CISA updated its Best Practices for MITRE ATT&CK Mapping, bringing the June 2021 guide in line with ATT&CK v9 through v12: new platforms, redefined data sources and detections, and Campaigns. Campaigns, added in ATT&CK v12 in October 2022, group intrusion activity by time frame and shared targets and objectives, whether or not anyone can pin it on a specific threat actor. The new section on common mistakes is the useful part, for example mapping malware that talks on ports 80/443 to T1071.001 without ever confirming it actually speaks HTTP. It also adds ICS-specific mapping guidance and a list of biases, such as novelty, visibility and availability bias, that skew which techniques end up in reports in the first place. Worth a read for anyone who has suffered through a threat report that is mostly a wall of technique IDs.
