← detection engineer

MITRE ATT&CK 101 — Tactics, Techniques, Navigator

beginner 2.5h

Navigate the ATT&CK matrix, distinguish tactic / technique / sub-technique / procedure, and map real adversary writeups to techniques.

After this module you will

  • › Navigate the MITRE ATT&CK matrix and use the Navigator app
  • › Distinguish tactics, techniques, sub-techniques, and procedures
  • › Explain how ATT&CK differs from the Kill Chain and Diamond models
  • › Use the detection coverage and data-source tabs in Navigator
  • › Map a real adversary writeup to ≥3 ATT&CK techniques

Lessons

1 Why Frameworks Exist — Kill Chain, Diamond, ATT&CK
20 min
2 Tactics, Techniques, Sub-techniques, and Procedures
20 min
3 Reading the Matrix and Using ATT&CK Navigator
25 min
4 Data Sources, Detection Coverage, and Prioritization
20 min
5 Worked Example: Mapping a Real Intrusion to ATT&CK
25 min

Module Quiz

Test your knowledge before moving on.

Take Quiz →