Home
Courses
Applying the MITRE ATT&CK Framework

Applying the MITRE ATT&CK Framework

Course 3942

Duration: 1 day
Language: English
Level: Intermediate

In this course, you will gain a foundational understanding of the MITRE ATT&CK Framework. Topics covered include its definition, the goals it aims to achieve, and its essential components, such as matrices, tactics, techniques, data sources, mitigations, groups, software, campaigns, and model relationships.

Through a case study, you'll explore the real world to illustrate how these components are interconnected. You'll explore the process of prioritizing techniques using cyber threat intelligence (CTI) and assess the effectiveness of current defensive measures.

MITRE ATT&CK Framework Training Delivery Methods

Online
Enterprise Solutions Available

MITRE ATT&CK Framework Training Information

In this course, you will learn how to:

Develop a strong foundational knowledge of the MITRE ATT&CK Framework and its components.
Apply the framework to real-world cyber threats, such as the SolarWinds supply chain attack.
Learn how to map threat intelligence, alerts, and adversary behaviors to ATT&CK.
Use ATT&CK-mapped data to make informed and prioritized defensive recommendations.
Understand the role of cyber threat intelligence and its practical applications in security.

Training Prerequisites

Basic knowledge of cybersecurity concepts and terminology is recommended but not required.

MITRE ATT&CK Framework Training Outline

Chapter 1: Fundamentals of MITRE ATT&CK Framework

MITRE ATT&CK Framework Definition

Goal of MITRE ATT&CK Framework

Matrices

Tactics and Techniques

Data Sources

Mitigations

Groups

Software

Campaigns

MITRE ATT&CK Model Relationships

MITRE ATT&CK Model Relationships Example

Breakdown of Tactics, Techniques, Procedures, Mitigations, and Detection

TeamTNT

Mitigations
Detection

Chapter 2: Mapping SolarWinds Supply Chain Attack to MITRE ATT&CK Framework

SolarWinds Compromise Background Information

Software Components of SolarWinds Compromise

SUNBURST and SUNSPOT

Mapping the Indicators to MITRE ATT&CK Framework

Loosely Linking Everything Together for SolarWinds

ATT&CK Navigator

SolarWinds ATT&CK Navigator

SolarWinds Attack Timeline

Indicators of Compromise (IOC)

Mitigations That Might Reduce the Likelihood and/or Impact of Supply Chain Attacks

Review of SolarWinds Compromise and Ability to Link to ATT&CK

Chapter 3: Mapping Alerts, Adversaries, Behaviors, and TTPs to MITRE ATT&CK

Mapping Threat Intelligence to ATT&CK

Cyber Threat Intelligence (CTI) and IoBs
Analyzing Behavior
UEBA Data Sources
Data Drawn From Above Sources

Snake Malware and Turla CTI Advisories and Alerts

Research Advisory and Alert Information
Adversary Behavior
Volatility Plugin
Network Intrusion Detection Systems (NIDS)
Host-Based Detection
Non-Standard Icon Size and Yara Rule
Memory Analysis

Practical Research Exercise

Initial Analysis
Mapping Data to MITRE ATT&CK
Compare Results to Improve Mapping

Pyramid of Pain

Chapter 4: Make Defensive Recommendations From ATT&CK Mapped Data

Use Collected and Analyzed Data to Make Initial Recommendations

Process for Making Recommendations

Ways to Determine Priority of Techniques Using CTI

Assess Current Defensive Measures and Their Effectiveness

MITRE CAR and D3FEND
MITRE’s Cyber Analytics Repository (CAR)
MITRE D3FEND
MITRE ATT&CK and D3FEND

MITRE D3FEND Practical Exercise

MITRE D3FEND Practical Exercise Answer

Research Additional Defensive Options and Organizational Capabilities/Constraints

Consider Tradeoffs for Each Option

Sample Pros and Cons of Options

Make Recommendations

Make Recommendations—Supply Chain Compromise

Get This Course $895 GOV $620

1-Day Instructor-Led Training

Get the Advantage $3,895

Take this course and gain unlimited access to more than 300 virtual instructor-led courses
Future-proof your career with more than 100 sought-after certifications in the market
Build real skills through hands-on learning in more than 180 virtual labs
Grow your skills and capabilities with more than one course at a time and save

Thank you for choosing subscriptions!

#3942

Guaranteed to Run - you can rest assured that the class will not be cancelled.
Jan 8 9:00 AM - 4:30 PM EST

Virtual
Apr 7 9:00 AM - 4:30 PM EDT

Virtual
Jul 2 9:00 AM - 4:30 PM EDT

Virtual
Oct 1 9:00 AM - 4:30 PM EDT

Virtual

1-Day Instructor-Led Training

Get the Advantage $3,895

Take this course and gain unlimited access to more than 300 virtual instructor-led courses
Future-proof your career with more than 100 sought-after certifications in the market
Build real skills through hands-on learning in more than 180 virtual labs
Grow your skills and capabilities with more than one course at a time and save

Thank you for choosing subscriptions!

#3942

Guaranteed to Run - you can rest assured that the class will not be cancelled.
Jan 8 9:00 AM - 4:30 PM EST

Virtual
Apr 7 9:00 AM - 4:30 PM EDT

Virtual
Jul 2 9:00 AM - 4:30 PM EDT

Virtual
Oct 1 9:00 AM - 4:30 PM EDT

Virtual

Bring this or any training to your organization
Full-scale program development
Delivered when, where, and how you want it
Blended learning models
Tailored content
Expert team coaching

Get the Advantage $3,895

Take this course and gain unlimited access to more than 300 virtual instructor-led courses
Future-proof your career with more than 100 sought-after certifications in the market
Build real skills through hands-on learning in more than 180 virtual labs
Grow your skills and capabilities with more than one course at a time and save

Thank you for choosing subscriptions!

#3942

Questions about this course?

Customize Your Team Training Experience

Fill out the form below or call 888-843-8733

* Required Fields

Preferred method of contact:

Phone

Need Help Finding The Right Training Solution?

Our training advisors are here for you.

MITRE ATT&CK Framework FAQs

The MITRE ATT&CK Framework is a comprehensive knowledge base of cyber adversary tactics, techniques, and procedures (TTPs) used in attacks. It's a valuable resource for understanding and countering cyber threats.

This course is designed for IT and cybersecurity professionals, security analysts, incident responders, threat intelligence analysts, and anyone interested in enhancing their knowledge of cyber threat analysis and defense strategies.

This course equips you with the knowledge and skills to better understand and respond to cyber threats. It's valuable for career growth in cybersecurity, threat analysis, and incident response.

For organizations, it can enhance their security posture and the ability to detect and mitigate threats effectively.

The main takeaways from this course include a strong foundation in the MITRE ATT&CK Framework, the ability to map real-world threats to it, and the skills to make informed defensive recommendations based on the framework.

IT and cybersecurity professionals
Security analysts and researchers
Incident responders
Threat intelligence analysts
Anyone interested in enhancing their understanding of cyber threat analysis and defense strategies.

Applying the MITRE ATT&CK Framework

MITRE ATT&CK Framework Training Delivery Methods

MITRE ATT&CK Framework Training Information

MITRE ATT&CK Framework Training Outline

Chapter 1: Fundamentals of MITRE ATT&CK Framework

Chapter 2: Mapping SolarWinds Supply Chain Attack to MITRE ATT&CK Framework

Chapter 3: Mapping Alerts, Adversaries, Behaviors, and TTPs to MITRE ATT&CK

Chapter 4: Make Defensive Recommendations From ATT&CK Mapped Data

Upgrade your course experience with: Subscriptions

Get the Advantage $3,895

Thank you for choosing subscriptions!

Upgrade your course experience with: Subscriptions

Get the Advantage $3,895

Thank you for choosing subscriptions!

Upgrade your course experience with: Subscriptions

Get the Advantage $3,895

Thank you for choosing subscriptions!

MITRE ATT&CK Framework FAQs

What is the MITRE ATT&CK Framework?

Who is this course designed for?

How can this course benefit my career or organization?

What are the main takeaways from this course?

Who should attend?

Related Courses