Adding MITRE Fight Fraud Framework (F3) mapping to existing skills

[mukul975]

MITRE Fight Fraud Framework (F3) — Adding Support to This Repo

MITRE's Center for Threat-Informed Defense released the Fight Fraud Framework (F3)
on April 9, 2026 — an ATT&CK-compatible framework covering the full lifecycle of
cyber-enabled financial fraud. I'm adding F3 mappings to existing skills in this repo.

What is MITRE F3?

F3 extends ATT&CK with 7 tactics. Two are completely new and don't exist in ATT&CK:

Tactic	Type	Description
Reconnaissance	Shared with ATT&CK	Gathering victim/org info for fraud planning
Resource Development	Shared with ATT&CK	Building mule accounts, infrastructure
Initial Access	Shared with ATT&CK	Gaining foothold via phishing, stolen creds
Defense Evasion	Shared with ATT&CK	Bypassing fraud scoring, KYC, transaction monitoring
Positioning	🆕 F3-only	Post-access prep: SIM swap, session hijack, account warming
Execution	Shared with ATT&CK	Initiating transfers, submitting fraudulent claims
Monetization	🆕 F3-only	Cash-out, mule layering, crypto conversion

How I'm implementing it

Adding a mitre_f3 block to existing skill YAML frontmatter — no new files,
no restructuring. Just an additional framework mapping alongside mitre_attack:

mitre_f3:
  version: "1.0"
  tactics:
    - positioning
    - monetization
  techniques:
    - id: T1566
      name: "Phishing"
      tactic: initial-access
      source: attack        # reused ATT&CK ID with fraud-tuned definition
    - id: F1XXX
      name: "SIM Swap"
      tactic: positioning
      source: f3            # F3-native fraud-specific technique

Skills I’m targeting first
• Phishing / Social Engineering → Reconnaissance, Initial Access, Positioning
• Account Takeover → Positioning, Execution, Monetization
• Malware Analysis (banking trojans) → Positioning, Execution, Monetization
• Network Security → Reconnaissance, Defense Evasion
• DFIR / Incident Response → All 7 tactics
• Threat Intelligence → All 7 tactics
Want to help?
If you’d like to contribute F3 mappings for a specific domain:

1. Pick a skill
2. Add a mitre_f3: block to its YAML frontmatter
3. Map tactics first — technique IDs can be pulled from the
   official F3 matrix
4. Open a PR with the label mitre-f3-mapping
   References
   F3 Matrix: https://ctid.mitre.org/fraud/#/matrix
   CTID Blog: https://ctid.mitre.org/blog/2026/04/09/fraud-fighters-unite-with-mitre-f3/
   F3 GitHub: https://github.com/center-for-threat-informed-defense/fight-fraud-framework