE ranking + D3FEND countermeasure lookup
         ↓
outputs/gaps.md          outputs/layer.json
(ranked gap report       (Navigator heatmap)
 with D3FEND section)

Feature status

CISA KEV feed

CISA's Known Exploited Vulnerabilities catalogue is public and requires no API key. The feed carries ATT&CK technique IDs from the CTID KEV-ATT&CK mapping, so KEV entries bypass the STIX family-lookup step and contribute technique IDs directly to the active set.

This adds a different signal than malware family feeds. CVE-2021-44228 (Log4Shell) maps to T1190. CVE-2017-0144 (EternalBlue) maps to T1210. Those techniques may or may not appear from ThreatFox on any given day — having a second authoritative source helps fill that gap.

mthcht detection lists

Sigma rules cover what your rule set includes. The --detection-lists flag fetches 15 curated lists from mthcht/awesome-lists and maps each one to its ATT&CK techniques: suspicious named pipes, LOLDrivers hashes, HijackLibs DLL paths, ransomware extensions, offensive tool keywords, and more.

The covered-techniques table in gaps.md gains a "Detection Source" column so you can see at a glance whether a technique is covered by a Sigma rule, a detection list, or both.

D3FEND countermeasures

For each top gap technique, the --d3fend flag queries the public MITRE D3FEND API and adds a countermeasures section to gaps.md. The output tells you not just "T1071 is uncovered" but which defensive techniques address it, linked directly to the D3FEND knowledge base. D3FEND covers 309 ATT&CK techniques mapped to 3,109 countermeasures.

Design decisions

Stateless CLI, not a platform. Runs on demand or on a schedule. No database, no frontend.

Two coverage layers. Sigma rules cover what you have written. Detection lists cover what the security community has catalogued. Both matter; neither replaces the other.

CISA KEV as a direct-technique feed. KEVs do not carry malware family names, so the STIX mapper would fail on them. The pipeline has a separate path: entries that already carry technique IDs skip the mapper entirely.

D3FEND as triage support, not a prescription. The countermeasures in the report are suggestions. Some will already be in place. The value is having the answer in the same document as the gap, so you do not have to cross-reference the D3FEND site manually for every uncovered technique.

Artifact-first output. The markdown report is readable in GitHub and includes everything needed for a review. The Navigator layer is ready to open without any extra steps.