Adversary Engagement with MITRE Engage
Plan a deception program against specific attackers by mapping ATT&CK techniques to MITRE Engage activities.
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 4 files
What it does
This skill teaches an AI agent to help plan a cyber deception operation using MITRE Engage, a public framework of goals and activities for luring, observing, and disrupting attackers. Instead of scattering honeypots or decoy files at random, the agent helps define a strategic goal, set measurable objectives, map the attacker techniques a team expects to see to matching decoy activities, and write rules of engagement. It can also run a small bundled Python script that turns a list of ATT&CK technique IDs into a coverage report and a plan skeleton.
Great for
- Security teams that already own honeypots, honeytokens or canary tokens but lack a coordinating strategy
- Security leads writing a formal adversary engagement or deception operation plan
- Threat intelligence analysts who want to map a known threat actor's techniques to deception options
Skip it if
- Teams without legal review or executive sponsorship: the skill itself says engagement operations with live adversaries need legal sign-off, and running them without it creates entrapment and liability risk
- Organizations without basic detection and response, since the skill treats engagement as an addition to defense-in-depth rather than a replacement for it
- Anyone expecting the skill to deploy decoys itself: it is a strategy and planning layer that points to separate tactical deployment skills for implementation
Try asking
- “Help me build an adversary engagement plan for a suspected access broker targeting our VPN, using MITRE Engage.”
- “Which MITRE Engage activities should we use against an attacker who relies on valid accounts and unsecured credentials?”
- “Turn this threat model JSON of ATT&CK techniques into a coverage report and operation plan skeleton.”
- “Write measurable Expose, Affect and Elicit objectives for our decoy credential program.”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 4 original files, the Apache-2.0 licence and an attribution note.
designing-adversary-engagement-with-mitre-engage.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip designing-adversary-engagement-with-mitre-engage.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip designing-adversary-engagement-with-mitre-engage.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Reconcile the script's starter ATT&CK-to-activity map against the live MITRE Engage matrix before using its output operationally, as the script itself instructs.
- Get legal review before any live engagement; treat the generated plan as a draft for that review.
- Supply a real threat model with ATT&CK technique IDs so the coverage report reflects your expected adversary.
What's inside
- assets/template.md
- references/standards.md
- scripts/process.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.