MITRE ATT&CK Fundamentals
Talkat FIRST & AfricaCERT Virtual Symposium for the African and Arab Regions 2021 · 2021-12-07..12-09·
summary
MITRE ATT&CK is a free, community‑curated knowledge base of real-world adversary behaviors that maps 14 Enterprise tactics to techniques and (as of recent releases) roughly 177 techniques and 348 sub‑techniques; it links each technique to mitigations, data sources and procedure examples. Practical tools include the ATT&CK Navigator for layered heat‑maps and scoring, the MITRE CAR repository for reusable analytics, and the ATT&CK Evaluations to test vendor detections. Concrete detection examples target LSASS memory access via process access and API execution telemetry and collection of Windows event 4698 for scheduled‑task abuse.
AI-written summary · about
chapters (29)
- 0:00Introduction
- 1:28What is Attack
- 3:18Course Structure
- 4:06Understanding Attack
- 10:46The Pyramid of Pain
- 14:13Attack Enterprise
- 22:00Mobile Attack
- 24:58Tactics
- 26:40Lateral Movement
- 27:15Command and scripting interpreter
- 28:19Sub techniques
- 33:14Mitigations
- 35:48Data Sources
- 39:13Memory Access
- 40:05Procedure Examples
- 40:15Procedures
- 41:05Groups
- 42:57Living Framework
- 44:13Evolution
- 47:25Contributions
- 48:19Website
- 48:35Section 2 Benefits
- 50:24Team Effort
- 52:20Threat Intelligence
- 53:56Attack Contributors
- 54:53Attack Contributions
- 56:33Collaboration
- 57:25Adversary Language
- 59:18Adversary Communication
related talks
58mMITRE ATT&CK for Developers
48mMITRE ATT&CK: The Play at Home Edition
40mMITRE ATT&CK® as a Framework for Cloud Threat Investigation
38mSightings Ecosystem: A Data-driven Analysis of ATT&CK in the Wild
21mUnderstanding the Latest Mitre Att&Ck Evaluation Data
30mThe SOC Counter ATT&CK
26mA Primer: Getting Started with MITRE Shield
31mAdversary Emulation: Generating MITRE ATT&CK Technique Sequences