Navigator Literacy
ATT&CK Navigator visualizes technique selections — build literacy layers for $LAB_RT campaigns and detection gaps.
Visual · rt_navigator_literacy
Navigator literacy. $LAB_RT only. Original Cyberlium.
Navigator layers tell a story: what you emulate, what blue detects, what gaps remain.
MITRE ATT&CK Navigator is a web tool for coloring technique cells — red for emulated TTPs, green for detected, yellow for gaps. Teams export JSON layers for debrief slides and detection backlogs. Cyberlium teaches Navigator literacy on paper or tool for $LAB_RT planning. You will NOT publish layers implying attacks on strangers or export layers as 'target lists' for unauthorized hosts. Next: ATT&CK Lab.
1. Layers and scoring in Navigator
Layers are JSON files coloring matrix cells. Multiple layers overlay: threat group emulation set, detection coverage, planned $LAB_RT campaign. Scoring can weight technique priority for purple backlog.
Literacy means reading layers in debrief — not treating colored cells as authorization outside $LAB_RT RoE.
Command guide
Try these commands — Layers and scoring in Navigator
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: curl, jq. Reference sites: ATT&CK Navigator (https://mitre-attack.github.io/attack-navigator/); Enterprise techniques (https://attack.mitre.org/techniques/enterprise/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Red vs blue layer conventions
Red layers: techniques emulated this campaign on $LAB_RT. Blue layers: techniques with confirmed detections or mitigations. Gap layers: emulated but missed — fuel for purple improvement.
Consistent color legend across teams prevents debrief confusion. Document legend in chmod 600 notes.
3. Navigator exports support debrief — not weaponization
Export JSON for YOUR $LAB_RT campaign archive — attach to RoE pack. Do not share Navigator layers in chat as 'attack plans' for classmate VMs or production.
Ship: layer legend + three example technique IDs for $LAB_RT campaign layer. Next: ATT&CK Lab.
4. What you ship: Navigator layer legend for $LAB_RT
Legend: emulated, detected, gap. Three technique IDs for $LAB_RT layer. NEVER stranger target layers. chmod 600.
5. What you record before the next lesson
Date. Navigator legend. Three technique IDs. $LAB_RT named. File t21-m02-l03-navigator-literacy.txt chmod 600.
6. Wrong vs right: stranger phishing vs authorized RT lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Publish Navigator layer targeting classmate IPs. Use Navigator as shopping list for ransomware.
- Right: Write Navigator layer legend for $LAB_RT. Next: ATT&CK Lab.
Mission: draft Navigator layer legend
1) Define red/green/yellow meaning for YOUR team. 2) List three technique IDs for $LAB_RT campaign layer. 3) chmod 600. Never attach stranger hosts to layers.
Stuck? Ask Cyberlium AI Mentor
Gap layers are gifts to blue — prioritize them in debrief.
APPLY: ATT&CK Navigator layers on Cyberlium support:
APPLY: True or False: A red Navigator layer replaces written RoE.
APPLY: Gap layers (emulated but not detected) should: