Lab 04 · evidence mapping
ATT&CK mappings with the evidence left attached.
Search the complete Enterprise catalogue, inspect official relationships, then compare a phishing behaviour model with reviewed actor evidence.
Open the matrix →697ATT&CK techniques
15Enterprise tactics
33HECAVEX mappings
0public sources
Evidence boundary. A behaviour model describes plausible branches, not a mandatory intrusion sequence. An actor cell means reviewed public reporting supports that relationship. An empty tactic does not prove absence. Neither view is an automated attribution result.
Interactive matrix
Compare behaviour, then inspect the claim
Loading evidence…
No reviewed mapping matches this view.
Interpretation model
What the labels mean
A source states the behaviour
The relationship remains attributed to the named publisher. HECAVEX has reviewed and structured it, not independently observed the intrusion.
HECAVEX holds direct evidence
Reserved for evidence collected or reproduced during a documented HECAVEX investigation. None of the initial actor mappings use this label.
An analytical inference is explicit
Used only when the relationship is reasoned from stated evidence and limitations. It must never be visually confused with source reporting.
MITRE attribution. ATT&CK data attribution loading… HECAVEX is independent and is not affiliated with or endorsed by MITRE. Terms of use ↗