Papers

• Philosophy Paper: This whitepaper provides an in-depth look at why we created ATT&CK, how we update and maintain it, and what the community commonly uses it for.
• Finding Cyber Threats with ATT&CK-Based Analytics: This paper presents a methodology for using ATT&CK to build, test, and refine behavioral-based analytic detection capabilities using adversary emulation.

Presentations

• Automation: The Wonderful Wizard of CTI (Or Is IT?)

  January 2020
  This presentation from the SANS CTI Summit explores how automation can be applied to cyber threat intelligence using the Threat Report ATT&CK Mapper (TRAM).
• Adaptive Adversary Emulation with MITRE ATT&CK

  October 2019
  This presentation from the SANS Purple Team Summit looks at moving beyond traditional, rigid adversary emulation by leveraging MITRE ATT&CK.
• Keeping CTI on Track: An Easier Way to Map to MITRE ATT&CK

  October 2019
  This presentation from BSidesDC covers an overview of ATT&CK and introduces a new tool for automating mapping to it called the Threat Report ATT&CK Mapper (TRAM).
• Turning Intelligence Into Action with MITRE ATT&CK

  October 2019
  This presentation from Anomali Detect discusses how you can use ATT&CK for threat intelligence, including a process for mapping intelligence to ATT&CK as well as biases to watch out for as you do this. Slides are also available.
• Leveraging MITRE ATT&CK for Detection, Analysis & Defense

  September 2019
  This presentation from the RH-ISAC Retail Cyber Intelligence Summit covers all four of the primary ATT&CK use cases, with a focus on detection and analytics, and assessments and engineering.
• MITRE ATT&CK: The Play at Home Edition

  August 2019
  This presentation from Black Hat walks through the story of a fictional organization in order to explain how different teams can use ATT&CK as a powerful force to improve defenses. Slides are also available.
• ATT&CKing Your Adversaries - Operationalizing cyber intelligence in your own environment for better sleep and a safer tomorrow

  August 2019
  This presentation from BSidesLV covers how to use ATT&CK to take cyber threat intelligence and operationalize it into behaviors that can drive relevant detections. Slides are also available.
• Lessons Learned Applying ATT&CK-Based SOC Assessments

  June 2019
  This keynote presentation from the SANS Security Operations Summit discusses a process to gauge a SOC’s detective capabilities as they relate to ATT&CK, including MITRE’s practical experiences and lessons learned.
• Finding Dependencies Between Adversary Techniques

  June 2019
  This presentation from the Annual FIRST Conference presents different methods of using ATT&CK to find dependencies between adversary techniques to support defense.
• Do-It-Yourself ATT&CK Evaluations to Improve Your Security Posture

  June 2019
  This presentation from the SANS Enterprise Defense Summit explains how defenders can improve their security posture through the use of adversary emulation by performing their very own ATT&CK Evaluations.
• APT ATT&CK - Threat-based Purple Teaming with ATT&CK Continued

  May 2019
  This presentation from x33fcon takes a deep-dive into using ATT&CK for purple teaming, including lessons learned from ATT&CK Evaluations. Slides are also available.
• Putting MITRE ATT&CK into Action with What You Have, Where You Are

  May 2019
  This presentation from Sp4rkcon presents an overview of ATT&CK as well as ideas for how you can put it into action for four use cases. Slides are also available.
• To Blue with ATT&CK-Flavored Love

  April 2019
  This presentation from the SANS Blue Team Summit provides a red teamer’s perspective to show how ATT&CK is a valuable tool to help red and blue teams work together to improve their defenses. Slides are also available.
• Turning Intelligence into Action with MITRE ATT&CK

  March 2019
  This presentation from the FIRST CTI Symposium discusses how you can use ATT&CK for threat intelligence as well as biases to be aware of as you do that.
• ATT&CK in Practice: A Primer to Improve Your Cyber-Defense

  March 2019
  This presentation from RSA covers an overview of ATT&CK as well as key use cases and tools that can be used to convert it into practice.
• ATT&CK by Numbers

  March 2019
  This presentation from BSides NOVA explores a number of different ways to analyze the ATT&CK knowledge base and how organizations might perform similar analyses with their own data.
• ATT&CK Your CTI: Lessons Learned from Four Years in the Trenches

  January 2019
  This presentation from the SANS CTI Summit presents an overview of how two different organizations use ATT&CK to map adversary behavior and prioritize how you apply that intelligence to defenses. Slides are also available.
• Advancing a Scientific Approach to Security Tool Evaluations with MITRE ATT&CK

  January 2019
  his presentation from Shmoocon discusses the use case of evaluating security tools with ATT&CK. It provides an overview of the approach taken by the ATT&CK Evaluations initiative.
• One technique, two techniques, red technique, blue technique

  November 2018
  This presentation from BSides DC explores how you can apply ATT&CK to optimize and harmonize adversarial and defensive cyber operations.
• ATT&CKing FIN7: The Value of Using Frameworks for Threat Intelligence

  October 2018
  This presentation from the FireEye Cyber Defense Summit covers the use of ATT&CK as a framework for understanding FIN7 behaviors. Slides are also available.
• ATT&CKing the Status Quo: Threat-Based Adversary Emulation with MITRE ATT&CK

  September 2018
  This presentation from the SANS Threat Hunting Summit shows how you can use ATT&CK to apply threat intelligence to adversary emulation.
• Stop, Drop, and Assess Your SOC

  August 2018
  This presentation from the DEFCON Blue Team Village shows how ATT&CK can be used for Security Operations Center (SOC) assessments.
• ATT&CKing the Status Quo: Improving Threat Intelligence and Cyber Defense with MITRE ATT&CK

  August 2018
  This presentation from BSidesLV provides an overview of ATT&CK along with details on two use cases: threat intelligence and analytics. Slides are also available.
• ATT&CKing with Threat Intelligence

  July 2018
  This presentation from HOPE provides perspective on how to use threat intelligence for ATT&CK-based adversary emulation. Slides are also available.
• Threat-based Purple Teaming with ATT&CK

  May 2018
  This presentation from x33fcon discusses how purple teams can use ATT&CK as a common language for adversary emulation. Slides are also available.
• Post-Exploit Threat Modeling with ATT&CK

  November 2016
  This presentation from BSides Delaware outlines the key features of ATT&CK, describing the tactics, techniques, groups, and software that make up ATT&CK along with a discussion on how it can be used.

Other ATT&CK Efforts

Graphics

MITRE ATT&CK Roadmap

Last updated October 2020

MITRE ATT&CK Matrix Poster

Last updated October 2020