Analyzing Apt Group With Mitre Navigator

mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-apt-group-with-mitre-navigator

作者 mukul97554a798831d2266a3ca61ce68a7acb80b81160d57Apache-2.0收录于 2026年10月9日更新于 2026年10月9日

Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one or more APT groups' TTPs for detection-gap analysis. Use to compare threat-actor technique coverage, find gaps in detection engineering, or produce Navigator visualizations for threat-intel reporting.

包含脚本SecurityData & Analytics
AI 生成的概览

查询 APT 组织的 MITRE ATT&CK 数据，并生成用于检测缺口分析的 ATT&CK Navigator 图层。

功能
使用 attackcti、mitreattack-python 和 stix2 查询 ATT&CK 数据，收集一个或多个 APT 组织被归因的技术。随后生成 ATT&CK Navigator 图层 JSON 文件，包括将威胁行为者 TTP 与检测能力映射进行对比的多图层叠加。还会输出战术分布以及跨组织共有与独有技术的对比，供检测工程和威胁情报报告使用。
适用场景
适用于比较威胁行为者的技术覆盖范围、发现检测工程中的缺口，或为威胁情报报告生成 ATT&CK Navigator 可视化。适合 SOC 分析师编写检测规则或验证相关技术的监控覆盖情况。
运行要求
需要 Python 3.9+ 以及 attackcti、mitreattack-python、stix2 和 requests 库，并需要访问 ATT&CK 数据（TAXII）的网络连接。该技能附带可执行脚本（scripts/agent.py）和参考文档；生成的图层需使用 ATT&CK Navigator 渲染。

Analyzing APT Group with MITRE ATT&CK Navigator

Overview

MITRE ATT&CK Navigator is a web-based tool for annotating and exploring ATT&CK matrices, enabling analysts to visualize threat actor technique coverage, compare multiple APT groups, identify detection gaps, and build threat-informed defense strategies. This skill covers querying ATT&CK data programmatically, mapping APT group TTPs to Navigator layers, creating multi-layer overlays for gap analysis, and generating actionable intelligence reports for detection engineering teams.

When to Use

  • When investigating security incidents that require analyzing apt group with mitre navigator
  • When building detection rules or threat hunting queries for this domain
  • When SOC analysts need structured procedures for this analysis type
  • When validating security monitoring coverage for related attack techniques

Prerequisites

  • Python 3.9+ with attackcti, mitreattack-python, stix2, requests libraries
  • ATT&CK Navigator (https://mitre-attack.github.io/attack-navigator/) or local deployment
  • Understanding of ATT&CK Enterprise matrix: 14 Tactics, 200+ Techniques, Sub-techniques
  • Access to threat intelligence reports or MISP/OpenCTI for threat actor data
  • Familiarity with STIX 2.1 Intrusion Set and Attack Pattern objects

Key Concepts

ATT&CK Navigator Layers

Navigator layers are JSON files that annotate ATT&CK techniques with scores, colors, comments, and metadata. Each layer can represent a single APT group's technique usage, a detection capability map, or a combined overlay. Layer version 4.5 supports enterprise-attack, mobile-attack, and ics-attack domains with filtering by platform (Windows, Linux, macOS, Cloud, Azure AD, Office 365, SaaS).

APT Group Profiles in ATT&CK

ATT&CK catalogs over 140 threat groups with documented technique usage. Each group profile includes aliases, targeted sectors, associated campaigns, software used, and technique mappings with procedure-level detail. Groups are identified by G-codes (e.g., G0016 for APT29, G0007 for APT28, G0032 for Lazarus Group).

Multi-Layer Analysis

The Navigator supports loading multiple layers simultaneously, allowing analysts to overlay threat actor TTPs against detection coverage to identify gaps, compare multiple APT groups to find common techniques worth prioritizing, and track technique coverage changes over time.

Workflow

Step 1: Query ATT&CK Data for APT Group

python
from attackcti import attack_clientimport json
lift = attack_client()
# Get all threat groupsgroups = lift.get_groups()print(f"Total ATT&CK groups: {len(groups)}")
# Find APT29 (Cozy Bear / Midnight Blizzard)apt29 = next((g for g in groups if g.get('name') == 'APT29'), None)if apt29:    print(f"Group: {apt29['name']}")    print(f"Aliases: {apt29.get('aliases', [])}")    print(f"Description: {apt29.get('description', '')[:300]}")
# Get techniques used by APT29 (G0016)techniques = lift.get_techniques_used_by_group("G0016")print(f"APT29 uses {len(techniques)} techniques")
technique_map = {}for tech in techniques:    tech_id = ""    for ref in tech.get("external_references", []):        if ref.get("source_name") == "mitre-attack":            tech_id = ref.get("external_id", "")            break    if tech_id:        tactics = [p.get("phase_name", "") for p in tech.get("kill_chain_phases", [])]        technique_map[tech_id] = {            "name": tech.get("name", ""),            "tactics": tactics,            "description": tech.get("description", "")[:500],            "platforms": tech.get("x_mitre_platforms", []),            "data_sources": tech.get("x_mitre_data_sources", []),        }

Step 2: Generate Navigator Layer JSON

python
def create_navigator_layer(group_name, technique_map, color="#ff6666"):    techniques_list = []    for tech_id, info in technique_map.items():        for tactic in info["tactics"]:            techniques_list.append({                "techniqueID": tech_id,                "tactic": tactic,                "color": color,                "comment": info["name"],                "enabled": True,                "score": 100,                "metadata": [                    {"name": "group", "value": group_name},                    {"name": "platforms", "value": ", ".join(info["platforms"])},                ],            })
    layer = {        "name": f"{group_name} TTP Coverage",        "versions": {"attack": "16.1", "navigator": "5.1.0", "layer": "4.5"},        "domain": "enterprise-attack",        "description": f"Techniques attributed to {group_name}",        "filters": {            "platforms": ["Linux", "macOS", "Windows", "Cloud",                          "Azure AD", "Office 365", "SaaS", "Google Workspace"]        },        "sorting": 0,        "layout": {            "layout": "side", "aggregateFunction": "average",            "showID": True, "showName": True,            "showAggregateScores": False, "countUnscored": False,        },        "hideDisabled": False,        "techniques": techniques_list,        "gradient": {"colors": ["#ffffff", color], "minValue": 0, "maxValue": 100},        "legendItems": [            {"label": f"Used by {group_name}", "color": color},            {"label": "Not observed", "color": "#ffffff"},        ],        "showTacticRowBackground": True,        "tacticRowBackground": "#dddddd",        "selectTechniquesAcrossTactics": True,        "selectSubtechniquesWithParent": False,        "selectVisibleTechniques": False,    }    return layer
layer = create_navigator_layer("APT29", technique_map)with open("apt29_layer.json", "w") as f:    json.dump(layer, f, indent=2)print("[+] Layer saved: apt29_layer.json")

Step 3: Compare Multiple APT Groups

python
groups_to_compare = {"G0016": "APT29", "G0007": "APT28", "G0032": "Lazarus Group"}group_techniques = {}
for gid, gname in groups_to_compare.items():    techs = lift.get_techniques_used_by_group(gid)    tech_ids = set()    for t in techs:        for ref in t.get("external_references", []):            if ref.get("source_name") == "mitre-attack":                tech_ids.add(ref.get("external_id", ""))    group_techniques[gname] = tech_ids
common_to_all = set.intersection(*group_techniques.values())print(f"Techniques common to all groups: {len(common_to_all)}")for tid in sorted(common_to_all):    print(f"  {tid}")
for gname, techs in group_techniques.items():    others = set.union(*[t for n, t in group_techniques.items() if n != gname])    unique = techs - others    print(f"\nUnique to {gname}: {len(unique)} techniques")

Step 4: Detection Gap Analysis with Layer Overlay

python
# Define your current detection capabilitiesdetected_techniques = {    "T1059", "T1059.001", "T1071", "T1071.001", "T1566", "T1566.001",    "T1547", "T1547.001", "T1053", "T1053.005", "T1078", "T1027",}
actor_techniques = set(technique_map.keys())covered = actor_techniques.intersection(detected_techniques)gaps = actor_techniques - detected_techniques
print(f"=== Detection Gap Analysis for APT29 ===")print(f"Actor techniques: {len(actor_techniques)}")print(f"Detected: {len(covered)} ({len(covered)/len(actor_techniques)*100:.0f}%)")print(f"Gaps: {len(gaps)} ({len(gaps)/len(actor_techniques)*100:.0f}%)")
# Create gap layer (red = undetected, green = detected)gap_techniques = []for tech_id in actor_techniques:    info = technique_map.get(tech_id, {})    for tactic in info.get("tactics", [""]):        color = "#66ff66" if tech_id in detected_techniques else "#ff3333"        gap_techniques.append({            "techniqueID": tech_id,            "tactic": tactic,            "color": color,            "comment": f"{'DETECTED' if tech_id in detected_techniques else 'GAP'}: {info.get('name', '')}",            "enabled": True,            "score": 100 if tech_id in detected_techniques else 0,        })
gap_layer = {    "name": "APT29 Detection Gap Analysis",    "versions": {"attack": "16.1", "navigator": "5.1.0", "layer": "4.5"},    "domain": "enterprise-attack",    "description": "Green = detected, Red = gap",    "techniques": gap_techniques,    "gradient": {"colors": ["#ff3333", "#66ff66"], "minValue": 0, "maxValue": 100},    "legendItems": [        {"label": "Detected", "color": "#66ff66"},        {"label": "Detection Gap", "color": "#ff3333"},    ],}with open("apt29_gap_layer.json", "w") as f:    json.dump(gap_layer, f, indent=2)

Step 5: Tactic Breakdown Analysis

python
from collections import defaultdict
tactic_breakdown = defaultdict(list)for tech_id, info in technique_map.items():    for tactic in info["tactics"]:        tactic_breakdown[tactic].append({"id": tech_id, "name": info["name"]})
tactic_order = [    "reconnaissance", "resource-development", "initial-access",    "execution", "persistence", "privilege-escalation",    "defense-evasion", "credential-access", "discovery",    "lateral-movement", "collection", "command-and-control",    "exfiltration", "impact",]
print("\n=== APT29 Tactic Breakdown ===")for tactic in tactic_order:    techs = tactic_breakdown.get(tactic, [])    if techs:        print(f"\n{tactic.upper()} ({len(techs)} techniques):")        for t in techs:            print(f"  {t['id']}: {t['name']}")

Validation Criteria

  • ATT&CK data queried successfully via TAXII server
  • APT group mapped to all documented techniques with procedure examples
  • Navigator layer JSON validates and renders correctly in ATT&CK Navigator
  • Multi-layer overlay shows threat actor vs. detection coverage
  • Detection gap analysis identifies unmonitored techniques with data source recommendations
  • Cross-group comparison reveals shared and unique TTPs
  • Output is actionable for detection engineering prioritization

References

来源与署名

来源：mukul975/Anthropic-Cybersecurity-Skills位于skills/analyzing-apt-group-with-mitre-navigator提交54a7988

许可证： Apache-2.0

内容归原作者所有。SourceWeft 从公开仓库中收录这些内容。

举报或申请下架

更多来自 mukul975/Anthropic-Cybersecurity-Skills 的技能

Exploiting Sql Injection Vulnerabilities

mukul975

在授权渗透测试中识别并利用 Web 应用中的 SQL 注入漏洞。

包含脚本
Security2026年10月9日

Analyzing Network Traffic With Wireshark

mukul975

使用 Wireshark 和 tshark 捕获并分析网络数据包，识别恶意流量并支持事件响应调查。

包含脚本
Security2026年10月9日

Analyzing Dns Logs For Exfiltration

mukul975

从 SIEM 中的 DNS 查询日志检测基于 DNS 的数据外泄、隧道、DGA 域名和隐蔽 C2 通道。

包含脚本
Security2026年10月9日

Analyzing Cloud Storage Access Patterns

mukul975

通过统计基线与异常检测，识别 AWS S3、GCS 和 Azure Blob 存储中的异常访问行为。

包含脚本
Security2026年10月9日

Analyzing Campaign Attribution Evidence

mukul975

使用钻石模型与竞争性假设分析评估网络战役证据，将攻击归因于特定威胁行为体。

包含脚本
Security2026年10月9日

Analyzing Certificate Transparency For Phishing

mukul975

通过 crt.sh 和 Certstream 监控证书透明度日志，检测钓鱼域名和仿冒证书。

包含脚本
Security2026年10月9日

更多Security技能

Kyc Rules

anthropics

精选

将公司的 KYC/AML 规则表应用于已解析的开户记录，评定风险并给出处理路由。

Security39K2周前更新

Kyc Rules

anthropics

精选

将公司的 KYC/AML 规则表应用于已解析的开户记录，评定风险并给出处理路由。

Security39K2周前更新

Compliance Tracking

anthropics

精选

跟踪合规要求、审计准备情况以及 SOC 2、ISO 27001、GDPR、HIPAA 和 PCI DSS 等框架的证据。

Security27K今天更新

Google Cloud Scc Remediation

google

精选

指导修复 Google Cloud Security Command Center 发现项，提供需用户批准的方案与参考手册。

Security21K昨天更新

Google Cloud Recipe Auth

google

精选

指导用户、服务账号和工作负载如何对 Google Cloud 服务与 API 进行身份验证和授权。

Security21K昨天更新

Dpop Adoption

google

精选

指导为 Google OAuth 平台实现 OAuth 2.0 DPoP（RFC 9449）发送方约束刷新令牌。

Security21K昨天更新