A step in an intrusion write-up has no matching ATT&CK technique — what do you do?

## The pull towards full coverage Mapping feels like a completion exercise: read the account, attach identifiers, be thorough. That instinct produces the most common defect in the craft — forcing the nearest available technique onto prose that describes something ATT&CK does not model. Ask what the catalogue is for. ATT&CK enumerates **behaviours an adversary performs** against systems on platforms it covers, grouped by the goal those behaviours serve. That is a narrow target compared with what a write-up contains. ## What routinely has no identifier **Conditions of the target.** "The pod ran as root and the service-account token was mounted by default." Nothing was done here by anybody; this is how the environment stood before the operator arrived. Conditions are the province of weakness and configuration vocabularies — a CWE-style weakness class, a CVE record when a specific product version is at fault, a control-class statement about what should have removed it — and of none of them is a technique identifier a substitute. **Motive, attribution and consequence.** "The crew appears financially motivated." "The company disclosed three weeks later." "Two hundred customers were affected." These are claims about people and outcomes, not behaviours. **The author's own speculation.** If the write-up says the operator *probably* pivoted, the text has offered you a possibility, and a technique row would convert it into a described behaviour. **Behaviour on ground the catalogue does not cover.** Coverage is platform-scoped and evolves; something performed against a system outside the covered platforms may have no home, even though it plainly happened. **Steps too coarse or too specific to name.** "They spent two days poking around" describes duration and effort, not a technique. Conversely a fully idiosyncratic action may simply have no entry. ## Why forcing an identifier is worse than a gap A row is a claim: *this account describes behaviour matching this technique*. Attach one to a sentence that cannot support it and you have manufactured that claim. Three consequences follow. First, it is unfalsifiable to the next reader, who sees an identifier and not the sentence. Second, it contaminates comparison: if you and somebody else both map the same intrusion and one of you forced rows, the diff between your mappings now measures your habits rather than the sources. Third, the claim travels — mappings get copied into summaries and profiles, and the nearest-fit row is indistinguishable from a well-supported one once it moves. A declared gap has none of those properties. "Paragraphs 4–6 describe the target's configuration and carry no technique" is a precise, checkable statement. ## The convention 1. Map behaviour; leave everything else unmapped. 2. Record *why* a passage is unmapped when the reason is interesting — condition, motive, out of scope, speculation. This is cheap and it pre-empts the reviewer who asks whether you simply missed it. 3. If the same behaviour keeps recurring across accounts with no home in the catalogue, that is worth raising with the framework's maintainers as a gap rather than papering over locally with a near-miss. 4. Never treat the proportion of an account that carries identifiers as a quality measure of the mapping. It is a property of the account. ## The distinction that makes it click ATT&CK names **what an adversary did**. CWE names **the kind of weakness that let them**. CVE names **a specific vulnerable product**. A control class names **what would have removed the opportunity**. A sentence about a default-mounted token is a weakness-and-control sentence; giving it a technique number does not make it a behaviour, it only makes your mapping wrong in a way that is hard to see later.