abstractionmaps.com

What It Is

Abstraction Maps is a cybersecurity reference site built around abstract mappings of MITRE ATT&CK techniques. The captured page shows multiple technique entries, including T1003.006 DCSYNC, T1033 User Session Enumeration, T1050 New Service, T1170 Mshta, and T1208 Kerberoasting. The highlighted example is T1050 New Service, listing key objects such as sc.exe, PowerShell New-Service, PSExec, SharpSC, reg.exe, Windows API, RPC interfaces, named pipes, and HKLM\SYSTEM\CurrentControlSet\Services.

Core Capabilities and Dimensions

In terms of protection category, it is not an EDR, WAF, NDR, or vulnerability management platform, but rather a security knowledge base / tactics-and-techniques mapping tool. Its core value lies in linking ATT&CK techniques to underlying implementation paths, such as OpenSCManager/CreateService, ROpenSCManager/RCreateService, \\PIPE\\svcctl, and \\PIPE\\winreg. This can help blue teams understand the logs, API calls, and registry artifacts associated with attack behaviors. Deployment model, compliance certifications, centralized management, alerting capabilities, and commercial integration capabilities are not shown in the text, so it should not be regarded as an enterprise-grade protection system that can be deployed directly.

Pricing and Ease of Use

The text does not mention pricing, subscriptions, free/paid tiers, or payment methods. The page structure is relatively simple, with navigation by ATT&CK Matrix and technique ID, so the learning curve is not steep. However, the content is fairly low-level and is mainly intended for security professionals who already have a foundation in Windows, RPC, the registry, and ATT&CK.

Pros and Cons

Its strengths are focused information and relatively fine-grained detail, making it useful for detection engineers writing Sigma, SIEM, or EDR detection logic, as well as for red teams reviewing the implementation chain of a technique. Its weaknesses are the lack of visible capabilities such as search, API access, export, alerts, and automation integrations. Its coverage and update frequency also cannot be determined from the text.

Best Fit and Access from China

It is better suited as reference material for security researchers, SOC analysts, threat hunters, and red/blue team practitioners. It is not suitable to purchase as a standalone protection product. Access status from China cannot be confirmed from the text, and both network connectivity and payment methods are unknown. For alternatives or complementary resources, consider MITRE ATT&CK, Atomic Red Team, LOLBAS, Sigma rule repositories, and detection content libraries from various SIEM/EDR platforms.