mitre-attack-framework SKILL.md skillA
mitre-attack-framework from hermeticormus/libresecops-claude-code is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add hermeticormus/libresecops-claude-code/mitre-attack-framework@git:20260930.71a2663Pins git:20260930.71a2663 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- hermeticormus/libresecops-claude-code
- Path
plugins/red-team-operations/skills/mitre-attack-framework/SKILL.md- Versions recorded
- 2
- Latest version
- git:20260930.71a2663, committed Sep 30, 2026
- First version recorded
- Feb 25, 2026
- Size
- 10,598 bytes
- Repository stars
- 4
- License
- MIT
MITRE ATT&CK Enterprise reference: tactics, key techniques with procedures, data sources, detection guidance, and mitigations. Use when mapping behavior to technique IDs, building detections, or planning authorized emulation.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# MITRE ATT&CK Framework > Reference knowledge covering ATT&CK Enterprise tactics, selected key techniques with detection guidance, and framework usage for adversary emulation planning. ## Knowledge Base ### What is MITRE ATT&CK MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a globally accessible knowledge base of adversary behavior based on real-world observations. It catalogs the TTPs (Tactics, Techniques, and Procedures) used by threat actors, organized into a matrix that maps the phases of an attack lifecycle. ATT&CK serves both offense and defense: - **Red teams** use it to plan realistic adversary emulations. - **Blue teams** use it to build detections, measure coverage, and prioritize gaps. - **Threat intelligence** uses it as a common language for describing adversary behavior. ### Enterprise ATT&CK Tactics (v15) The 14 tactics represent the adversary's tactical objectives -- the "why" behind each action: | ID | Tactic | Purpose | Example Question | |----|--------|---------|-----------------| | TA0043 | Reconnaissance | Gather info for targeting | What is exposed on the internet? | …
Read the whole file at its exact version.
How to install
mdr add hermeticormus/libresecops-claude-code/mitre-attack-framework@sha256:ed2c2f643af6dc34The line at the top of this page pins the label git:20260930.71a2663, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_p4iu54kgcvtjh7xv)
3 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 2 versions of this file, between Feb 25, 2026 and Sep 30, 2026, about one every 218 days. Its first recorded version is graded C and its latest A.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20260930.71a2663 latest | 2026-09-30 | 71a2663 | 10,598 B | A | view · diff |
| git:20260225.4a0a620 | 2026-02-25 | 4a0a620 | 10,317 B | C | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (10598 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
hermeticormus/libresecops-claude-code · 4 stars · license MIT · pushed 2026-10-04 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_p4iu54kgcvtjh7xv GET https://markdownregistry.com/api/v1/resolve?ref=hermeticormus/libresecops-claude-code/mitre-attack-framework GET https://markdownregistry.com/api/v1/blob/ed2c2f643af6dc34dceb755adf6d6ec90f68e966c8ac48b2a29151f85661bbbb
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.