Using ATT&CK Navigator

What You Need for This Project

Purpose

To compare APT groups in the ATT&CK framework.

Creating a New Layer

Open this page:

https://mitre-attack.github.io/attack-navigator/

Click the drop-down arrow in the "Create New Layer" line.

Click the drop-down arrow in the "More Options" line.

Select Version ATT&CK v9 and domain Enterprise, as shown below.

Then click Create.

Selecting a Group

Click the "search & multiselect" button, outlined in red in the image below.

In the pane that pops up on the right, select the Technique, Threat Group, Software, Mitigation, or Data Source of interest, such as APT41. Then click the "search & multiselect" button again to make that pane go away.

Then click the Scoring button, outlined in blue in the image below. Assign a score of 1. Click the Scoring button again.

The tactics used by that group turn red, as shown below.

At the top left, click the tab label and change its name to the correct value, outlined in yellow in the image below.

Adding a New Layer

At the top left, click the plus sign next to the tab.

Create a new layer as you did before.

Select a group, such as APT29. Give it a score of 2.

Put the group name on the tab label.

Your screen should resemble the image below.

Adding a Calculated Layer

At the top left, click the plus sign next to the tabs.

Click the drop-down arrow in the "Create Layer from other layers" line.

Click the drop-down arrow in the "More Options" line.

Select a domain of Enterprise ATT&CK v9 and a "score expression" of a + b as shown below.

Then scroll to the bottom and click Create.

The boxes are now colored to indicate all the possible scores, as shown below.

Hover the mouse over a box to see its score. It will turn blue while the pointer is on it.

Posted 7-25-2021
Updated 9-23-2021
Updated 9-29-22