Turn What You Saw Into ATT&CK Technique IDs MITRE
A report has to say WriteProcessMemory as T1055, a Run key as T1547.001. This maps the concrete things you observed to their ATT&CK techniques, so triage output speaks the language coverage and intel are written in.
What you observed
Paste API names, command lines, registry keys, LOLBins, behaviours — or SPECIMEN's output. One per line or run together; it scans for the concrete signals.
Techniques, by tactic
Reading the mapping
Each technique is named from a concrete indicator in your text, with the evidence shown and a link to its ATT&CK page. It is a high-confidence first pass: confirm each fits, add the techniques only context reveals, and drop any the evidence does not really support. The Navigator layer turns the mapping into a coverage picture. Pairs with SPECIMEN, whose output you can paste straight in.