This course teaches learners how to use the MITRE ATT&CK framework to guide threat hunting activities effectively. The goal is to help participants avoid aimless hunting and develop specific hypotheses and plans for their hunts. By utilizing an adversary emulation developed at Splunk, participants will learn how to apply techniques from the MITRE ATT&CK framework to identify artifacts and indicators, leading to more insightful and operationalized findings. The teaching method involves practical demonstrations and real-world examples. This course is intended for analysts and professionals involved in threat hunting activities within organizations.
Don't Boil the Ocean - Using MITRE ATT&CK to Guide Hunting Activity
Security BSides San Francisco via YouTube
Overview
Syllabus
BSidesSF 2019 - Don't Boil the Ocean: Using MITRE ATT&CK to Guide Hunting Activity (John Stoner)
Taught by
Security BSides San Francisco
Related Courses
-
Threat Hunting - Using MITRE ATT&CK Against Carbanak Malware
-
MITRE ATT&CK - The Play at Home Edition
-
Becoming a Dark Knight - Adversary Emulation Demonstration for ATT&CK Evaluations
-
ARTHIR - ATT&CK Remote Threat Hunting Incident Response Windows Tool
-
Improve Likelihood Calculation by Mapping MITRE ATT&CK to Existing Controls
-
Emulación de Adversarios con Mitre ATT&CK y Caldera
