Home
Courses
Applying the MITRE ATT&CK Framework

Applying the MITRE ATT&CK Framework

Course 3942

Duration: 1 day
Language: English
Level: Intermediate

In this course, you will gain a foundational understanding of the MITRE ATT&CK Framework. Topics covered include its definition, the goals it aims to achieve, and its essential components, such as matrices, tactics, techniques, data sources, mitigations, groups, software, campaigns, and model relationships.

Through a case study, you'll explore the real world to illustrate how these components are interconnected. You'll explore the process of prioritising techniques using cyber threat intelligence (CTI) and assess the effectiveness of current defensive measures.

MITRE ATT&CK Framework Training Delivery Methods

Online
Enterprise Solutions Available

MITRE ATT&CK Framework Training Information

In this course, you will learn how to:

Develop a strong foundational knowledge of the MITRE ATT&CK Framework and its components.
Apply the framework to real-world cyber threats, such as the SolarWinds supply chain attack.
Learn how to map threat intelligence, alerts, and adversary behaviours to ATT&CK.
Use ATT&CK-mapped data to make informed and prioritised defensive recommendations.
Understand the role of cyber threat intelligence and its practical applications in security.

Training Prerequisites

Basic knowledge of cybersecurity concepts and terminology is recommended but not required.

MITRE ATT&CK Framework Training Outline

Chapter 1: Fundamentals of MITRE ATT&CK Framework

MITRE ATT&CK Framework Definition

Goal of MITRE ATT&CK Framework

Matrices

Tactics and Techniques

Data Sources

Mitigations

Groups

Software

Campaigns

MITRE ATT&CK Model Relationships

MITRE ATT&CK Model Relationships Example

Breakdown of Tactics, Techniques, Procedures, Mitigations, and Detection

TeamTNT

Mitigations
Detection

Chapter 2: Mapping SolarWinds Supply Chain Attack to MITRE ATT&CK Framework

SolarWinds Compromise Background Information

Software Components of SolarWinds Compromise

SUNBURST and SUNSPOT

Mapping the Indicators to MITRE ATT&CK Framework

Loosely Linking Everything Together for SolarWinds

ATT&CK Navigator

SolarWinds ATT&CK Navigator

SolarWinds Attack Timeline

Indicators of Compromise (IOC)

Mitigations That Might Reduce the Likelihood and/or Impact of Supply Chain Attacks

Review of SolarWinds Compromise and Ability to Link to ATT&CK

Chapter 3: Mapping Alerts, Adversaries, Behaviours, and TTPs to MITRE ATT&CK

Mapping Threat Intelligence to ATT&CK

Cyber Threat Intelligence (CTI) and IoBs
Analysing Behaviour
UEBA Data Sources
Data Drawn From Above Sources

Snake Malware and Turla CTI Advisories and Alerts

Research Advisory and Alert Information
Adversary Behaviour
Volatility Plugin
Network Intrusion Detection Systems (NIDS)
Host-Based Detection
Non-Standard Icon Size and Yara Rule
Memory Analysis

Practical Research Exercise

Initial Analysis
Mapping Data to MITRE ATT&CK
Compare Results to Improve Mapping

Pyramid of Pain

Chapter 4: Make Defensive Recommendations From ATT&CK Mapped Data

Use Collected and Analysed Data to Make Initial Recommendations

Process for Making Recommendations

Ways to Determine Priority of Techniques Using CTI

Assess Current Defensive Measures and Their Effectiveness

MITRE CAR and D3FEND
MITRE’s Cyber Analytics Repository (CAR)
MITRE D3FEND
MITRE ATT&CK and D3FEND

MITRE D3FEND Practical Exercise

MITRE D3FEND Practical Exercise Answer

Research Additional Defensive Options and Organisational Capabilities/Constraints

Consider Tradeoffs for Each Option

Sample Pros and Cons of Options

Make Recommendations

Make Recommendations—Supply Chain Compromise

Get This Course 9 950 kr

1-Day Instructor-Led Training

Get the Advantage 37 295 kr

Take this course and gain unlimited access to more than 300 virtual instructor-led courses
Future-proof your career with more than 100 sought-after certifications in the market
Build real skills through hands-on learning in more than 180 virtual labs
Grow your skills and capabilities with more than one course at a time and save

Thank you for choosing subscriptions!

Include dates with afternoon start times

#3942

Guaranteed to Run - you can rest assured that the class will not be cancelled.
jan 8 15:00 - 22:30 CET

Virtual
feb 18 10:00 - 17:30 CET

Virtual
feb 18 9:00 - 16:30 CET

Virtual
apr 7 15:00 - 22:30 CEST

Virtual
maj 19 9:00 - 16:30 CEST

Virtual
maj 19 10:00 - 17:30 CEST

Virtual
jul 2 15:00 - 22:30 CEST

Virtual
aug 18 9:00 - 16:30 CEST

Virtual
aug 18 10:00 - 17:30 CEST

Virtual
okt 1 15:00 - 22:30 CEST

Virtual
nov 17 10:00 - 17:30 CET

Virtual
nov 17 9:00 - 16:30 CET

Virtual

Scroll to view additional course dates

Bring this or any training to your organisation
Full-scale programme development
Delivered when, where, and how you want it
Blended learning models
Tailored content
Expert team coaching

Get the Advantage 37 295 kr

Take this course and gain unlimited access to more than 300 virtual instructor-led courses
Future-proof your career with more than 100 sought-after certifications in the market
Build real skills through hands-on learning in more than 180 virtual labs
Grow your skills and capabilities with more than one course at a time and save

Thank you for choosing subscriptions!

#3942

Questions about this course?

Customise Your Team Training Experience

Fill out the form below or call +46 (0)8 506 668 00

* Required Fields

Preferred method of contact:

Phone

Need Help Finding The Right Training Solution?

Our training advisors are here for you.

MITRE ATT&CK Framework FAQs

The MITRE ATT&CK Framework is a comprehensive knowledge base of cyber adversary tactics, techniques, and procedures (TTPs) used in attacks. It's a valuable resource for understanding and countering cyber threats.

This course is designed for IT and cybersecurity professionals, security analysts, incident responders, threat intelligence analysts, and anyone interested in enhancing their knowledge of cyber threat analysis and defense strategies.

This course equips you with the knowledge and skills to better understand and respond to cyber threats. It's valuable for career growth in cybersecurity, threat analysis, and incident response.

For organisations, it can enhance their security posture and the ability to detect and mitigate threats effectively.

The main takeaways from this course include a strong foundation in the MITRE ATT&CK Framework, the ability to map real-world threats to it, and the skills to make informed defensive recommendations based on the framework.

IT and cybersecurity professionals
Security analysts and researchers
Incident responders
Threat intelligence analysts
Anyone interested in enhancing their understanding of cyber threat analysis and defense strategies.

Applying the MITRE ATT&CK Framework

MITRE ATT&CK Framework Training Delivery Methods

MITRE ATT&CK Framework Training Information

MITRE ATT&CK Framework Training Outline

Chapter 1: Fundamentals of MITRE ATT&CK Framework

Chapter 2: Mapping SolarWinds Supply Chain Attack to MITRE ATT&CK Framework

Chapter 3: Mapping Alerts, Adversaries, Behaviours, and TTPs to MITRE ATT&CK

Chapter 4: Make Defensive Recommendations From ATT&CK Mapped Data

Upgrade your course experience with: Subscriptions

Get the Advantage 37 295 kr

Thank you for choosing subscriptions!

Upgrade your course experience with: Subscriptions

Get the Advantage 37 295 kr

Thank you for choosing subscriptions!

MITRE ATT&CK Framework FAQs

What is the MITRE ATT&CK Framework?

Who is this course designed for?

How can this course benefit my career or organisation?

What are the main takeaways from this course?

Who should attend?

Related Courses