Module
MITRE ATT&CK Fundamentals
Take an incident write-up, tag each thing the attacker did with its ATT&CK tactic and technique, cite the version you mapped against, and say what the mapping does not prove. One seven-line write-up, mapped five ways, against Enterprise ATT&CK v19.2.
62 min · Beginner
Start MITRE ATT&CK Fundamentals
What you will learn
- Say what ATT&CK records and what it does not, and rewrite an artifact as a behaviour
- Name the tactic for a behaviour by asking why, across the 15 Enterprise tactics of version 19
- Tag one behaviour with every technique that applies, at the right level, with the version written down
- Map a whole incident write-up with evidence beside every ID, and catch CISA's three mapping mistakes
- Say what an overlap with a group's techniques supports, and write the sentence that goes in the report
Lessons
Behaviour, Not Artifacts
ATT&CK is a record of what attackers have been seen doing, not a list of every attack or every weakness. Tell a value the attacker left behind from an action they took.
Tactics Are the Why
A tactic is the attacker's reason. Name it by asking why, meet the 15 tactics of version 19, and stop reading the matrix as a timeline.
One Behaviour, Several Cells
Tactic, technique, sub-technique, procedure. One behaviour can carry two techniques, one technique four tactics, and IDs move between versions.
Mapping the Write-Up
CISA's six steps on the whole write-up, the three mistakes CISA names, and a mapping you do yourself before you see the answer.
What a Match Does Not Prove
Your techniques match a group's page. What Group, Software and Campaign entries are built from, and the one sentence the overlap supports.