captures four things: The specific behavior — not the technique category The source references that support it, with evidence labels Candidate ATT&CK technique mappings and the reasoning behind each candidate Required telemetry, a detection idea, validation plan, and known limitations Confidence Labels Each record carries one of four evidence labels inherited from the source assessment: Observed — the behavior appears directly in source telemetry, a recovered sample, a screenshot, or a...
