MITRE ATT&CK Navigator Hands-on Labs¶

Choose the route that fits your available time and computing resources. Use the Interactive Lab for a short guided layer-building exercise, or the Full Lab to produce and independently verify a reviewable layer in a working Navigator environment. Offline installation remains available as an optional extension.

Hands-on ATT&CK mapping

Define it. Map it. Defend it.

Start with three evidence records, create a purpose-specific Navigator layer, apply a documented score, and export a result another analyst can review.

⏱ 90–150 min core ◆ Guided beginner ✓ Reviewable layer

Start building

Browser or self-hosted · 90–150 min core

MITRE ATT&CK Navigator Full Lab

Independent evidence required

How this differs from the walkthrough

The preserved walkthrough demonstrates many product features and scoring examples. This lab gives you one evidence-led outcome and clear success checks while linking back to the complete procedures and screenshots.

Before you begin

You need: a supported browser, a working Navigator instance, approximately 90–150 minutes, and a folder for layer JSON, screenshots, and review notes.

Recommended first

Beginner Core Lab¶

Use the official Navigator web application or an existing working Navigator instance. Focus on defining, mapping, reviewing, reopening, and explaining one layer.

Expected time: 90–150 minutes across three sessions.

Optional extension

Offline self-hosted PoC¶

After the core outcome works, reproduce the preserved air-gapped installation and verify Enterprise, Mobile, and ICS data from the local server.

Expected time: 3–5 additional hours.

How to use this lab

Complete one activity at a time. Do not colour a technique until you can state the layer purpose, evidence, score meaning, confidence, and limitation.

Session 1Prepare and verify
Session 2Map and score
Session 3Review and export

Objective¶

You are the analyst preparing detection review NAV-1042 for a small SOC. Build a Navigator layer that distinguishes observed telemetry, an alert, and a validated detection. Document the scoring rule, map only the behaviour supported by evidence, then export a layer another analyst can reopen and challenge.

Use this scoring rule throughout the lab:

Score	Meaning in this lab
1	Behaviour observed in telemetry; no alert was demonstrated
2	Alert evidence exists; the detection has not been safely validated
3	Detection was exercised safely and produced the expected evidence

01

Activity 1: Prepare Navigator¶

Choose and verify the route¶

For the Beginner Core Lab, open the official Navigator web application or an existing working deployment. Confirm that you can create an Enterprise ATT&CK layer and export JSON before entering assessment data.

For the optional self-hosted route, complete the offline installation journey, then confirm that Enterprise, Mobile, and ICS data load from the local server. Do not troubleshoot deployment and mapping at the same time: finish the installation checkpoint before continuing.

Create the review baseline¶

Create an Enterprise ATT&CK layer.
Name it CDK detection review.
Add NAV-1042, your name, the review date, and the displayed ATT&CK version to the layer description.
Add the three score meanings from the objective without changing them.
Export an empty baseline named cdk-detection-review-baseline.json.
Reopen the baseline and confirm the name, description, domain, and zero selected techniques are preserved.

Milestone 1Baseline reopens cleanlyThe Enterprise layer preserves its purpose, owner, date, ATT&CK version, and score meanings without selecting a technique.

Expected result Navigator opens locally, the Enterprise matrix loads, and an empty baseline preserves the layer purpose and scoring rule.

02

Activity 2: Build an evidence layer¶

Use these synthetic records only. Treat each row as a separate evidence boundary; do not infer activity that is not stated.

Record	Evidence	Supported mapping	Score	Required limitation
EV-01	Process telemetry shows `powershell.exe` running an encoded command	Command and Scripting Interpreter: PowerShell	1	No alert was demonstrated
EV-02	A scheduled-task alert records a new task configured to run at logon	Scheduled Task/Job: Scheduled Task	2	The detection was not safely validated
EV-03	An authorised credential-access test triggered the expected alert and analyst workflow	OS Credential Dumping	3	Validated only for this controlled test

For each record:

read the complete technique or sub-technique definition;
select the closest mapping rather than matching a keyword alone;
apply the stated score and a consistent gradient;
add a comment containing the record ID, evidence, confidence, and required limitation; and
leave unrelated techniques unselected.

Follow Build and score Navigator layers for the preserved product procedure and screenshots.

Analyst challenge: resist the extra square

EV-01 names a parent application and an encoded PowerShell command. Do not add User Execution unless another record shows the user action required by that mapping. The goal is a defensible layer, not a colourful one.

Milestone 2Three mappings, three meaningsEV-01, EV-02, and EV-03 produce exactly three selected techniques with scores 1, 2, and 3 and a limitation on each.

Expected result Exactly three techniques are selected, their scores follow the documented rule, and each comment explains what the evidence does and does not prove.

03

Activity 3: Review and export¶

Complete the review gate¶

Use another learner if available. Otherwise, close the layer for ten minutes and perform a fresh second-pass review. Verify:

the purpose, owner, review date, domain, and ATT&CK version;
exactly three selected techniques and no unsupported selections;
the complete ATT&CK definition for each mapping;
scores 1, 2, and 3 against the documented meanings; and
EV-01, EV-02, or EV-03, confidence, and a limitation in each comment.

Correct any item that fails before exporting.

Export, reopen, and challenge¶

Export the finished layer as cdk-detection-review-final.json.
Open a new Navigator tab and load that JSON without referring to the original tab.
Confirm the layer contains exactly three selected techniques with the same scores, comments, description, and ATT&CK domain.
Search for User Execution. Confirm it remains unselected because the supplied evidence did not prove a user action.
Export an SVG or table view and check that its colours agree with the JSON.
Write a two-sentence handover: what the layer represents, and what it does not prove.

Use Compare and export Navigator layers for the complete combine and export walkthrough.

Milestone 3Reviewable layer exportedAnother analyst can reopen the JSON, interpret every score, trace each selected technique to evidence, and understand the limitations.

Expected result The reopened JSON and communication export agree with the documented evidence and scoring model, User Execution remains unselected, and the handover avoids claiming complete ATT&CK coverage.

Full Lab evidence checklist¶

Layer purpose, ATT&CK version, owner, review date, and scoring rule.
The empty baseline layer JSON.
Three selected techniques with supporting evidence and confidence.
Scores 1, 2, and 3 applied according to the documented meaning.
A limitation recorded for every selected technique.
Finished JSON reopened with exactly three mappings and unsupported User Execution left unselected.
An SVG or table export that matches the layer.
Review notes, corrections, and a two-sentence analyst handover.

0 of 8 recorded Mark each item when you have saved the evidence.

Clean up¶

Retain the final JSON, communication export, and review notes. Remove temporary test data or disposable layers that are no longer required, and stop the local development server if you created one only for this exercise.