MITRE ATT&CK & CKC Framework

• Introduction to the course and objectives
• What is MITRE ATT&CK and its significance in CTI
• Understanding the ATT&CK framework and its components
• Examining the different stages of an attack and how they relate to ATT&CK

• Identifying sources of finished reporting for mapping to ATT&CK
• Techniques for mapping finished reporting to ATTCK
• Hands-on exercise: Mapping finished reporting to ATT&CK

• Identifying sources of raw data for mapping to ATT&CK
• Techniques for mapping raw data to ATT&CK
• Hands-on exercise: Mapping raw data to ATT&CK

• Challenges in storing ATT&CK-mapped data and their solutions
• How to analyze and interpret ATT&CK-mapped data
• Hands-on exercise: Storing and analyzing ATT&CK-mapped intel

• How to make defensive recommendations using CTI analysis
• Practical applications of ATT&CK-mapped data in security operations
• Hands-on exercise: Making ATT&CK-mapped data actionable with defensive recommendations

• What is a Cyber Kill Chain?
• The history and evolution of Cyber Kill Chain
• Cyber Kill Chain process
• Cyber Kill Chain model

• How does the Cyber Kill Chain Work?
• Phases of the Cyber Kill Chain
• Reconnaissance
• Weaponization
• Delivery
• Exploitation
• Installation
• Command and Control
• Actions on Objectives

• Reconnaissance phase
• Intrusion phase
• Exploitation phase
• Privilege Escalation phase
• Lateral Movement phase
• Obfuscation/Anti-Forensics phase
• Denial of Service phase
• Exfiltration phase

• How can Cyber Kill Chain protect against attacks?
• Create a simulation of cyberattacks
• Identify security gaps by evaluating the controls
• Remediate cybersecurity gaps

• Implementing Cyber Kill Chain in the organization
• Measuring and monitoring the effectiveness of Cyber Kill Chain
• Incident Response Planning
• Cyber Kill Chain case studies and examples

Participants should have a basic understanding of networking and cybersecurity concepts. Familiarity with common cyber threats and vulnerabilities is recommended. Participants should also have experience with the command-line interface and basic scripting skills. Familiarity with a scripting language such as Python is helpful but not required.