Package: attack-lookup
%%%%%#########%%%%%                              
                    ###%%%%##                 &%%%                          
               (#####%%          /.. .,,,,&      .%%                        
           //((###            . ...**//((... ,     %%                       
       ***//((               (..***//((...*#,,,     %%                      
   *******                  #(#./((((#......,%#(     %                      
    *****                   @%##....#%%%%%,,%#((     %                      
      ****//                 %%%%,,%%%%%%%**/((     #                       
         *//((#*               %%,%%%%%##((((      %                        
            ((####%               ,((((((/                                  
               #####%%#,                                         **         
                   ##%%%#####                              //**             
                        %%%%#########%.          ######((/                  
                               %%%%%#%%%%%%%%%#####                         

                              by Curated IntelligenceMITRE ATT&CK Lookup Toolattack-lookupis a tool that lets you easily check what Tactic, Technique, or Sub-technique ID maps to what name, and vice versa. It can be used interactively, for batch processing, or in your own tooling.Installationattack-lookupcan be installed from PyPI:$ pip install attack-lookupIt can also be installed manually:$ git clone https://github.com/curated-intel/attack-lookup.git
$ cd attack-lookup
$ python setup.py install --userUsage$ attack-lookup --help
usage: attack-lookup [-h] [-v VERSION] [-m {enterprise,ics,mobile}] [-O] [-i INPUT] [-o OUTPUT] [--output-mode {results,csv}]

MITRE ATT&CK Lookup Tool

optional arguments:
  -h, --help            show this help message and exit
  -v VERSION, --version VERSION
                        ATT&CK matrix version to use (default: v10.1)
  -m {enterprise,ics,mobile}, --matrix {enterprise,ics,mobile}
                        ATT&CK matrix to use (default: enterprise)
  -O, --offline         Run in offline mode (default: False)
  -i INPUT, --input INPUT
                        Path to input file (one lookup value per line) (default: None)
  -o OUTPUT, --output OUTPUT
                        Path to output file (default: -)
  --output-mode {results,csv}
                        Mode for output file ("result" only has the lookup results, "csv" outputs a CSV with the lookup and result values (default: results)By default,attack-lookupuses the latest version of the Enterprise matrix. When running in Online mode,attack-lookuppulls the latest matrix from MITRE's GitHubrepo. When running in Offline mode, it can use any matrix available inattack_lookup/data.You can useattack-lookupin interactive or batch mode:$ attack-lookup
(loading latest enterprise matrix...done)
Running attack-lookup in interactive mode, exit with (q)uit. Enter one or more values to lookup, separated by a comma.
ATT&CK> T1539
Steal Web Session Cookie
ATT&CK>For batch mode, specify an input file, and optionally an output file/mode. By default, output will go tostdout.$ attack-lookup -i test
(loading latest enterprise matrix...done)
Collection
T1133
Peripheral Device Discovery

$ attack-lookup -i test --output-mode=csv
(loading latest enterprise matrix...done)
TA0009,Collection
External Remote Services,T1133
T1120,Peripheral Device Discovery

$ attack-lookup -i test --output-mode=csv -o out_file
(loading latest enterprise matrix...done)
Wrote output data to out_fileIf multiple mappings exist (e.g., "Domains"),attack-lookupwill provide all possible values:ATT&CK> Domains
Multiple possible values: T1583.001, T1584.001APIYou can also useattack-lookupin your own scripts.fromattack_lookupimportAttackMapping# version is ignored when running online FYSAmapping=AttackMapping(matrix="enterprise",version="v10.1",offline=False)# load the data# this can take ~10secifnotmapping.load_data():print("failed to load data")else:mapping.lookup("T1574")# returns "Hijack Execution Flow"