For a recap of previous MITRE ATT&CK Defender™ learning paths, please revisit the stories: MITRE ATT&CK DEFENDER™ Cyber Threat Intelligence Training — Leadership Recommendations & Review MITRE ATT&CK Defender™ ATT&CK® SOC Assessments Training-Recommendations & Review MITRE ATT&CK Defender™ ATT&CK® Adversary Emulation Training-Recommendations & Review In this story, I’ll cover the…

ATT&CK® Adversary Emulation For a recap of previous MITRE ATT&CK Defender™ learning paths, please revisit the stories MITRE ATT&CK DEFENDER™ Cyber Threat Intelligence Training — Leadership Recommendations & Review and MITRE ATT&CK Defender™ ATT&CK® SOC Assessments Training-Recommendations & Review. The ATT&CK® Adversary Emulation learning path includes instructor-led videos, with exams for paid subscribers…

ATT&CK® SOC Assessments For an overview of the MITRE ATT&CK Defender™ (MAD) training program, revisit the story: MITRE ATT&CK DEFENDER™ Cyber Threat Intelligence Training — Leadership Recommendations & Review. The ATT&CK® SOC Assessments training path includes instructor-led videos, with exams for subscribers looking to obtain a certification badge, and the learning objectives include: …

MITRE ATT&CK DEFENDER™ (MAD) Overview Before providing some thoughts on the Cyber Threat Intelligence (CTI) training content and certification path, a brief overview of the MITRE ATT&CK Defender™ (MAD) training program can help provide some context on the scope and proposed value. The MITRE Engenuity’s website defines MAD as: MITRE ATT&CK Defender™ (MAD) is a…

Introduction In a previous story, I wrote about duoreverse, a Python wrapper using a custom build of the duo_client to help red teams conduct multiple attack techniques against a Duo environment. Throughout the story, I provided attack scenarios with corresponding detection guidance, including example log events. …

Collection Management Part 3 — Collection Automation — In Part 1 of the Collection Management series, Collection Management Part 1 — Overview, we defined a collection workflow and focused on the objectives of each process step. In Part 2, Collection Management Part 2 — Design Technical Approach, we identified technical design considerations to capture website HTML, article text…

Addressing what is in your control — 10 October is World Mental Health Day and those in cybersecurity roles should take the opportunity to pause within the chaos of the latest zero-day, barrage of alerts, active incidents, new threat actor information, or risk mitigation politicking to acknowledge the uniqueness of this domain and the impact on mental…

Collection Management Part 2 — Design Technical Approach — In the previous story: Cyber Threat Intelligence Collection Management Part 1 — Overview the CTI Collection management lifecycle was explored. Part 2 will deep dive into the CTI collection design phase, specifically with a focus on future CTI Processing automation. In the previous post, the following collection source was leveraged…

Collection Management Part 1 — Overview — Cyber Threat Intelligence Lifecycle Prior to exploring collection management, it’s pertinent to define the cyber threat intelligence (CTI) lifecycle. The CTI lifecycle can broadly be identified under the following domains, each with specific objectives: Requirements Collection Processing Analysis Dissemination Feedback For a quick introduction to each domain, the following resources provide a good overview: