MITRE ATT&CK: The Play at Home Edition

on YouTube ↗48m

" summary

Small company maps ATT&CK to Splunk, authors 41 technique detections and visualizes coverage in the ATT&CK Navigator, then uses Atomic Red Team to emulate adversary procedures; detections fire but a separate fictional APT still compromises them because of blind spots and overconfidence. Concrete takeaways: map detections to actual data sources, score confidence on a 0–5 scale instead of green/red, automate taxonomy sync via APIs, and run red/blue purple exercises to turn red findings into durable analytics rather than checkbox rules.

AI-written summary · about

" chapters (14)

1. 0:00Welcome and introductions
2. 0:39Play at home setup
3. 3:11Meet the characters
4. 6:11The cyber attack narrative
5. 10:13Implementing MITRE ATT&CK
6. 13:54Validating defenses
7. 16:17The attack fails
8. 17:54Lessons learned
9. 20:51Executive threat mapping
10. 26:00Actionable threat intel
11. 30:43Data-driven detection
12. 35:18Reducing false positives
13. 38:01Purple team collaboration
14. 41:53Final takeaways

" related talks

• 01h 47mMITRE ATT&CK FundamentalsSean Whitley · FIRST & AfricaCERT Virtual Symposium for the African and Arab Regions 2021
• 30mThe SOC Counter ATT&CKMathieu Saulnier · NorthSec 2019
• 58mMITRE ATT&CK for DevelopersChris Ayers · NDC Security 2026
• 31mDon't Boil the Ocean: Using MITRE ATT&CK to Guide Hunting ActivityJohn Stoner · BSidesSF 2019
• 30mShall We Play a Game?J. Wolfgang Goerlich · BSidesSF 2019
• 21mUnderstanding the Latest Mitre Att&Ck Evaluation DataNorm Chan · BSides Vancouver 2021
• 38mSightings Ecosystem: A Data-driven Analysis of ATT&CK in the WildKellyn Wagner Ramsdell, Mike Cunningham · 34th Annual FIRST Conference 2022
• 40mMITRE ATT&CK® as a Framework for Cloud Threat InvestigationJasdeep Basra, Tanu Kaushik · RSAC 2021