Threat › Module 5 › Lesson 2
Navigator Named
Navigator named literacy covers MITRE ATT&CK Navigator layers, scoring, and export — practice layer concepts on YOUR $TI_LAB notes before prod dashboards.
Visual · t33_navigator_named
Navigator literacy. $TI_LAB only. Original Cyberlium.
Opening
Color the matrix — literacy names ATT&CK Navigator so you visualize coverage on lab layers before production detection reviews.
MITRE ATT&CK Navigator (attack-navigator.mitre.org) overlays technique scores on the matrix — color gradients show detection coverage, adversary emulation, or data source availability. Layers export as JSON for sharing. Multiple layers compare red-team emulation vs blue-team coverage side by side. Cyberlium describes Navigator layer on YOUR $TI_LAB — paper mock of three techniques scored for fictional detection coverage. Next: Coverage Gaps.
1. Navigator concepts (named)
Layer: JSON file scoring techniques 0–100 or color-coded. Score meaning: team-defined — detection coverage, logging availability, emulation status. Export/import: share layers between hunt, detection engineering, and TI teams. Filters: platform, tactic, data source views.
On $TI_LAB, sketch Navigator mock — three techniques with scores and legend explaining score meaning.
Command guide
Try these commands — Navigator concepts (named)
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: curl, grep. Reference sites: ATT&CK Navigator (https://mitre-attack.github.io/attack-navigator/); Navigator repo (https://github.com/mitre-attack/attack-navigator); MITRE ATT&CK (https://attack.mitre.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why Navigator beats spreadsheet technique lists
Visual gaps pop on the matrix — uncovered Initial Access cells stand out. Layer comparison shows red vs blue divergence. Executive briefings attach Navigator PNG exports for coverage storytelling.
Students mock layers on lab notes — production layers follow team scoring definitions.
3. Lab boundary
Forbidden: claiming 100% coverage scores without linked detection rules. Allowed: Navigator named card — layer mock with $TI_LAB fictional scores and legend.
Ship: Navigator layer mock for YOUR lab coverage story. Next: Coverage Gaps.
4. What you ship: Navigator layer mock for $TI_LAB
Three technique scores with legend. $TI_LAB named. chmod 600.
5. What you record before the next lesson
Date. Navigator mock. $TI_LAB named. File t33-m05-l02-navigator-named.txt chmod 600.
6. Wrong vs right: criminal markets vs YOUR lab IOCs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Score all techniques 100 without evidence. Skip legend explaining score meaning.
Right
Write Navigator layer mock for YOUR $TI_LAB. Next: Coverage Gaps.
Mission: mock Navigator layer on YOUR lab
1) Pick three ATT&CK techniques from lab mapping. 2) Assign scores 0–100 with legend. 3) Note one gap the mock reveals. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Define what score means before you color — detection coverage ≠ emulation status.
Knowledge Check
APPLY: ATT&CK Navigator primarily:
Multiple choice
Knowledge Check
APPLY: True or False: Navigator layers export as JSON for team sharing.
True or False
Knowledge Check
APPLY: Navigator literacy on Cyberlium uses:
Multiple choice