## Load an ATT&CK phase mapping

Use Load JSON to open any mapping in the Mandiant M-Trends shape
(`phases[].techniques[]` with `percentage` and `tlctcMapping`),
or click Mandiant 2026 to load the shipped example.

#

phases
techniques
top %
source

## Filter by TLCTC cluster

sort by % hide filtered out

## Cluster frequency across all observed techniques (weighted by %)

###

of Mandiant 2025 investigations
TLCTC mapping
Rationale