How to use the MITRE ATT&CK Matrix for Enterprise: Video walkthrough
Unsure how to use the MITRE ATT&CK® Matrix for Enterprise? Infosec Principal Security researcher Keatron Evans explains how it works, how you can use it to understand your adversaries and how it can help you and your team better to develop their cybersecurity skills.
Watch the full video below:
Cyber Work listeners get free cybersecurity training resources. Click below to see free courses and other free materials.
Mapping events to the MITRE ATT&CK framework
(0:00–0:24) Cybercriminals cost $6 trillion worth of damage every year. But how exactly are they breaking into organizations' networks, evading detection and causing problems like ransomware, denial of service and intellectual property theft? And more importantly, how can you stop them?
Well, one free tool, every cybersecurity team can use to answer these questions is the MITRE ATT&CK framework.
What is the MITRE ATT&CK framework?
(0:44–1:01) The ATT&CK in MITRE ATT&CK stands for Adversarial Tactics, Techniques and Common Knowledge. And the framework does just that; it helps you understand the real-world tactics and techniques that adversaries use when they prepare, launch and execute an attack against your organization.
MITRE ATT&CK Matrix for Enterprise
(1:02–1:22) Let's take a look at the ATT&CK Matrix for Enterprise, which has 14 tactics and 200-plus techniques used by real-world threat actors.
The biggest benefit of the framework is that it provides a realistic guide to how adversaries will attempt to gain access to your environment and achieve their end goal.
How to use the MITRE ATT&CK framework
(1:23–2:09) As a practitioner and instructor, I regularly use the framework in several ways. I'll often reference it when I'm doing penetration test results and walkthroughs for customers. I will often use it when I'm leading responses to data breaches. It provides a perfect foundation to give even non-technical audiences an overview of how the attackers got in and what they did when I'm teaching classes. I will often design capture-the-flag exercises around the framework. Whereas each flag is accomplishing a task from the framework.
It's also great for building team skills and finding out where your team's knowledge gaps are when it comes to the adversary. You're going to have a much better idea of how to defend against the adversary.
Understanding the attacker mindset
(2:10–2:36) If you have a good picture of what their tactics look like, the MITRE ATT&CK framework is just as much about mindset as it is about the knowledge base itself. That's why it can be such a great asset for organizations looking to guide and train their teams around the most prevalent threats.
And I've noticed that the defenders I train around the framework tend to change their mindsets and truly start to think like the attacker.
Try this cyber range yourself
(2:37–2:49) If you want to build your team's hands-on skills around tactics and techniques in the MITRE ATT&CK framework go to infosecinstitute.com/range and try our hands-on cyber ranges today.
More cybersecurity training resources
Check out the weekly Cyber Work Podcast for in-depth conversations with cybersecurity practitioners and industry thought leaders — plus other free cybersecurity videos.
Cyber Work listeners also get more free cybersecurity resources. See the latest free training courses and resources and keep learning!
In this Series
- How to use the MITRE ATT&CK Matrix for Enterprise: Video walkthrough
- Advanced adversary tactics and defense evasion: Lab and walkthrough
- Privilege escalation via cross-site scripting: Lab and walkthrough
- Executing the Sandworm APT: Lab and walkthrough
- Using persistence to maintain a foothold: Example and walkthrough
- Pivoting and proxychains with MITRE ATT&CK: Example and walkthrough
- Recon and resource development with MITRE ATT&CK: Example and walkthrough
- How to use MITRE ATT&CK Navigator: A step-by-step guide
- Most common MITRE ATT&CK tactics and techniques: CISA shares most common RVAs
- Using MITRE ATT&CK with cyber threat intelligence
- MITRE ATT&CK framework mitigations: An overview
- MITRE ATT&CK framework techniques, sub-techniques & procedures
- MITRE Shield: An active defense and adversary engagement knowledge base
- 7 Steps of the MITRE ATT&CK®-based Analytics Development Method
- How to Use MITRE ATT&CK® to Map Defenses and Understand Gaps
- Using MITRE ATT&CK®-based analytics for threat detection: 5 principles
- Use cases for implementing the MITRE ATT&CK® framework
- How to Use the MITRE ATT&CK® Framework and the Lockheed Martin Cyber Kill Chain Together
- How to use the MITRE ATT&CK® framework and diamond model of intrusion analysis together
- MITRE ATT&CK® Framework Tactics: An Overview
- MITRE ATT&CK® Framework Matrices: An Overview
- The Ultimate Guide to the MITRE ATT&CK® Framework
- MITRE ATT&CK spotlight: Process injection
- MITRE ATT&CK: System shutdown/reboot
- MITRE ATT&CK: Credential dumping
- MITRE ATT&CK: Endpoint denial of service
- MITRE ATT&CK: Disk content wipe
- MITRE ATT&CK: Disk structure wipe
- MITRE ATT&CK: Supply chain compromise
- MITRE ATT&CK: Shortcut modification
- MITRE ATT&CK: External remote service
- MITRE ATT&CK: Port knocking
- MITRE ATT&CK vulnerability spotlight: Forced authentication
- MITRE ATT&CK vulnerability spotlight: Exploitation for credential access
- MITRE ATT&CK: External remote services
- MITRE ATT&CK: Exploiting a public-facing application
- MITRE ATT&CK: Drive-by compromise
- MITRE ATT&CK vulnerability spotlight: Credentials in registry
- MITRE ATT&CK vulnerability spotlight: Credentials in files
- MITRE ATT&CK vulnerability spotlight: Brute force
- MITRE ATT&CK: Hardware Additions
- MITRE ATT&CK vulnerability spotlight: Bash history
- MITRE ATT&CK vulnerability spotlight: Account manipulation
- MITRE ATT&CK: Replication through removable media
- MITRE ATT&CK: Command-line interface
- MITRE ATT&CK: Network sniffing
- MITRE ATT&CK: Input capture
- MITRE ATT&CK: Audio Capture
- MITRE ATT&CK: Man-in-the-browser
- MITRE ATT&CK: Browser bookmark discovery
- MITRE ATT&CK: Clipboard data
Get free resources in your inbox!
Sign up for our newsletter and get free cybersecurity resources in your inbox every week. Prepare for your next cert, learn new skills, increase your salary and more!
MITRE ATT&CK™
