Turn what you saw into ATT&CK technique IDs MITRE
A report has to say WriteProcessMemory as T1055, a Run key as T1547.001. This maps the concrete things you observed to their ATT&CK techniques, so triage output speaks the language coverage and intel are written in.
What you observed
Paste API names, command lines, registry keys, LOLBins, behaviours, or SPECIMEN's output. One per line or run together; it scans for the concrete signals.
Techniques, by tactic
How it works
Reading the mapping
Each technique is named from a concrete indicator in your text, with the evidence shown and a link to its ATT&CK page. It is a high-confidence first pass: confirm each fits, add the techniques only context reveals, and drop any the evidence does not really support. The Navigator layer turns the mapping into a coverage picture. Pairs with SPECIMEN, whose output you can paste straight in.
Doing this often? The Sovereign Console pulls every indicator and timestamp across a whole case and exports a report to map against. On its own, US$4 a month; with everything else, US$9 a month or US$79 a year. 7 days free.