Control Validation Compass | Threat Alignment Risk Workflow | Threat Modeling Aide & Purple Team Content Repository

Categorized Threats (Motive, Location, Industry)

Choose one or multiple criteria, then select a single adversary or threat category from the right-hand menu. Selecting multiple criteria will narrow your search (usually desired).

Select an entire threat category:

No adversaries match selected criteria

Recent Intelligence

View the full library of recent adversary TTP intelligence heatmaps and source content.

Consider using this handy script to easily generate TTP heatmap files from open-source intel reports!

Input Your Own Data

Upload a Navigator json layer file

Navigator json contents can also be pasted into the text box below

Skip this step (See results for all the threat data)

Threat Model for:

TrickBot

You can complete just the Threat Modeling half of this workflow (with additional visuals!) here

Control Stack

Toggle the controls & testing capabilities used in your environment or otherwise relevant to you. Click the triangles to reveal options within each category.

Policy/Process Controls

Frameworks

MITRE ATT&CK Mitigations NIST 800-53 Mappings CIS Controls MITRE D3FEND MITRE Engage

Defensive Capabilities

Network & Endpoint Telemetry - Native Controls

Splunk Threat Hunting Splunk App Elastic Stack EQL Analytics Library Microsoft Sentinel & Defender (Unified) Sentinel detection mappings LogPoint

Network & Endpoint Telemetry - Third-Party Rule Repositories

Cyber Analytics Repository Atomic Threat Coverage Sigma rules public repository ThreatHunter Playbook

Network Telemetry

Network Security Monitoring rule mappings

Endpoint Telemetry

Tanium Threat Response

Cloud

Azure full stack mappings AWS security control mappings GCP Community Security Analytics

Offensive Capabilities

Unit Tests

Atomic Red Team Cyber Analytics Repository Red Team Automation Prelude Community TTPs CALDERA Stockpile Scythe

Advanced Options

The output has the following settings by default. You can modify them as desired to expand or further refine the techniques covered:

'Lowest-level' techniques only

Tactics: Reconnaissance Resource Development Initial Access Defense Evasion Command and Control Discovery Collection Persistence Credential Access Privilege Escalation Lateral Movement Execution Exfiltration Impact

Sort Low-to-High by:

Sort High-to-Low by:

Adversary Base