Threat Informed Planning with Macro-level ATT&CK Trending

on YouTube ↗40m

" summary

Research aggregates Mandiant M-Trends, Red Canary, CISA alerts and CTID over 2020–2022 to rank nearly 600 ATT&CK techniques and finds four techniques appear in the top 20 for at least three vendors; M‑Trends provides the most granular sub‑technique frequencies. Command and scripting interpreter frequency jumps (roughly 5% to 31–50% in some reports), and correlation analysis on CISA alerts shows Task Scheduling and Command and Scripting Interpreter act as facilitator hubs with distinct association patterns, suggesting starting detection and hunting on those top four techniques.

AI-written summary · about

" chapters (13)

1. 0:00Introduction to talk
2. 1:06Why focus on threat data
3. 3:18ATT&CK framework basics
4. 5:06Pyramid of Pain explained
5. 6:53Macro-level threat reporting
6. 10:04Analyzing top ATT&CK techniques
7. 14:46Public vs private sector data
8. 16:15Consensus in threat reporting
9. 19:58Multiple methods for prioritization
10. 20:19Correlation analysis of techniques
11. 25:53Other ATT&CK analysis methods
12. 28:46Applying findings to defense
13. 31:01Summary and Q&A

" related talks

• 38mSightings Ecosystem: A Data-driven Analysis of ATT&CK in the WildKellyn Wagner Ramsdell, Mike Cunningham · 34th Annual FIRST Conference 2022
• 01h 47mMITRE ATT&CK FundamentalsSean Whitley · FIRST & AfricaCERT Virtual Symposium for the African and Arab Regions 2021
• 35mThese Aren't the Threats You're Looking For: How Our APT Focus Ruins CTIKatie Nickels · RSAC 365 Virtual Summit 2021
• 42mKeynote: The Expanding Universe of Cyber ThreatsDr. Xena Olsen · BSidesSF 2023
• 30mThe SOC Counter ATT&CKMathieu Saulnier · NorthSec 2019
• 58mMITRE ATT&CK for DevelopersChris Ayers · NDC Security 2026
• 40mMITRE ATT&CK® as a Framework for Cloud Threat InvestigationJasdeep Basra, Tanu Kaushik · RSAC 2021
• 21mUnderstanding the Latest Mitre Att&Ck Evaluation DataNorm Chan · BSides Vancouver 2021