<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-threat-actor-ttps
description: >-
  Systematically map threat actor behavior to the MITRE ATT&CK framework, build
  technique coverage heatmaps, identify detection gaps, and produce actionable
  intelligence linking observed IOCs to adversary techniques.
domain: cybersecurity
subdomain: threat-intelligence
tags:
  - mitre-attack
  - ttp-analysis
  - threat-actors
  - attack-navigator
  - detection-gaps
  - apt-groups
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1003", "T1059", "T1071", "T1078", "T1566"]
---
# Analyzing Threat Actor TTPs

## Overview

Threat actor TTP analysis maps observed adversary behavior to the MITRE ATT&CK
framework for structured intelligence production. This skill covers querying ATT&CK
data programmatically, mapping threat groups to techniques with procedure-level
detail, generating Navigator layers for visualization, performing detection gap
analysis, and cross-group technique comparison for prioritized defensive coverage.

## Prerequisites

| Requirement | Details |
|---|---|
| Python 3.10+ with `mitreattack-python`, `attackcti`, `stix2` libraries | Required |
| MITRE ATT&CK Navigator (web or local deployment) | Required |
| Access to threat intelligence reports or MISP/OpenCTI for actor data | Required |
| Understanding of ATT&CK matrix | 14 Tactics → Techniques → Sub-techniques |
| Familiarity with STIX 2.1 Attack Pattern objects | Required |

## Key Concepts

### ATT&CK Matrix Structure

The Enterprise matrix organizes adversary behavior into 14 Tactics (the "why")
containing Techniques (the "how") and Sub-techniques (specific implementations).
Each technique includes data sources, detections, mitigations, and procedure
examples from observed threat groups.

**Tactic progression (simplified Kill Chain mapping):**
```
Reconnaissance → Resource Development → Initial Access → Execution →
Persistence → Privilege Escalation → Defense Evasion → Credential Access →
Discovery → Lateral Movement → Collection → C2 → Exfiltration → Impact
```

### Threat Group Identification

ATT&CK catalogs 140+ threat groups with documented technique usage. Key fields:
- **Group ID**: G0007 (APT28), G0016 (APT29), G0032 (Lazarus)
- **Aliases**: vendor-specific names (Fancy Bear, Cozy Bear, HIDDEN COBRA)
- **Software**: associated tools (S0154 = Cobalt Strike, S0005 = X-Agent)
- **Campaigns**: time-bounded intrusion sets (C0021 = SolarWinds)

### Navigator Layer Anatomy

Navigator layers are JSON files annotating techniques with:
- `score`: numeric value (0-100) for gradient coloring
- `color`: hex color override
- `comment`: analyst notes per technique
- `metadata`: key-value pairs for filtering
- `tactic`: which tactic column to highlight

### Detection Gap Analysis

Compare actor technique sets against detection capability:
```
Coverage % = |detected ∩ actor_techniques| / |actor_techniques| × 100
Gap set    = actor_techniques - detected_techniques
Priority   = Gap techniques ranked by actor frequency + impact
```

## Workflow

### Step 1: Query ATT&CK Data

```python
from attackcti import attack_client

lift = attack_client()

# Get all Enterprise techniques
enterprise_techniques = lift.get_enterprise_techniques()
print(f"Total Enterprise techniques: {len(enterprise_techniques)}")

# Get specific group
groups = lift.get_groups()
apt29 = [g for g in groups if 'APT29' in g.get('name', '')]
if apt29:
    group = apt29[0]
    print(f"Group: {group['name']} | Aliases: {group.get('aliases', [])}")
```

### Step 2: Map Actor to Techniques

```python
# Get techniques used by APT29 (G0016)
apt29_techniques = lift.get_techniques_used_by_group("G0016")

technique_map = {}
for entry in apt29_techniques:
    tech_id = entry.get("external_references", [{}])[0].get("external_id", "")
    tech_name = entry.get("name", "")
    tactics = [p.get("phase_name", "") for p in entry.get("kill_chain_phases", [])]
    technique_map[tech_id] = {"name": tech_name, "tactics": tactics}

for tid, info in sorted(technique_map.items()):
    print(f"  {tid}: {info['name']} [{', '.join(info['tactics'])}]")
```

### Step 3: Generate Navigator Layer

```python
import json

def create_navigator_layer(group_name, technique_map):
    techniques_list = [
        {
            "techniqueID": tid,
            "tactic": info["tactics"][0] if info["tactics"] else "",
            "color": "#ff6666",
            "score": 100,
            "enabled": True,
        }
        for tid, info in technique_map.items()
    ]
    return {
        "name": f"{group_name} TTP Coverage",
        "versions": {"attack": "16.1", "navigator": "5.1.0", "layer": "4.5"},
        "domain": "enterprise-attack",
        "description": f"Techniques attributed to {group_name}",
        "techniques": techniques_list,
        "gradient": {"colors": ["#ffffff", "#ff6666"], "minValue": 0, "maxValue": 100},
    }

layer = create_navigator_layer("APT29", technique_map)
with open("apt29_layer.json", "w") as f:
    json.dump(layer, f, indent=2)
```

### Step 4: Detection Gap Analysis

```python
# Your current detection capabilities (technique IDs you can detect)
detected = {"T1059", "T1071", "T1566", "T1003", "T1078"}
actor_techniques = set(technique_map.keys())

covered = actor_techniques & detected
gaps = actor_techniques - detected

print(f"Coverage: {len(covered)}/{len(actor_techniques)} ({len(covered)/len(actor_techniques)*100:.0f}%)")
print(f"Gaps ({len(gaps)}):")
for tid in sorted(gaps):
    print(f"  {tid}: {technique_map[tid]['name']}")
```

### Step 5: Cross-Group Comparison

```python
groups_to_compare = {"G0016": "APT29", "G0007": "APT28", "G0032": "Lazarus"}
group_techs = {}

for gid, gname in groups_to_compare.items():
    techs = lift.get_techniques_used_by_group(gid)
    group_techs[gname] = {
        t.get("external_references", [{}])[0].get("external_id", "")
        for t in techs
    }

common = set.intersection(*group_techs.values())
print(f"Common techniques across all groups: {len(common)}")
```

## Detection

```yaml
title: Threat Actor Ttps Detection
id: 8d9c0c6f-b760-4643-95a6-c67e8b3290ab
status: experimental
description: Detects suspicious activity related to analyzing threat actor ttps techniques in threat intelligence context
logsource:
  category: network_connection
  product: firewall
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1003
  - attack.t1059
  - attack.t1071
  - attack.t1078
  - attack.t1566
  - attack.reconnaissance
falsepositives:
  - Threat intelligence platform aggregating feeds from approved sources
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Threat Actor Ttps Detection | firewall/network_connection | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1003, T1059, T1071, T1078, T1566 |

## Verification

- [ ] ATT&CK data queried successfully via TAXII or local STIX bundle
- [ ] Threat actor mapped to techniques with tactic association
- [ ] Navigator layer JSON validates and renders in ATT&CK Navigator
- [ ] Detection gap analysis identifies unmonitored techniques with priority
- [ ] Cross-group comparison reveals shared and unique TTPs
- [ ] Output actionable for detection engineering prioritization

## References

- [MITRE ATT&CK](https://attack.mitre.org/)
- [ATT&CK Navigator](https://mitre-attack.github.io/attack-navigator/)
- [attackcti Python Library](https://github.com/OTRF/ATTACK-Python-Client)
- [ATT&CK STIX Data](https://github.com/mitre/cti)
- [ATT&CK Groups](https://attack.mitre.org/groups/)
