Skip to content
Get packs

Mapping Threat Actor TTPs to MITRE ATT&CK

Map attacker behaviour to MITRE ATT&CK techniques, build Navigator heatmaps, and spot detection gaps.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
7 files

What it does

Once installed, the agent can take a threat actor's known behaviours or observed indicators and map them to techniques in the MITRE ATT&CK knowledge base, a public catalogue of how real attackers operate. It can generate ATT&CK Navigator layer files (colour-coded heatmaps of techniques), compare several threat groups, and point out where a defender's detections may not cover the observed behaviour. The skill also includes a Python script that fetches ATT&CK data from MITRE's servers and produces these outputs.

Great for

  • Security analysts writing threat intelligence reports on a specific adversary group
  • Detection engineers checking which observed techniques lack monitoring coverage
  • Students learning how ATT&CK, STIX data and Navigator fit together

Skip it if

  • Live incident response where speed matters more than mapping rigour, since the workflow is report-oriented and needs analyst review
  • Organisations that cannot send queries to MITRE's servers or GitHub, because the default script downloads data from the internet
  • Readers expecting authoritative attribution: the skill maps described behaviour to techniques but does not establish who is responsible for an attack

Try asking

  • “Map the techniques used by APT29 and generate a Navigator layer I can open in the ATT&CK Navigator”
  • “Compare the TTPs of APT28, APT29 and Lazarus Group and summarise the overlaps”
  • “Given these IOCs and log observations, which ATT&CK techniques do they correspond to and what detection gaps remain?”
Step-by-step guide: how to use Mapping Threat Actor TTPs to MITRE ATT&CKInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 7 original files, the Apache-2.0 licence and an attribution note.

    analyzing-threat-actor-ttps-with-mitre-attack.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip analyzing-threat-actor-ttps-with-mitre-attack.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip analyzing-threat-actor-ttps-with-mitre-attack.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Review generated Navigator layers and mapped techniques before sharing; automated mapping from descriptions can be imprecise.
  • Supply a local copy of the ATT&CK STIX bundle to avoid repeated network downloads and to pin a specific ATT&CK version.
  • Provide your own detections file when asking for gap analysis so the output reflects your actual coverage.

What's inside

  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.