MITRE ATT&CK Training Course
The MITRE ATT&CK framework provides a structured methodology for categorizing adversarial tactics and techniques to evaluate organizational risk. This approach enhances security awareness by identifying defensive gaps and prioritizing risk mitigation for government entities.
This instructor-led, live training session (delivered online or on-site) is designed for information system analysts seeking to utilize MITRE ATT&CK to mitigate the risk of security compromises for government operations.
Upon completion, participants will be capable of:
- Establishing the requisite development environment to implement MITRE ATT&CK protocols.
- Categorizing attacker interactions with system infrastructure.
- Documenting adversary behaviors within organizational systems.
- Tracking attack patterns, analyzing trends, and evaluating existing defense mechanisms.
Instructional Format
- Interactive lectures and facilitated discussions.
- Extensive exercises and practical application.
- Hands-on implementation in a live laboratory environment.
Customization Options
- To request tailored training content for government requirements, please contact us to coordinate scheduling and scope.
Course Outline
Introduction
Definition and Classification of Malware
- Categorization of malware variants
- Historical development of malicious software
Summary of Malicious Intrusion Vectors
- Self-replicating threats
- Non-self-replicating threats
ATT&CK Matrix Architecture
- Enterprise ATT&CK framework
- Pre-ATT&CK environment
- Mobile ATT&CK domain
MITRE ATT&CK Framework
- Eleven tactical categories
- Specific techniques
- Observed procedures
Configuring the Development Environment
- Establishing a version control repository (GitHub)
- Acquiring a project containing a to-do list data system
- Deployment and configuration of ATT&CK Navigator
Monitoring Compromised Systems (WMI)
- Executing command-line scripts to perform lateral movement
- Leveraging ATT&CK Navigator to detect intrusion
- Evaluating compromise severity via the ATT&CK framework
- Conducting process-level monitoring
- Recording findings and remediating vulnerabilities in the security architecture
Monitoring Compromised Systems (EternalBlue)
- Executing command-line scripts to perform lateral movement
- Leveraging ATT&CK Navigator to detect intrusion
- Evaluating compromise severity via the ATT&CK framework
- Conducting process-level monitoring
- Recording findings and remediating vulnerabilities in the security architecture
Summary and Final Remarks
Requirements
- Familiarity with information system security principles
Intended Audience
- Information systems analysts
Runs with a minimum of 4 + people. For 1-to-1 or private group training, request a quote.
MITRE ATT&CK Training Course - Booking
MITRE ATT&CK Training Course - Enquiry
MITRE ATT&CK - Consultancy Enquiry
Testimonials (2)
- Understanding that ATT&CK creates a map that makes it easy to see, where an organization is protected and where the vulnerable areas are. Then to identify the security gaps that are most significant from a risk perspective. - Learn that each technique comes with a list of mitigations and detections that incident response teams can employ to detect and defend. - Learn about the various sources and communities for deriving Defensive Recommendations.
CHU YAN LEE - PacificLight Power Pte Ltd
Course - MITRE ATT&CK
All is excellent
Manar Abu Talib - Dubai Electronic Security Center
Course - MITRE ATT&CK
Upcoming Courses
Related Courses
AI-Powered Cybersecurity: Threat Detection & Response
21 HoursThis instructor-led, live training in US (online or onsite) is intended for entry-level cybersecurity professionals seeking to utilize AI for enhanced threat detection and response capabilities for government.
Upon completion of this training, participants will be able to:
- Understand the application of AI in cybersecurity contexts.
- Implement AI algorithms for threat detection.
- Automate incident response processes using AI tools.
- Integrate AI capabilities into existing cybersecurity infrastructure.
AI-Powered Cybersecurity: Advanced Threat Detection & Response
28 HoursThis instructor-led, live training in US (online or onsite) is aimed at intermediate-level to advanced-level cybersecurity professionals who wish to elevate their skills in AI-driven threat detection and incident response.
By the end of this training, participants will be able to:
- Implement advanced AI algorithms for real-time threat detection.
- Customize AI models for specific cybersecurity challenges.
- Develop automation workflows for threat response.
- Secure AI-driven security tools against adversarial attacks.
Blue Team Fundamentals: Security Operations and Analysis
21 HoursThis instructor-led, live training in US (available online or onsite) is tailored for intermediate-level IT security professionals seeking to refine their skills in security monitoring, analysis, and response for government applications.
Upon completion of this program, participants will be able to:
- Define the strategic role of the Blue Team within cybersecurity operations.
- Leverage SIEM tools for comprehensive security monitoring and log analysis.
- Identify, evaluate, and execute response protocols for security incidents.
- Conduct network traffic analysis and gather actionable threat intelligence.
- Implement established best practices in Security Operations Center (SOC) workflows.
Bug Bounty Hunting
21 HoursVulnerability disclosure initiatives involve the systematic identification of security weaknesses within software, web applications, or infrastructure, followed by the responsible reporting of these findings for remediation and recognition.
This instructor-led, live training session, available online or onsite, is designed for entry-level security researchers, software developers, and information technology professionals seeking to master the fundamentals of ethical security assessment and participation in formal disclosure programs.
Upon completion of this training, participants will be able to:
- Comprehend the foundational principles of vulnerability discovery and the governance of disclosure programs.
- Apply professional-grade tools, including Burp Suite and browser development utilities, for application testing.
- Detect common web security deficiencies, including XSS, SQLi, and CSRF.
- Prepare and submit clear, actionable vulnerability reports through established platforms for government and private sector use.
Instructional Delivery Model
- Interactive instructional modules and facilitated discussion.
- Practical application of security testing tools within controlled, simulated environments.
- Supervised exercises emphasizing the identification, validation, and documentation of security flaws.
Instructional Tailoring Capabilities
- To solicit a customized training curriculum aligned with your organization's specific applications or testing requirements, please contact the provider for coordination.
Bug Bounty: Advanced Techniques and Automation
21 HoursAdvanced Techniques and Automation in Vulnerability Research provides a detailed examination of high-impact security flaws, automation frameworks, reconnaissance methodologies, and tooling strategies employed by expert security professionals.
This instructor-led, live training session (available online or onsite) is designed for intermediate-to-advanced security researchers, penetration testers, and vulnerability researchers seeking to optimize workflows, expand reconnaissance capabilities, and identify complex vulnerabilities across diverse environments.
Upon completion of this training, participants will be equipped to:
- Automate reconnaissance and scanning processes for multiple targets.
- Utilize advanced tools and scripts for efficient security automation.
- Identify complex, logic-based vulnerabilities that exceed standard scanning capabilities.
- Construct custom workflows for subdomain enumeration, fuzzing, and reporting.
Course Format
- Interactive instruction and facilitated discussion.
- Practical application of advanced tools and scripting for automation.
- Supervised laboratory exercises focused on real-world security workflows and advanced attack chains.
Course Customization Options
- To request a tailored training module for government agencies based on specific target sets, automation requirements, or internal security challenges, please contact us to schedule.
CHFI - Certified Digital Forensics Examiner
35 HoursThe Certified Digital Forensics Examiner (vendor-neutral certification) is designed to provide advanced training to Cyber Crime and Fraud Investigators. The curriculum covers electronic discovery and sophisticated investigation techniques. This course is essential for any personnel for government who may encounter digital evidence during the course of an investigation.
The Certified Digital Forensics Examiner training instructs participants in the methodology for conducting computer forensic examinations. Learners will acquire the skill to apply forensically sound investigative techniques to assess the scene, collect and document relevant information, interview appropriate personnel, maintain chain-of-custody, and prepare findings reports.
This course benefits organizations, individuals, government offices, and law enforcement agencies engaged in litigation, establishing proof of guilt, or implementing corrective actions based on digital evidence.
Certified Incident Handler
21 HoursThe Certified Incident Handler program delivers a disciplined framework for managing and mitigating cybersecurity incidents with precision and efficiency.
This live, instructor-led training (available virtually or in-person) is designed for intermediate-level IT security personnel seeking to enhance their tactical proficiency in planning, categorizing, isolating, and resolving security events.
Upon completion of this curriculum, participants will be equipped to:
- Comprehend the incident response lifecycle and its distinct operational phases.
- Execute standardized procedures for threat detection, event classification, and stakeholder notification.
- Implement robust strategies for containment, eradication, and system recovery.
- Formulate comprehensive post-incident reporting mechanisms and continuous improvement initiatives.
Curriculum Structure
- Interactive lectures and structured discussions.
- Practical application of incident handling protocols within simulated environments.
- Directed exercises emphasizing detection, containment, and response workflows.
Customization Provisions for Government
- Organizations may request tailored training aligned with specific incident response protocols or technical assets by contacting our team for coordination.
Mastering Continuous Threat Exposure Management (CTEM)
28 HoursThis instructor-led, live training in US (online or onsite) is designed for intermediate-level cybersecurity professionals seeking to implement CTEM within their organizational structures.
Upon completion of this training, participants will be equipped to:
- Comprehend the foundational principles and operational stages of CTEM.
- Identify and prioritize risks utilizing established CTEM methodologies.
- Integrate CTEM practices into existing security operational protocols.
- Leverage specialized tools and technologies for continuous threat management.
- Formulate strategies to validate and continuously improve security measures.
Cyber Threat Intelligence
35 HoursThis live, instructor-led training in US (online or on-site) is tailored for senior cybersecurity professionals aiming to deepen their understanding of Cyber Threat Intelligence and develop skills to effectively manage and mitigate cyber threats.
Upon completion of this training, participants will be able to:
- Understand the fundamental concepts of Cyber Threat Intelligence (CTI).
- Assess the current cyber threat landscape.
- Collect and process intelligence data effectively.
- Conduct advanced threat analysis.
- Leverage Threat Intelligence Platforms (TIPs) and automate threat intelligence processes.
Fundamentals of Corporate Cyber Warfare
14 HoursThis instructor-led live training session, conducted in US (online or on-site), examines the critical components of enterprise security, spanning from artificial intelligence to database protection. It also provides an in-depth review of the contemporary tools, operational processes, and strategic perspectives essential for safeguarding organizations against sophisticated attacks for government and commercial purposes.
DeepSeek for Cybersecurity and Threat Detection
14 HoursThis live, instructor-led training session, conducted in US either virtually or in person, is designed for intermediate-level cybersecurity practitioners aiming to utilize DeepSeek for advanced threat detection and automation tasks.
By the conclusion of this program, participants will be proficient in:
- Utilizing DeepSeek AI for immediate threat recognition and detailed analysis.
- Implementing AI-based anomaly detection methods.
- Streamlining security monitoring and response actions with DeepSeek.
- Integrating DeepSeek into current cybersecurity frameworks.
Duty Managers Cyber Resilience
14 HoursThis instructor-led live training in US (online or onsite) is tailored for intermediate-level duty managers and operational leaders aiming to establish robust cyber resilience strategies to protect public sector organizations from cyber threats.
Upon completion of this training, participants will be able to:
- Comprehend the fundamentals of cyber resilience and their direct application to duty management functions.
- Formulate incident response plans that ensure sustained operational continuity.
- Identify specific cyber threats and vulnerabilities present within their operational environment.
- Deploy security protocols to effectively minimize risk exposure.
- Coordinate team responses during cyber incidents and subsequent recovery phases.
Junior Detection Engineer Essentials
21 HoursDetection engineering encompasses the design, implementation, and refinement of methodologies to identify malicious activity across information systems and networks.
This instructor-led live training, available in online or onsite formats, is designed for entry-level cybersecurity professionals seeking to acquire practical proficiency in developing and tuning security detection mechanisms.
Upon completion of this program, participants will possess the competencies necessary to:
- Formulate effective detection rules and signatures using standard security tooling.
- Analyze logs and telemetry to identify suspicious operational behaviors.
- Apply threat intelligence to enhance detection logic.
- Optimize alerting and mitigate false positives within a Security Operations Center (SOC) workflow.
Instructional Format
- Structured guidance accompanied by practical demonstrations.
- Scenario-based exercises and hands-on analytical tasks.
- Practical detection construction within an interactive laboratory environment.
Program Customization
- Should your agency require a tailored version of this curriculum, please contact us to discuss specific customization requirements for government operations.
Open-Source EDR Fundamentals: Deployment, Detection & Response
14 HoursOpenEDR is an open-source endpoint detection and response framework designed to provide continuous telemetry, detection, and analytical capabilities regarding adversarial activities on government endpoints.
This instructor-led training session, available in both online and on-site formats, is tailored for entry-level to intermediate IT and security professionals responsible for deploying, configuring, and operating OpenEDR to identify and counter cyber threats for government use.
Upon completion of this course, participants will demonstrate the ability to:
- Deploy and configure OpenEDR agents and server components to facilitate telemetry collection.
- Execute foundational detection and monitoring tasks using OpenEDR dashboards and event views.
- Analyze endpoint events to discern suspicious activities and identify potential security threats.
- Incorporate OpenEDR alerts into established incident response workflows and reporting structures.
Course Delivery Format
- Interactive instructional lectures and facilitated discussions.
- Extensive practical exercises and skill reinforcement activities.
- Hands-on implementation tasks within a live laboratory environment.
Customization Options for Government
- Requests for customized training content for this course may be submitted to the appropriate training coordination office.
Mastering Open-Source EDR & Mitre ATT&CK for Threat Hunting
21 HoursOpenEDR is an open-source endpoint detection and response platform that enables real-time analytic detection with MITRE ATT&CK visibility, supporting event correlation and root cause analysis of malicious activity.
This instructor-led training, delivered either online or on-site, is designed for advanced Security Operations Center (SOC) analysts, threat hunters, and incident responders. It focuses on the design and operation of threat hunting programs using OpenEDR, with an emphasis on mapping detections to the MITRE ATT&CK framework.
Upon completion of this training, participants will be equipped to:
- Deploy and configure OpenEDR agents and server components for the collection and analysis of telemetry data.
- Map observable endpoint telemetry to MITRE ATT&CK techniques and develop corresponding detection logic.
- Design and execute threat hunting workflows leveraging behavioral analytics and event correlation to identify adversary activity.
- Integrate OpenEDR findings into incident response playbooks and conduct comprehensive root cause analysis.
Course Delivery Format
- Interactive lectures and facilitated discussions.
- Extensive practical exercises and skill-building activities.
- Hands-on implementation within a live laboratory environment.
Customization Options
- To arrange a customized training curriculum tailored for government or specific organizational needs, please contact the provider for coordination.
