Map advanced persistent threat (APT) group tactics, techniques, and procedures (TTPs) to the MITRE ATT&CK framework using the ATT&CK Navigator and attackcti Python library. The analyst queries STIX/TAXII data for group-technique associations, generates Navigator layer files for visualization, and compares defensive coverage against adversary profiles. Activates for requests involving APT TTP mapping, ATT&CK Navigator layers, threat actor profiling, or MITRE technique coverage analysis.
Automate repetitive workflows and reduce manual effort
Example: Generate reports, summarize documents, draft communications
Save 3-5 hours per week on routine tasks
Learn new skills, understand complex topics, get expert guidance
Example: Explain concepts, provide examples, suggest learning resources
Accelerate learning and skill development by 2x
Enhance output quality through reviews, suggestions, and refinements
Example: Review drafts, suggest improvements, catch errors
Improve work quality by 30-40% with less effort
Time estimate: 15-45 minutes depending on use case complexity
Prerequisites
Submit your Claude Code skill and start earning
epx add mukul975/Anthropic-Cybersecurity-Skills/analyzing-threat-actor-ttps-with-mitre-navigatorCompatible with
Supported agents
| name | analyzing-threat-actor-ttps-with-mitre-navigator |
| description | 'Map advanced persistent threat (APT) group tactics, techniques, and procedures (TTPs) to the MITRE ATT&CK framework using the ATT&CK Navigator and attackcti Python library. The analyst queries STIX/TAXII data for group-technique associations, generates Navigator layer files for visualization, and compares defensive coverage against adversary profiles. Activates for requests involving APT TTP mapping, ATT&CK Navigator layers, threat actor profiling, or MITRE technique coverage analysis. ' |
| domain | cybersecurity |
| subdomain | threat-intelligence |
| tags | - mitre-attack - navigator - threat-intelligence - apt - ttp-mapping - stix - attackcti |
| version | '1.0' |
| author | mahipal |
| license | Apache-2.0 |
| nist_ai_rmf | - MEASURE-2.7 - MAP-5.1 - MANAGE-2.4 |
| atlas_techniques | - AML.T0070 - AML.T0066 - AML.T0082 |
| d3fend_techniques | - File Metadata Consistency Validation - Application Protocol Command Analysis - Identifier Analysis - Content Format Conversion - Message Analysis |
| nist_csf | - ID.RA-01 - ID.RA-05 - DE.CM-01 - DE.AE-02 |
The MITRE ATT&CK Navigator is a web application for annotating and visualizing ATT&CK matrices. Combined with the attackcti Python library (which queries ATT&CK STIX data via TAXII), analysts can programmatically generate Navigator layer files mapping specific threat group TTPs, compare multiple groups, and assess detection coverage gaps against known adversaries.
{
"name": "APT29 TTPs",
"domain": "enterprise-attack",
"techniques": [
{"techniqueID": "T1566.001", "score": 1, "comment": "Spearphishing Attachment"},
{"techniqueID": "T1059.001", "score": 1, "comment": "PowerShell"}
]
}
AI-first code editor with Composer
Before installing skills in Cursor, ensure your development environment meets these requirements:
node --versionanalyzing-threat-actor-ttps-with-mitre-navigatorExecute the skills CLI command in your project's root directory to begin installation:
epx add mukul975/Anthropic-Cybersecurity-Skills/analyzing-threat-actor-ttps-with-mitre-navigatorFetches analyzing-threat-actor-ttps-with-mitre-navigator from mukul975/Anthropic-Cybersecurity-Skills and configures it for Cursor.
The CLI shows a list of agents. Use arrow keys and space to select Cursor:
Confirm successful installation by checking the skill directory location:
.cursor/skills/analyzing-threat-actor-ttps-with-mitre-navigator
Restart Cursor to activate analyzing-threat-actor-ttps-with-mitre-navigator. Access via /analyzing-threat-actor-ttps-with-mitre-navigatorin your agent's command palette.
Learn more:View source on GitHubSkills CLI docsAbout CursorWhat are agent skills?
Steps
Common Pitfalls
✓ Do
✗ Don't
💡 Pro Tips
✓ Use when
Use when skill capabilities match your task, clear ROI on time saved, and you can validate outputs. Best for repetitive tasks, learning, and quality improvement.
✗ Avoid when
Avoid when task requires deep expertise you can't validate, involves sensitive decisions, or when learning process is more valuable than speed of completion.
detecting-insider-threat-behaviors
mukul975/Anthropic-Cybersecurity-Skills · detecting-insider-threat-behaviors · same repo
performing-thick-client-application-penetration-test
mukul975/Anthropic-Cybersecurity-Skills · performing-thick-client-application-penetration-test · same repo
hunting-credential-stuffing-attacks
mukul975/Anthropic-Cybersecurity-Skills · hunting-credential-stuffing-attacks · same repo
analyzing-outlook-pst-for-email-forensics
mukul975/Anthropic-Cybersecurity-Skills · analyzing-outlook-pst-for-email-forensics · same repo
performing-scada-hmi-security-assessment
mukul975/Anthropic-Cybersecurity-Skills · performing-scada-hmi-security-assessment · same repo
testing-for-xxe-injection-vulnerabilities
mukul975/Anthropic-Cybersecurity-Skills · testing-for-xxe-injection-vulnerabilities · same repo
analyzing-threat-actor-ttps-with-mitre-navigator fits our agent workflows well — practical, well scoped, and easy to wire into existing repos.
analyzing-threat-actor-ttps-with-mitre-navigator is among the better-maintained entries we tried; worth keeping pinned for repeat workflows.
analyzing-threat-actor-ttps-with-mitre-navigator is among the better-maintained entries we tried; worth keeping pinned for repeat workflows.
analyzing-threat-actor-ttps-with-mitre-navigator reduced setup friction for our internal harness; good balance of opinion and flexibility.
Solid pick for teams standardizing on skills: analyzing-threat-actor-ttps-with-mitre-navigator is focused, and the summary matches what you get after install.
Registry listing for analyzing-threat-actor-ttps-with-mitre-navigator matched our evaluation — installs cleanly and behaves as described in the markdown.
Keeps context tight: analyzing-threat-actor-ttps-with-mitre-navigator is the kind of skill you can hand to a new teammate without a long onboarding doc.
Registry listing for analyzing-threat-actor-ttps-with-mitre-navigator matched our evaluation — installs cleanly and behaves as described in the markdown.
Useful defaults in analyzing-threat-actor-ttps-with-mitre-navigator — fewer surprises than typical one-off scripts, and it plays nicely with `npx skills` flows.
analyzing-threat-actor-ttps-with-mitre-navigator has been reliable in day-to-day use. Documentation quality is above average for community skills.
showing 1-10 of 70