Lab 1.2 — ATT&CK Mapping

Lab Overview

Part 1: Open the ATT&CK Navigator

The ATT&CK Navigator is a free web tool from MITRE that lets you visualize, annotate, and color-code the ATT&CK matrix. SOC teams use it to map threat intelligence to their detection coverage.

Step 1: Launch the Navigator

Open the MITRE ATT&CK Navigator in a new tab:

https://mitre-attack.github.io/attack-navigator/

Once it loads, click "Create New Layer" and select "Enterprise". This gives you the full ATT&CK Enterprise matrix — the same matrix used by SOC teams, red teams, and threat intel analysts worldwide.

Step 2: Name Your Layer

At the top of the Navigator, find the layer tab (it will say something like "layer"). Click it and rename it to:

APT29 Detection Coverage

Take a moment to orient yourself. Each column is a tactic (Initial Access, Execution, Persistence, etc.) and each cell is a technique. You can scroll horizontally to see all 14 tactics. Sub-techniques are hidden by default — click the small arrow on a technique to expand them.

Part 2: Read the Attack Report

Below is a simplified but realistic intelligence report describing an APT29 campaign. APT29 (also known as Cozy Bear) is a Russian state-sponsored threat group attributed to the SVR. They are known for sophisticated, long-duration intrusions targeting government, healthcare, and technology sectors.

Read the entire report carefully. Your goal is to identify every technique used, find its ATT&CK ID, and add it to your tracking table.

Intelligence Report — "Operation Midnight Eclipse"

Click to enlarge

Classification: TLP:GREEN — May be shared within the cybersecurity community

Date: January 2026

Attribution: APT29 / Cozy Bear (High Confidence)

Target: European government ministry responsible for energy policy

Executive Summary. In late January 2026, APT29 conducted a targeted intrusion against a European government ministry. The campaign began with spearphishing emails sent to three senior policy advisors. The emails contained Word documents with embedded macros that, when enabled, executed a PowerShell downloader. The operation progressed through credential theft, lateral movement, and ultimately data exfiltration over a 72-hour window before detection.

Initial Compromise. The attack began with spearphishing emails containing malicious attachments (T1566.001). The Word documents were themed as "EU Energy Policy Draft — Urgent Review Required." When recipients enabled macros, the embedded VBA code launched a PowerShell (T1059.001) script that downloaded a second-stage payload from a compromised WordPress site.

Establishing Foothold. The PowerShell script also used Windows Management Instrumentation (WMI) (T1047) to execute commands remotely on the infected host, querying system information and establishing persistence. Two persistence mechanisms were deployed: a scheduled task (T1053.005) configured to run the payload every 4 hours, and a Registry Run Key (T1547.001) to survive reboots.

Evading Detection. The second-stage payload was heavily obfuscated (T1027) — variable names were randomized, strings were Base64-encoded, and control flow was flattened. To execute in-memory without touching disk, the attacker used DLL injection (T1055.001) to inject their code into a legitimate svchost.exe process.

Credential Theft. Once established, the attacker used a modified version of Mimikatz to dump credentials from LSASS memory (T1003.001). This yielded domain administrator credentials, which opened access to the entire internal network.

Reconnaissance and Lateral Movement. Using the stolen credentials, the attacker performed domain account discovery (T1087.002) to identify high-value targets and system network configuration discovery (T1016) to map the internal network topology. They moved laterally using SMB/Windows Admin Shares (T1021.002), accessing file servers containing classified energy policy documents.

Data Collection and Exfiltration. The attacker archived collected data (T1560.001) into password-protected ZIP files. Command and control was maintained over HTTPS web protocols (T1071.001), blending with normal web traffic. Additional tools were brought in via ingress tool transfer (T1105). Finally, the archived data was exfiltrated over the existing C2 channel (T1041), totaling approximately 4.7 GB of documents over 48 hours.

Detection Timeline. The intrusion was detected 72 hours after initial access when the ministry's EDR flagged an anomalous svchost.exe process making outbound HTTPS connections to a known-bad IP address.

Step 3: Build Your TTP Tracking Table

As you read the report, extract each technique into this table. You should find 15 techniques across 8 tactics:

Part 3: Map and Color-Code in the Navigator

Now comes the core skill: translating written intelligence into a visual ATT&CK layer. This is exactly what threat intelligence analysts do when a new campaign report drops.

Click to enlarge

Step 4: Select Each Technique

For each of the 15 techniques in your tracking table:

1. Use the search bar (magnifying glass) in the Navigator toolbar
2. Type the technique ID (e.g., T1566.001)
3. Click the technique in the search results to highlight it
4. The technique cell will become selected (highlighted with a border)

Repeat for all 15 techniques. When done, you should see 15 cells highlighted across the matrix.

Step 5: Apply Detection-Based Color Coding

This is where you connect Lab 1.1 to Lab 1.2. Based on what you learned about Wazuh's capabilities, color-code each technique using this scheme:

To apply colors in the Navigator:

1. Click a technique to select it
2. In the right-side panel, find the "score" field
3. Enter the score (1, 2, or 3)
4. In the technique controls, set the background color to match the scheme above

Step 6: Complete the Detection Assessment Table

For each technique, assess detection capability and fill in this table:

Summary: 3 Green, 5 Yellow, 7 Red — Wazuh alone covers only 20% of this APT29 campaign with high confidence.

Part 4: Export and Analyze

Step 7: Export Your Navigator Layer

1. In the Navigator toolbar, click the download icon (or go to the layer tab menu)
2. Select "Download Layer as JSON"
3. Save the file as apt29-detection-coverage.json

This JSON file is your deliverable — it contains every technique you mapped, your color-coding, and scores. In a real SOC, these layers get shared across the team and updated as detection coverage improves.

Step 8: Write Your Gap Analysis

Using your Detection Assessment Table, write a brief (1-page) analysis answering these three questions:

Question 1: Which tactics have the strongest detection coverage?

Look at your green and yellow techniques. Which parts of the kill chain does Wazuh handle well? Think about what those tactics have in common.

Question 2: Where are the biggest gaps?

Look at your red techniques. Notice a pattern? Which stages of the attack are hardest to detect with Wazuh alone? What do those stages require that Wazuh doesn't provide?

Question 3: What tools would close the top 3 gaps?

For the three most critical detection gaps, recommend a specific tool or capability:

Deliverables Checklist

Before marking this lab complete, verify you have:

• TTP Tracking Table — All 15 techniques identified with ATT&CK IDs and report sections
• Navigator Layer — 15 techniques selected, color-coded (green/yellow/red), and scored
• Detection Assessment Table — Each technique assessed with rationale and Lab 1.1 evidence
• Exported JSON — Navigator layer saved as apt29-detection-coverage.json
• Gap Analysis — 1-page writeup answering the 3 analysis questions with tool recommendations

What's Next

In Lab 1.3 — Log Source Identification, you'll shift from "what can we detect?" to "what data do we need?" You'll catalog every log source in a simulated enterprise network, map each source to the ATT&CK techniques it can support, and build a Log Source Matrix that becomes the foundation for your detection engineering work in Module 2.