Mapping the simulated attacks to MITRE ATT&CK
Each of the 35 simulated attacks links directly to its MITRE ATT&CK technique. That single link turns a tool-specific scenario into a shared vocabulary — one a SOC, a red team and an auditor already speak — and makes a simulation result comparable with threat intelligence and detection coverage.
Why anchor scenarios to ATT&CK
A scenario named « consent phishing » is clear to the person who wrote it. A scenario tagged T1528 — Steal Application Access Token is clear to everyone: the SOC that hunts for it, the detection engineer who covers it, the CTI analyst who tracks the actors who use it. ATT&CK is the common reference layer, so anchoring each simulated attack to its technique lets a simulation result plug straight into work that already exists.
In EntraGUARD, clicking the name of an attack opens its ATT&CK technique page directly. There is no internal, hand-written summary to maintain and go stale — the authoritative description lives at MITRE, and the tool points to it.
The mapping, by phase
The technique IDs below are the ones each scenario points to. Some scenarios share a technique — several cloud-account abuses legitimately map to the same ATT&CK entry — and that is expected: ATT&CK describes behaviour, and different weaknesses can enable the same behaviour.
| Attack | Technique |
|---|---|
| AiTM / session theft | T1557 — Adversary-in-the-Middle |
| Device code phishing | T1566.002 — Spearphishing Link |
| Password spray | T1110.003 — Password Spraying |
| Legacy authentication | T1078.004 — Cloud Accounts |
| MFA fatigue | T1621 — MFA Request Generation |
| Consent phishing / permissive user consent / no admin consent workflow / dangerous redirect URIs | T1528 — Steal Application Access Token |
| Shadow admin / dangerous app permissions / role-assignable groups / standing privileged roles / tenant-takeover Graph permissions | T1098.003 — Additional Cloud Roles |
| Service principal & risky application credentials / standing TAP | T1098.001 — Additional Cloud Credentials |
| Break-glass abuse / stale admins / no MFA / privileged guests / unhandled risky users | T1078.004 — Cloud Accounts |
| Guest surface / open guest invitations | T1136.003 — Create Cloud Account |
| Conditional Access bypass / no Conditional Access / no baseline protection | T1556 — Modify Authentication Process (incl. .009 Conditional Access) |
| Cross-tenant / sync abuse | T1199 — Trusted Relationship |
| Golden SAML / federation | T1606.002 — SAML Tokens |
| Rogue external identity provider | T1556.007 — Hybrid Identity |
| Ownerless applications / user app registration / exploitable dynamic groups | T1098 — Account Manipulation |
| Anonymous SharePoint / OneDrive sharing | T1213 — Data from Information Repositories |
What the mapping is — and isn't
The link points to the technique that best describes the scenario's behaviour. It is a navigation aid and a shared label, not a claim of full ATT&CK coverage: the simulator does not implement every procedure under a technique, and one tenant weakness can map to a technique that also has procedures the simulator does not test. Read the mapping as « this is the ATT&CK behaviour this path belongs to », then use MITRE's page for the full procedure list and the detection and mitigation guidance.
Verify the technique IDs against MITRE. ATT&CK evolves — sub-techniques get renumbered and split. The IDs above are the mapping the tool ships with; if one no longer resolves on attack.mitre.org, it is the mapping to update, not the finding.
Using it in a SOC or a report
- Detection coverage. Take the techniques behind your viable paths and check them against your detection content. A viable path with no matching detection is a double gap — exposed and blind.
- Threat alignment. If your CTI flags an actor using T1557 or T1606.002 against your sector, the simulator tells you immediately whether that exact path is viable on your tenant.
- Reporting. A findings table with an ATT&CK column reads as credible to a technical audience and maps cleanly onto a defender's existing framework — no translation needed.