<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: performing-mitre-attack-threat-modeling
description: >-
  Map system threats to MITRE ATT&CK tactics, techniques, and procedures (TTPs) for detection coverage analysis, purple team planning, and threat-informed defense prioritization.
domain: cybersecurity
subdomain: threat-modeling
tags:
  - mitre-attack
  - ttps
  - detection-coverage
  - purple-team
  - threat-informed
  - navigator
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190", "T1078", "T1059", "T1053", "T1021", "T1557", "T1098"]
---

# Performing MITRE ATT&CK Threat Modeling

## Overview

MITRE ATT&CK-driven threat modeling maps identified threats to known adversary tactics,
techniques, and procedures (TTPs), enabling detection coverage analysis and threat-informed
defense prioritization. This technique covers ATT&CK mapping, coverage gap analysis, and
Navigator layer generation.

Mode: `[MODE: PURPLE]` — ATT&CK-mapped detection engineering and coverage analysis.

## Prerequisites

- MITRE ATT&CK framework knowledge (Enterprise, Mobile, ICS matrices)
- ATT&CK Navigator for visualization: `npm install -g attack-navigator`
- Detection rule inventory (Sigma, KQL, SPL)
- Threat intelligence on relevant threat actors
- Python 3.10+

## Key Concepts

### ATT&CK Matrix Structure

| Level | Description | Example |
|-------|-------------|---------|
| Tactic | Why — adversary goal | Initial Access, Persistence |
| Technique | How — method used | T1190 Exploit Public-Facing App |
| Sub-technique | Specific variation | T1059.001 PowerShell |
| Procedure | Implementation detail | APT29 uses PowerShell for C2 |

### Coverage Analysis

| Coverage Level | Description | Action |
|----------------|-------------|--------|
| None | No detection capability | Priority gap — implement detection |
| Partial | Some visibility, not reliable | Improve fidelity, add data sources |
| Good | Reliable detection, tested | Maintain, update for evasion |
| Excellent | Multiple detection layers | Monitor for new sub-techniques |

### Threat Actor Mapping

Map relevant threat actors to their known TTPs for focused defense:
1. Identify adversaries targeting your sector
2. Pull their TTP profiles from ATT&CK Groups
3. Overlay on your detection coverage
4. Prioritize gaps in adversary-relevant techniques

## Workflow

### Step 1: Map Threats to ATT&CK

```bash
node scripts/agent.js --action map --input threats.json --output attack-mapping.json
```

### Step 2: Analyze Detection Coverage

```bash
# Compare ATT&CK mapping against detection rules
node scripts/agent.js --action coverage --input attack-mapping.json --rules rules/ --output coverage.json
```

### Step 3: Generate Navigator Layer

```bash
node scripts/agent.js --action navigator --input coverage.json --output navigator-layer.json
```

### Step 4: Gap Analysis and Recommendations

```bash
node scripts/agent.js --action gaps --input coverage.json --output gap-report.json
```

## Verification

- [ ] All identified threats mapped to ATT&CK techniques
- [ ] Detection coverage assessed for each mapped technique
- [ ] Navigator layer generated for visualization
- [ ] Coverage gaps prioritized by adversary relevance
- [ ] Detection rules recommended for critical gaps
- [ ] Threat actor TTP profiles overlaid on coverage map

## References

- [MITRE ATT&CK](https://attack.mitre.org/)
- [ATT&CK Navigator](https://mitre-attack.github.io/attack-navigator/)
- [Sigma Rules](https://github.com/SigmaHQ/sigma)
- [MITRE D3FEND](https://d3fend.mitre.org/)
