网络安全 Analyzing Threat Actor Ttps With Mitre Navigator

Analyzing Threat Actor Ttps With Mitre Navigator：网络安全 skill: analyzing-threat-actor-ttps-with-mitre，适用于安全分析、取证与威胁排查场景。

Skill Documentation

网络安全 Analyzing Threat Actor Ttps With Mitre Navigator

摘要

Analyzing Threat Actor Ttps With Mitre Navigator：网络安全 skill: analyzing-threat-actor-ttps-with-mitre，适用于安全分析、取证与威胁排查场景。

> 来源: mukul975/Anthropic-Cybersecurity-Skills (18k stars) — 网络安全专业技能集

> 原文件: skills/analyzing-threat-actor-ttps-with-mitre-navigator/SKILL.md

> 模型推荐: claude-opus-4-7 (安全分析深度推理)

这个 skill 是干嘛的

mukul975 整理的 100+ 个网络安全专业 skill — 覆盖渗透测试 / 取证 / 威胁情报 / 合规审计 / 云安全 / 移动安全 等领域。每个 skill 对应一个具体的安全分析任务。

michael 强调"skill 要有相应的指导功能,指导用户使用",所以加了下面两节让 Agent 和用户对接。

---

🤖 Agent 使用说明

1. 用户提到"分析 X 日志 / 取证 / 检测威胁 / 渗透测试 / 安全审计"时触发对应 skill

2. skill 按操作步骤执行(取证镜像 / 解析日志 / 跑威胁情报)

3. 涉及破坏性操作前必须 ask user 确认

4. 完工后跑自检

5. 区分"防御性分析" vs "恶意代码审计"

👤 用户需要做什么?

1. 告诉 Agent 你要做什么(分析日志 / 取证 / 安全审计 / 渗透测试)

2. 按 Agent 提示提供文件/镜像/日志/哈希

3. 涉及破坏性操作时明确告诉 Agent"继续"或"取消"

4. 全程 Agent 自动化,你只需提供数据 + 回答决策点

---

原 skill 内容(mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-threat-actor-ttps-with-mitre-navigator/SKILL.md,截断到 12k chars)

---

name: analyzing-threat-actor-ttps-with-mitre-navigator

description: 'Map advanced persistent threat (APT) group TTPs to the MITRE ATT&CK framework using the attackcti Python library to query STIX/TAXII data for group-technique associations, then generate ATT&CK Navigator layer files to visualize and compare defensive coverage against adversary profiles. Use when profiling an APT group''s techniques, building Navigator coverage heatmaps, or assessing technique coverage gaps against a specific threat actor.

'

domain: cybersecurity

subdomain: threat-intelligence

tags:

• mitre-attack
• navigator
• threat-intelligence
• apt
• ttp-mapping
• stix
• attackcti

version: '1.0'

author: mahipal

license: Apache-2.0

nist_ai_rmf:

• MEASURE-2.7
• MAP-5.1
• MANAGE-2.4

atlas_techniques:

• AML.T0070
• AML.T0066
• AML.T0082

d3fend_techniques:

• File Metadata Consistency Validation
• Application Protocol Command Analysis
• Identifier Analysis
• Content Format Conversion
• Message Analysis

nist_csf:

• ID.RA-01
• ID.RA-05
• DE.CM-01
• DE.AE-02

mitre_attack:

• T1566.001
• T1059.001
• T1071.001
• T1547.001
• T1053.005

---

Analyzing Threat Actor TTPs with MITRE Navigator

Overview

The MITRE ATT&CK Navigator is a web application for annotating and visualizing ATT&CK matrices.

Combined with the attackcti Python library (which queries ATT&CK STIX data via TAXII), analysts

can programmatically generate Navigator layer files mapping specific threat group TTPs, compare

multiple groups, and assess detection coverage gaps against known adversaries.

When to Use

• When investigating security incidents that require analyzing threat actor ttps with mitre navigator
• When building detection rules or threat hunting queries for this domain
• When SOC analysts need structured procedures for this analysis type
• When validating security monitoring coverage for related attack techniques

Prerequisites

• Python 3.8+ with attackcti and stix2 libraries installed
• MITRE ATT&CK Navigator (web UI or local instance)
• Understanding of STIX 2.1 objects and relationships

Steps

1. Query ATT&CK STIX data for target threat group using attackcti

2. Extract techniques associated with the group via STIX relationships

3. Generate ATT&CK Navigator layer JSON with technique annotations

4. Overlay detection coverage to identify gaps

5. Export layer for team review and defensive planning

Expected Output

{
  "name": "APT29 TTPs",
  "domain": "enterprise-attack",
  "techniques": [
    {"techniqueID": "T1566.001", "score": 1, "comment": "Spearphishing Attachment"},
    {"techniqueID": "T1059.001", "score": 1, "comment": "PowerShell"}
  ]
}

常见问题（FAQ）

使用「Analyzing Thre」这个 skill 能解决什么问题?

本 skill 专注于Analyzing Thre，网络安全 skill: analyzing-threat-actor-ttps-with-mitre-navigator。它将相关流程标准化，帮助用户更快拿到可靠结果，减少重复手工操作。

什么情况下适合使用「Analyzing Thre」?

当你需要在Analyzing Threat Actor Ttps With Mitre Navigator相关工作中获得稳定、可复用的产出时最适合——无论是单次任务还是纳入日常工作流，都能直接调用。

使用「Analyzing Thre」前需要准备什么?

需要明确授权范围内的目标系统或样本文件，并准备隔离的分析环境（虚拟机/沙箱）。