The SOC Counter ATT&CK
summary
Walks through applying MITRE ATT&CK to a SOC by mapping all 244 enterprise techniques in the ATT&CK Navigator, scoring each technique with weighted questions (examples shown: 35%, 30%, 10%) and producing colored JSON layers to track progress. Recommends ingesting Sysmon logs, using Sigma and OSQuery rule sets, and validating detections with Atomic Red Team. Cites Red Canary top‑10 where PowerShell dominates, reports moving from ~90% to 100% visibility on the top ten through focused detection and hunting.
AI-written summary · about
chapters (20)
- 0:00Intro
- 6:08History of Attack
- 7:09Attack Framework
- 8:00Attack Navigator
- 14:45Scoring
- 15:16Weight
- 15:44Points
- 17:42Threat Detection Report
- 18:27Threat Modeling
- 19:59Matrix and KPI
- 23:44Sigma
- 24:36Modular
- 24:57OS Query
- 25:09Tread Hunting
- 25:52Red Canary
- 26:15Atomic Friday
- 26:38RedTeam Automation
- 26:52Commercial
- 27:23Key takeaways
- 28:41Thank you
related talks
48mMITRE ATT&CK: The Play at Home Edition
31mDon't Boil the Ocean: Using MITRE ATT&CK to Guide Hunting Activity
01h 47mMITRE ATT&CK Fundamentals
38mSightings Ecosystem: A Data-driven Analysis of ATT&CK in the Wild
58mMITRE ATT&CK for Developers
40mCybersecurity Operations Center Technology Taxonomy
21mUnderstanding the Latest Mitre Att&Ck Evaluation Data
40mMITRE ATT&CK® as a Framework for Cloud Threat Investigation