STAGE 5: CORRELATE

MITRE ATT&CK® Enterprise Matrix Auto-Mapper

Complete 14-tactic Enterprise matrix with automated technique illumination, dynamic telemetry observation logs, and ATT&CK Navigator layer export.

ACTIVE SAMPLE MITRE COVERAGE• WannaCry.exe

6 Active ATT&CK Techniques Identified

Spanning 6 Enterprise Tactics across the intrusion killchain.

T1190T1059.003T1543.003T1070.004T1071.001T1486

Killchain Phase

Ransomware

Reconnaissance

TA0043

No static techniques mapped in this tier.

Resource Dev

TA0042

No static techniques mapped in this tier.

Initial Access

TA0001

1 ACTIVE

T1190

Exploit Public-Facing App

Propagates autonomously across internal subnets via SMBv1 vulnerability (CVE-2017-0144).

T1566.001

Spearphishing Attachment

Execution

TA0002

1 ACTIVE

T1059.001

PowerShell Scripting

T1059.003

Windows Command Shell

Spawns cmd.exe to invoke vssadmin.exe and icacls.exe to wipe shadow copies.

T1106

Native API Execution

Persistence

TA0003

1 ACTIVE

T1543.003

Windows Service

Creates persistent service 'mssecsvc2.0' (Microsoft Security Center (2.0) Service).

T1547.001

Registry Run Keys

Privilege Escalation

TA0004

T1055.012

Process Hollowing

T1055.001

Reflective DLL Injection

Defense Evasion

TA0005

1 ACTIVE

T1070.004

File Deletion / Shadow Wipe

Executes wbadmin, bcdedit, and vssadmin to prevent system recovery.

T1027

Obfuscated Information

T1036

Masquerading as Utility

Credential Access

TA0006

T1555.003

Credentials from Web Browsers

T1003.001

OS Credential Dumping: LSASS

Discovery

TA0007

T1082

System Information Discovery

T1012

Query Registry

Lateral Movement

TA0008

T1210

Exploitation of Remote Services

T1021.002

SMB Named Pipes

Collection

TA0009

T1005

Data from Local System

T1115

Clipboard Data

Command & Control

TA0011

1 ACTIVE

T1071.001

Web Protocols (Malleable HTTPS)

Probes killswitch domain www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com prior to payload detonation.

T1095

Non-Application Layer TCP

T1571

Non-Standard Port Protocol

Exfiltration

TA0010

T1041

Exfiltration Over C2 (HTTP POST)

Impact

TA0040

1 ACTIVE

T1486

Data Encrypted for Impact

Appends .WNCRY extension to encrypted files and renders @WanaDecryptor@.exe UI.