MITRE ATT&CK

ShadowMap maps threat intelligence data to the MITRE ATT&CK framework, providing a visual matrix and sortable list of tactics and techniques used by threat actors relevant to your organization. The matrix includes a heat map based on actor intensity and an optional coverage overlay that lets you mark which techniques your defenses cover -- revealing gaps in your detection posture.

Overview

View Modes

The page supports two views, toggled via buttons in the header:

• Matrix View -- Visual ATT&CK matrix with tactics as columns and techniques as cells, color-coded by actor intensity. This is the primary view.
• List View -- Sortable table of all techniques with filters. Best for searching and bulk review.

Matrix View

Reading the Matrix

• Columns represent ATT&CK tactics -- the attacker's goal at each stage (Reconnaissance, Initial Access, Execution, Persistence, etc.)
• Cells represent techniques -- specific methods used to achieve those goals
• Each cell shows the technique's MITRE ID and name
• A count badge on each tactic header shows how many techniques fall under it

Heat Map

Cells are color-coded by actor intensity -- how many tracked threat actors are known to use each technique:

Color	Intensity	Meaning
No color	None	No tracked actors use this technique
Light shade	Low	A small number of actors use this technique
Medium shade	Medium	Multiple actors use this technique
Dark shade	High	Many actors use this technique
Darkest shade	Critical	A large number of actors use this technique -- high priority for detection

Hover over any cell to see a tooltip with the technique's MITRE ID, name, and exact actor count.

Coverage Overlay

Click the Coverage button in the header to enable the coverage overlay. When active:

• Covered techniques show a shield icon and green border -- these are techniques your team has marked as having detection or prevention controls
• Gap techniques show a red indicator -- these are techniques without coverage
• Right-click any technique cell to toggle its coverage status
• The legend updates to show both the heat map and coverage indicators

The coverage overlay persists across sessions, building a living map of your defensive posture.

List View

The list view presents techniques in a filterable, sortable table:

Column	Description
ID	MITRE ATT&CK technique ID (e.g., T1059, T1566.001)
Name	Technique name (e.g., Command and Scripting Interpreter, Spearphishing Attachment)
Tactic	The ATT&CK tactic this technique belongs to
Platforms	Operating systems and platforms where this technique applies
Actors	Count of threat actors known to use this technique

Filters (List View)

Filter	Options
Tactic	Filter by ATT&CK tactic
Platform	Filter by target platform (Windows, Linux, macOS, etc.)
Search	Free-text search across technique IDs and names

Export (List View)

Click the export button to download the current filtered technique list as an Excel file.

How to Use the ATT&CK Matrix

Use Case	How
Identify gaps	Enable coverage overlay. Techniques with high actor intensity but no coverage are your highest-priority detection gaps.
Prioritize detections	Focus on Initial Access and Persistence techniques used by actors targeting your sector -- stopping or detecting attackers early is the most cost-effective defense.
Brief stakeholders	Use the matrix view in board presentations for at-a-glance coverage. Export the list view for compliance audit evidence.
Map to controls	Cross-reference techniques with NIST CSF, CIS Controls, ISO 27001, or PCI DSS to validate control effectiveness.
Purple teaming	Select techniques from actors targeting your sector, build attack chains across tactics, test whether detections fire, and update coverage based on results.

Related

• Threat Actors -- Actor profiles link to their specific ATT&CK techniques
• Campaigns -- Campaign TTPs map to ATT&CK techniques
• Malware -- Malware capabilities map to ATT&CK techniques
• Threat Intelligence Overview -- ATT&CK technique count in hero metrics
• Vulnerabilities (CVEs) -- CVEs exploited by actors using specific techniques