mcpField
A
analyzing-threat-actor-ttps-with-mitre-navigator

analyzing-threat-actor-ttps-with-mitre-navigator

github.com/mukul975Security35.2k270 installsUpdated 8w ago
Repository

About analyzing-threat-actor-ttps-with-mitre-navigator

A security analysis skill that uses attackcti and MITRE ATT&CK data to map threat-group techniques into Navigator layers. It is intended for analysts reviewing adversary behavior and defensive detection coverage.

Key features

  1. 01Query ATT&CK STIX data
  2. 02Extract group-linked techniques
  3. 03Generate Navigator layer JSON
  4. 04Overlay detection coverage
  5. 05Export layers for review

Use cases

  1. 01Map a threat group's ATT&CK techniques
  2. 02Compare adversary behavior
  3. 03Identify detection coverage gaps
  4. 04Prepare layers for defensive planning

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/mukul975/anthropic-cybersecurity-skills --skill analyzing-threat-actor-ttps-with-mitre-navigator

After installing, type/analyzing-threat-actor-ttps-with-mitre-navigatorin Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

LICENSE
references/
api-reference.md
scripts/
agent.py

Details

From the project README

Analyzing Threat Actor TTPs with MITRE Navigator

Overview

The MITRE ATT&CK Navigator is a web application for annotating and visualizing ATT&CK matrices. Combined with the attackcti Python library (which queries ATT&CK STIX data via TAXII), analysts can programmatically generate Navigator layer files mapping specific threat group TTPs, compare multiple groups, and assess detection coverage gaps against known adversaries.

When to Use

  • When investigating security incidents that require analyzing threat actor ttps with mitre navigator
  • When building detection rules or threat hunting queries for this domain
  • When SOC analysts need structured procedures for this analysis type
  • When validating security monitoring coverage for related attack techniques

Prerequisites

  • Python 3.8+ with attackcti and stix2 libraries installed
  • MITRE ATT&CK Navigator (web UI or local instance)
  • Understanding of STIX 2.1 objects and relationships

Steps

  1. Query ATT&CK STIX data for target threat group using attackcti
  2. Extract techniques associated with the group via STIX relationships
  3. Generate ATT&CK Navigator layer JSON with technique annotations
  4. Overlay detection coverage to identify gaps
  5. Export layer for team review and defensive planning

Expected Output

{
  "name": "APT29 TTPs",
  "domain": "enterprise-attack",
  "techniques": [
    {"techniqueID": "T1566.001", "score": 1, "comment": "Spearphishing Attachment"},
    {"techniqueID": "T1059.001", "score": 1, "comment": "PowerShell"}
  ]
}

Comments

Markdown supported