free exercise · worked answer · real lab output
MITRE ATT&CK mapping exercise: map these real log lines to techniques
Real Linux and Windows lines from our Wazuh lab, mapped to ATT&CK techniques and compared with what Wazuh itself says.
The scenario
Your SOC writes a MITRE ATT&CK technique on every ticket, so that anyone can see at a glance what kind of step each event was and what usually comes next. Your lead hands you seven lines from one night on the lab network and asks you to map them. Some are from an attacker, some are from the administrator doing ordinary work, and you are not told which.
1 Nov 13 02:11:03 linux-server-01 sshd[6274]: error: maximum authentication attempts exceeded for student from 10.20.2.66 port 33510 ssh2 [preauth] 2 Nov 13 02:11:08 linux-server-01 sshd[6276]: Failed password for student from 10.20.2.66 port 45722 ssh2 3 Nov 13 02:11:22 linux-server-01 sshd[6278]: Accepted password for student from 10.20.2.66 port 48560 ssh2 4 Nov 13 02:09:50 linux-server-01 useradd[6249]: new user: name=backup-svc, UID=1002, GID=1002, home=/home/backup-svc, shell=/usr/sbin/nologin, from=none 5 Nov 13 02:09:30 linux-server-01 sshd[6087]: Accepted password for student from 10.20.1.50 port 35648 ssh2 6 win-server-01, a command Sysmon recorded being run: net user 7 win-server-01, a command Sysmon recorded being run: whoami /groups
For context: the administrator works from 10.20.1.50. Line 1 came after six wrong passwords in a row from 10.20.2.66, and line 2 is one of the ten failed passwords from that address in 36 seconds. Lines 6 and 7 are not raw log lines: they are the two commands that Sysmon recorded on the Windows server, written out plainly.
Your task: give each line the most specific ATT&CK technique or sub-technique the evidence supports, with its tactic. Then say which lines are part of an attack, and which you cannot judge from the line alone. Finally, compare your answer with what Wazuh itself tagged.
Words this exercise uses
- MITRE ATT&CK
- A free public catalogue of the ways attackers behave, used so that everyone describes attacks in the same words.
- Tactic
- The attacker's goal at that step, such as getting credentials (Credential Access) or finding out what is on a machine (Discovery).
- Technique and sub-technique
- How the goal is reached, such as T1110 Brute Force, and a more precise form of it, such as T1110.001 Password Guessing.
- Sysmon
- A free Microsoft tool that records events on Windows, such as every program that starts, so Wazuh can see them.
Show a hint
Map the behaviour the line shows, not your opinion of who did it. Two identical lines get the same technique even if one is an attacker and one is an administrator. Deciding which is which is a separate step.
Prefer a sub-technique when the line proves it. A failed password repeated many times is guessing; a successful login with a real password is a valid account being used; the way in, SSH, is its own technique.
Show the worked answer
Step 1. Map each line
| Line | What it shows | Technique | Tactic |
|---|---|---|---|
| 1 | sshd cut the connection after too many wrong passwords | T1110.001 Password Guessing (the same guessing, seen from the server's limit) | Credential Access |
| 2 | One of many failed passwords for one user from one address | T1110.001 Brute Force: Password Guessing; the channel is T1021.004 Remote Services: SSH | Credential Access; Lateral Movement for the SSH part |
| 3 | A correct password from the address that was guessing | T1078.003 Valid Accounts: Local Accounts, over T1021.004 SSH | Initial Access (T1078 also sits under Persistence, Privilege Escalation and Stealth) |
| 4 | useradd created a local account | T1136.001 Create Account: Local Account | Persistence |
| 5 | A correct password from the administrator's machine | T1078.003 Valid Accounts: Local Accounts, over T1021.004 SSH | Initial Access. The technique is the same as line 3; only the context makes it harmless. |
| 6 | net user lists the machine's local accounts | T1087.001 Account Discovery: Local Account | Discovery |
| 7 | whoami /groups shows who is logged in and their groups | T1033 System Owner/User Discovery | Discovery |
MITRE's own pages back each choice. T1087.001 names net user as a command that lists local accounts, T1033 names whoami, and T1136.001 names useradd on Linux. T1110.001 is the guessing of passwords, which is what ten wrong passwords for one user in 36 seconds are.
Step 2. Decide which lines are part of an attack
Lines 1, 2 and 3 are one attack: guessing from 10.20.2.66, then a login with the guessed password, about 14 seconds after the last attempt we listed. In ATT&CK terms the attacker moved from Credential Access to Initial Access. Line 5 has exactly the same technique as line 3, but it came from the administrator's usual machine, with no guessing before it, so it is ordinary work. Line 4 was the administrator's planned backup account, with no login shell. Lines 6 and 7 are the commands an attacker often runs first after getting in, and also commands administrators run every day. The lines alone cannot tell you which: you would check who was logged in to the Windows server at that moment and from where. In our lab we ran them ourselves to produce the alerts below.
Step 3. Compare with what Wazuh tagged
| Line | Wazuh rule | Wazuh's techniques | Ours | Why they differ |
|---|---|---|---|---|
| 1 | 5758 | T1110 | T1110.001 | Same technique; the line shows guessing, so the sub-technique is more precise. |
| 2 | 5760 | T1110.001, T1021.004 | T1110.001, T1021.004 | They agree. |
| 3 | 40112 | T1078, T1110 | T1078.003 (after T1110.001) | Wazuh tags the pattern, failures then success; we split it into the guessing and the account it opened. |
| 4 | 5902 | T1136 | T1136.001 | A useradd line proves a local account. |
| 5 | 5715 | T1078, T1021 | T1078.003, T1021.004 | Same behaviour as line 3; only the context says it is harmless. |
| 6 and 7 | 92031, with other Sysmon rules | T1087 on 92031 | T1087.001 and T1033 | Wazuh's rule 92031 groups discovery commands under one technique. Other Sysmon rules fired around them, for example 92036 when net.exe was started from a command prompt, tagged T1059.003 and T1574.001, which describe how the program was launched rather than what it was for. |
One more difference you will meet. Wazuh 4.14.10 lists the tactics of T1078 as Defense Evasion, Persistence, Privilege Escalation and Initial Access. In the current ATT&CK release (version 20, 13 October 2026), the old Defense Evasion tactic is split into TA0005, now called Stealth, and TA0112, Defense Impairment. T1078 sits under Stealth, which is why our table says Stealth. Write the tactic ID on the ticket, and nobody is confused by the change of name.
The raw alert behind line 3, as it reached the indexer, shows Wazuh's mapping inside the rule:
"rule": {
"level": 12,
"description": "Multiple authentication failures followed by a success.",
"id": "40112",
"mitre": {
"technique": ["Valid Accounts", "Brute Force"],
"id": ["T1078", "T1110"],
"tactic": ["Defense Evasion", "Persistence", "Privilege Escalation",
"Initial Access", "Credential Access"]
}
},
"data": { "srcip": "10.20.2.66", "dstuser": "student", "srcport": "48560" },
"full_log": "Nov 13 02:11:22 linux-server-01 sshd[6278]: Accepted password for student from 10.20.2.66 port 48560 ssh2"Part of the real alert for line 3, 13 November 2026 (compliance fields left out).
The answer. 1 and 2: T1110.001 Password Guessing (Credential Access), over T1021.004 SSH. 3 and 5: T1078.003 Valid Accounts: Local Accounts. 4: T1136.001 Create Account: Local Account (Persistence). 6: T1087.001 Account Discovery: Local Account. 7: T1033 System Owner/User Discovery. Only 1, 2 and 3 are the attack; 6 and 7 cannot be judged from the lines alone. A technique describes what happened; the context around it decides whether it was an attack.
The same lines appear as alerts in the alert triage exercise, where you decide which to escalate.
Questions people ask
What does it mean to map a log to MITRE ATT&CK?
It means naming the attacker behaviour the log line shows, as an ATT&CK technique such as T1110.001 Password Guessing. It tells the next analyst what kind of step this was and which steps usually come before and after it.
Is a mapped technique the same as an attack?
No. A mapping describes the behaviour, not the intent. Our administrator's own login maps to T1078 Valid Accounts exactly like the attacker's. The verdict comes from the context around the line.
Which technique is SSH password guessing?
T1110.001, Brute Force: Password Guessing, under the tactic Credential Access. The successful login that follows uses T1078 Valid Accounts, and the way in, SSH, is T1021.004 Remote Services: SSH.
Should I use the technique or the sub-technique?
Use the most specific one the evidence supports. A useradd line on Linux proves a local account, so T1136.001 Local Account is better than T1136 Create Account, which is what Wazuh's rule 5902 says.
Why does Wazuh say Defense Evasion when ATT&CK says Stealth?
In the current ATT&CK release, version 20 from 13 October 2026, the old Defense Evasion tactic is split into TA0005, now called Stealth, and TA0112, Defense Impairment. Valid Accounts, T1078, sits under Stealth. Wazuh 4.14.10's bundled mapping still uses the old name.
Where every number comes from
- Our AI SOC Analyst cloud lab on AWS, 13 Nov 2026: Wazuh 4.14.10, linux-server-01, admin-pc at 10.20.1.50, the attacker at 10.20.2.66; 41 alerts pulled with pull_alerts.py
- Our Windows Server in the same lab, 13 Nov 2026: Sysmon events in Wazuh after running whoami /groups and net user
- MITRE ATT&CK T1110 Brute Force (version 2.8) and T1110.001 Password Guessing (version 1.7), both modified 3 Nov 2026
- MITRE ATT&CK T1078 Valid Accounts and T1078.003 Local Accounts
- MITRE ATT&CK T1021.004 Remote Services: SSH (modified 3 Nov 2026)
- MITRE ATT&CK T1136.001 Create Account: Local Account (modified 4 Nov 2026)
- MITRE ATT&CK T1087.001 Account Discovery: Local Account, and T1033 System Owner/User Discovery
- MITRE ATT&CK Enterprise tactics page, current release v20 (13 Oct 2026): TA0005 Stealth and TA0112 Defense Impairment, where Defense Evasion used to be
- Wazuh 4.14.10 bundled ruleset: rule 5902 in 0020-syslog_rules.xml, rule 40112 in 0280-attack_rules.xml, read from the wazuh/wazuh-manager:4.14.10 image on 13 Nov 2026
This exercise comes from the course AI SOC Analyst, where each step is done on a real Wazuh lab and explained line by line. More exercises like it: Triaging five Wazuh alerts; Writing a Wazuh custom rule. Or see every free exercise.