Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.decepticon.red/llms.txt

Use this file to discover all available pages before exploring further.

MITRE’s Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) is a curated knowledge base of cyber-adversary behavior, organized by the phases of an adversary’s lifecycle and the platforms they target. Decepticon uses ATT&CK as the connective tissue between threat profiles, OPPLAN objectives, skills, and findings.

​
The TTP Hierarchy

ATT&CK is built on a three-level hierarchy. Decepticon adopts this vocabulary consistently — agents, skills, and findings all reference the same identifiers.

Tactics

The tactical goals a threat may pursue during an operation. Examples: Initial Access (TA0001), Execution (TA0002), Persistence (TA0003), Privilege Escalation (TA0004).

Techniques

The actions threats take to achieve their tactical goals. Examples: T1566 Phishing, T1059 Command and Scripting Interpreter, T1078 Valid Accounts.

Procedures

The technical steps required to perform a technique in a specific environment. Procedures are concrete commands, scripts, and tool invocations.

​
Where ATT&CK Surfaces in Decepticon

ATT&CK is not just metadata — it is the type system Decepticon agents reason in.
SurfaceATT&CK Use
Threat ProfileThe profile lists in-scope techniques; Decepticon refuses out-of-profile actions.
OPPLAN ObjectivesEvery objective carries a mitre_attack field with one or more T-IDs.
SkillsSkill frontmatter includes mitre_attack: T1590, T1591, ... — used for filtering and trigger matching.
ConOpsThe “adversary of record” section enumerates the techniques the threat is known to use.
FindingsEach finding produced by Decepticon is tagged with the technique used and the resulting evidence.
Defense BriefThe Defender agent’s output maps each offensive action to the corresponding detection or mitigation technique.

​
Skill Frontmatter Example

A Decepticon skill carries ATT&CK metadata that the orchestrator uses to load only the right skills for the active engagement: 
---
name: passive-recon
description: "Use when gathering intelligence WITHOUT touching the target"
allowed-tools: Bash Read Write
metadata:
  subdomain: reconnaissance
  tags: passive, dns, subdomain-enum, whois, ct-logs
  mitre_attack: T1590, T1591, T1592
---
When a threat profile lists T1590 as an in-scope technique, this skill becomes available. When the operator switches to a profile that does not include it, the skill is excluded from the agent’s working set.

​
ATT&CK Matrix Coverage

Decepticon’s skill library covers the canonical attack lifecycle:
TacticDecepticon Coverage
ReconnaissancePassive recon (OSINT, CT logs, DNS), active recon (port scan, service enum)
Resource DevelopmentImplant generation via Sliver C2
Initial AccessWeb exploitation, AD initial access, phishing-payload generation
ExecutionBash, PowerShell, scripting via interactive sandbox
PersistenceService hijacking, scheduled tasks, WMI (via Post-Exploit)
Privilege EscalationLocal privesc, domain privesc (AD Operator)
Defense EvasionOPSEC skill set, AMSI/ETW awareness, log evasion
Credential AccessKerberoasting, LSASS dumping, cloud key extraction
DiscoveryInternal recon, AD enumeration, cloud metadata abuse
Lateral MovementPass-the-hash, RDP, SSH pivoting, cloud session theft
CollectionSensitive-data discovery, screenshot capture
Command and ControlSliver mTLS / HTTPS / DNS channels, tiered callbacks
ExfiltrationDNS tunneling, web upload, C2 channel exfil
ImpactModeled but constrained by RoE — proof-of-impact only

​
ATT&CK Navigator Export

Decepticon emits an ATT&CK Navigator-compatible JSON layer per engagement, listing exactly which techniques were used and which produced findings. This file becomes part of the engagement deliverable — the blue team can overlay it on their own detection coverage to find gaps.
The TTP hierarchy is verbatim from MITRE: Tactics are goals, Techniques are actions, Procedures are concrete steps. Decepticon agents are trained to use these terms precisely — never interchangeably.

Skill System

How the progressive-disclosure skill loader filters by ATT&CK technique overlap.