Reading the Matrix and Using ATT&CK Navigator

Go to attack.mitre.org and look at the matrix. It’s a grid. Columns across the top, rows of technique names below.

You already know what the columns are: Tactics. Each column is one of the 14 adversary objectives.

The cells in each column are techniques (and their sub-techniques, which fold in). A technique cell that has a gray expand arrow contains sub-techniques.

Reading the matrix is the first skill. Using ATT&CK Navigator to annotate it is the second.

Anatomy of a Technique Page

Click any technique — let’s use T1059.001 (PowerShell). You land on a page with several sections:

Description: What the technique is and why adversaries use it. Written behaviorally, not vendor-specifically.

Procedure Examples: A table of real threat groups + campaigns that used this technique, with citations. This is intelligence data — not hypothetical.

Mitigations: ATT&CK’s recommended countermeasures (e.g., M1038 — Execution Prevention, M1045 — Code Signing). Mitigations don’t detect; they prevent.

Detection: The most important section for you. Lists:

• Data sources: Which log sources produce relevant events
• Data components: Specific event types within those sources
• Detections: References to analytics and detection platforms (Sigma, CAR, CTID)

Data Sources / Components for T1059.001:
  - Command: Command Execution
  - Module: Module Load
  - Process: Process Creation
  - Script: Script Execution

That tells you: to detect PowerShell abuse, you need Process Creation events (for powershell.exe spawning), Script Execution events (PowerShell ScriptBlock logging), and Module Load events (suspicious DLL loads from PowerShell).

ATT&CK Navigator — From Matrix to Layer

Navigator is a free web app that lets you annotate the ATT&CK matrix with colors, scores, and comments. Think of it as a whiteboard overlay on top of the matrix.

What you use it for:

• Detection coverage maps: Color the cells your SIEM actually has detection rules for. Gaps become obvious.
• Threat actor profiles: Color the techniques a specific adversary uses (e.g., APT29’s known TTPs). Tells you where to focus your detection investment.
• Assessment results: After a purple team exercise, color techniques that were tested and whether your detections fired.

Creating Your First Layer

1. Go to mitre-attack.github.io/attack-navigator
2. Click + Create New Layer
3. Select Enterprise ATT&CK (or whichever platform applies)
4. You now have an empty matrix

Adding color to a technique:

• Click a technique cell to select it
• In the left toolbar, click the fill color swatch
• Pick a color (common convention: green = detected, yellow = partially detected, red = not detected)

Selecting by tactic or technique:

• Use the selection toolbar to select all techniques under one tactic
• Useful for saying “we have no detections for Lateral Movement at all”

Scoring:

• Each cell can have a numeric score (0–100)
• Score a technique based on rule confidence, data source coverage, or analyst review hours
• The gradient view converts scores to a heat map

Exporting a Layer

File → Download Layer (JSON). The JSON format is machine-readable — other tools, scripts, and dashboards can import it. This is what teams use to track detection coverage in code.

{
  "name": "Detection Coverage Q1",
  "versions": { "attack": "14", "navigator": "4.9" },
  "domain": "enterprise-attack",
  "techniques": [
    {
      "techniqueID": "T1059.001",
      "color": "#6dab3c",
      "comment": "Sigma rule sigma/proc_creation/win_powershell_encoded_cmd.yml",
      "score": 80
    }
  ]
}

Filtering the Matrix

Navigator’s filter toolbar lets you narrow the matrix:

• Filter by platform: Show only Windows techniques, or only Cloud/AWS
• Filter by data source: Show only techniques detectable via Process Creation
• Search: Type a technique name or ID to highlight it

Navigator Shortcut: Loading a Threat Group Profile

ATT&CK maintains technique-to-group mappings. Navigator can load them directly:

1. Navigator → + → Load from URL
2. Enter https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/intrusion-set/intrusion-set--6748198f-255b-4e2b-9f11-db2e4b61c7a1.json (APT29)
3. Click Load

You’ll see all documented APT29 techniques highlighted in the matrix. Overlay this against your detection coverage layer — the gap is your priority list.