Analyzing APT Group with MITRE ATT&CK Navigator

Overview

MITRE ATT&CK Navigator is a web-based tool for annotating and exploring ATT&CK matrices, enabling analysts to visualize threat actor technique coverage, compare multiple APT groups, identify detection gaps, and build threat-informed defense strategies. This skill covers querying ATT&CK data programmatically, mapping APT group TTPs to Navigator layers, creating multi-layer overlays for gap analysis, and generating actionable intelligence reports for detection engineering teams.

Prerequisites

• Python 3.9+ with attackcti, mitreattack-python, stix2, requests libraries
• ATT&CK Navigator (https://mitre-attack.github.io/attack-navigator/) or local deployment
• Understanding of ATT&CK Enterprise matrix: 14 Tactics, 200+ Techniques, Sub-techniques
• Access to threat intelligence reports or MISP/OpenCTI for threat actor data
• Familiarity with STIX 2.1 Intrusion Set and Attack Pattern objects

Key Concepts

ATT&CK Navigator Layers

Navigator layers are JSON files that annotate ATT&CK techniques with scores, colors, comments, and metadata. Each layer can represent a single APT group's technique usage, a detection capability map, or a combined overlay. Layer version 4.5 supports enterprise-attack, mobile-attack, and ics-attack domains with filtering by platform (Windows, Linux, macOS, Cloud, Azure AD, Office 365, SaaS).