Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Analyzing Threat Actor TTPs with MITRE Navigator · mukul975 | DecimalAI

Analyzing Threat Actor Ttps With Mitre Navigator

SkillScore17Maintained

analyzing-threat-actor-ttps-with-mitre-navigator

Map advanced persistent threat (APT) group tactics, techniques, and procedures (TTPs) to the MITRE ATT&CK framework using the ATT&CK Navigator and attackcti Python library. The analyst queries STIX/TAXII data for group-technique associations, generates Navigator layer files for visualization, and compares defensive coverage against adversary profiles. Activates for requests involving APT TTP mapping, ATT&CK Navigator layers, threat actor profiling, or MITRE technique coverage analysis.

Securityby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/analyzing-threat-actor-ttps-with-mitre-navigator/SKILL.md

decimalai skills pull analyzing-threat-actor-ttps-with-mitre-navigator --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/analyzing-threat-actor-ttps-with-mitre-navigator/SKILL.md https://app.decimal.ai/s/analyzing-threat-actor-ttps-with-mitre-navigator/SKILL.md

Raw file: /s/analyzing-threat-actor-ttps-with-mitre-navigator/SKILL.md ↗ · machine-readable summary at /s/analyzing-threat-actor-ttps-with-mitre-navigator.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 55d ago

Yes — +17% lift-14% tokens0% turns17% of whole cases pass with skill (4/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-01	✗→✓	▲ Improved	—	—
case-06	✗→✓	▲ Improved	—	—
case-14	✗→✓	▲ Improved	—	—
case-10	✗→✓	▲ Improved	—	—
case-21	✗→✗	＝ Same ✗	—	—

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/analyzing-threat-actor-ttps-with-mitre-navigator/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/8/2026Version v1Bundled 2 files · scripts

Skill contents

scripts/

references/

SKILL.md

Analyzing Threat Actor TTPs with MITRE Navigator

Overview

The MITRE ATT&CK Navigator is a web application for annotating and visualizing ATT&CK matrices. Combined with the attackcti Python library (which queries ATT&CK STIX data via TAXII), analysts can programmatically generate Navigator layer files mapping specific threat group TTPs, compare multiple groups, and assess detection coverage gaps against known adversaries.

When to Use

When investigating security incidents that require analyzing threat actor ttps with mitre navigator
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Python 3.8+ with attackcti and stix2 libraries installed
MITRE ATT&CK Navigator (web UI or local instance)
Understanding of STIX 2.1 objects and relationships

Steps

Query ATT&CK STIX data for target threat group using attackcti
Extract techniques associated with the group via STIX relationships
Generate ATT&CK Navigator layer JSON with technique annotations
Overlay detection coverage to identify gaps
Export layer for team review and defensive planning

Expected Output

json
{
  "name": "APT29 TTPs",
  "domain": "enterprise-attack",
  "techniques": [
    {"techniqueID": "T1566.001", "score": 1, "comment": "Spearphishing Attachment"},
    {"techniqueID": "T1059.001", "score": 1, "comment": "PowerShell"}
  ]
}

Illustrative Want to see what analyzing-threat-actor-ttps-with-mitre-navigator would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/27/2026, 23:48 UTC · 23 cases

Lift

+17%

17% vs 0%

Agent turns

1.0 vs 1.0

Tokens

-14%

1,008.78 vs 1,170.3

fail → pass · 4fail → fail · 19

Per-case results (23)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-21 A threat intelligence analyst is creating an ATT&CK Navigator layer file for mobile threat TTPs. What exact string value must be assigned to the `domain` key in the root JSON object for Mobile ATT&CK matrix layers?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-12 Once threat group techniques have been parsed from STIX relationships, what JSON output construction step must be performed prior to detection gap analysis?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-07 Beyond the primary ATT&CK TAXII client library (`attackcti`), what underlying Python library for working with STIX 2.1 objects and relationships is required to parse and process the returned threat intelligence objects?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-18 In the context of threat actor TTP analysis using ATT&CK Navigator, which specific ATT&CK matrix domain string is targeted when analyzing enterprise host and network techniques?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 A SOC team wants to programmatically fetch MITRE ATT&CK enterprise group techniques using Python via TAXII endpoints. They are considering using generic web scrapers or raw HTTP requests. What Python library specifically designed for querying ATT&CK STIX data via TAXII should they integrate alongside `stix2`?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-11 After obtaining the threat group STIX object from ATT&CK TAXII, what is the next procedural step to isolate the specific attack methods used by the group?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-19 A security engineer has generated an ATT&CK Navigator layer mapping APT29 TTPs and wants to assess detection gaps. What specific numeric field in the technique object of the layer schema is used to represent coverage status?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-05 To highlight technique prevalence or priority in an ATT&CK Navigator layer JSON file, you need to assign numerical values to techniques. The developer suggests using the key `"weight"` or `"priority"`. What standard key name does ATT&CK Navigator use for numerical technique scoring?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-08 When programmatically extracting adversary relationships from ATT&CK data via `attackcti`, what specific version of the Structured Threat Information Expression (STIX) standard object specification is utilized?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-09 You need to generate a minimal valid ATT&CK Navigator layer JSON object for group TTP visualization. Someone proposed using `matrix_domain` and `techniques_list` as root keys. What are the correct standard root JSON key names for layer title, ATT&CK domain, and technique list?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-06 A team is setting up an automated pipeline to run `attackcti` scripts for generating ATT&CK Navigator layers. They are considering running on legacy Python 3.6. What minimum Python runtime version is required for these STIX analysis dependencies?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-03 When constructing the `techniques` array inside a MITRE ATT&CK Navigator JSON layer file, a developer proposed using `technique_id` as the key for technique codes like `T1566.001`. What exact JSON key name does ATT&CK Navigator require for technique identifiers?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-15 What threat intelligence transport protocol standard is used by `attackcti` under the hood to pull ATT&CK STIX objects from MITRE's repository?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-13 After generating the baseline ATT&CK Navigator JSON layer containing threat actor TTPs, how do SOC analysts identify blind spots in their security controls?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-16 What type of software tool is MITRE ATT&CK Navigator and what is its primary interface capability for security analysts?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-22 When querying STIX 2.1 threat intelligence objects using Python STIX libraries, what exact string value is stored in the `relationship_type` attribute of a SDO relationship object connecting a Threat Actor or Intrusion Set to an Attack Pattern technique?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-20 What primary operational capability does programmatically generating ATT&CK Navigator layers via `attackcti` provide over manual matrix editing?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-23 In an ATT&CK Navigator layer JSON file, what exact root object key contains the configuration object for visual score color gradients and legend settings?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-17 Write a JSON object representing a single technique entry within the `techniques` array of an Enterprise ATT&CK Navigator layer for Spearphishing Attachment (T1566.001) with a score of 1 and comment "Spearphishing Attachment".	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-14 What is the final procedural step in the threat actor TTP analysis process after overlaying detection gaps in ATT&CK Navigator?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-04 In the technique array of an ATT&CK Navigator layer JSON file, you want to record descriptive text for why a technique was assigned to an adversary (e.g., "Spearphishing Attachment"). A colleague suggests using the key `"notes"`. What is the standard JSON key for textual annotations in ATT&CK Navigator technique objects?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-02 You are building a Python script to export an ATT&CK Navigator layer JSON file for APT29. Someone suggested setting `"domain": "mitre-enterprise"` in the root JSON object. What exact domain string value must be used for standard Enterprise ATT&CK matrix layer files?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-10 What is the initial procedural step when programmatically creating a threat actor TTP layer file for ATT&CK Navigator using Python threat intelligence tools?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted. The headline lift of +17 percentage points is the difference between those two pass rates over the 23 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 0%
Pass rate with the skill: 17.4%
Cases attempted: 23
Cases counted toward lift: 23
Cases that regressed: 0
Skill version measured: v1
Run completed: 7/27/2026, 23:48 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run17

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 54 days ago

Other measured skills in the registry, with their headline benchmark lift.