MITRE ATT&CK Fundamentals case studies
MITRE ATT&CK Fundamentals · Put your knowledge to work in context.
MITRE ATT&CK Fundamentals is an entry-level credential for people who need to read, interpret, and apply the ATT&CK knowledge base in day-to-day security work. It suits SOC analysts, threat intelligence staff, detection engineers, incident responders, vulnerability managers, and security architects who must translate adversary behavior into defensible controls. The MITRE ATT&CK Fundamentals case studies are 5 cases and about 4,405 words.
1The 92 Percent Coverage Claim: Mapping at the Right Level of Abstraction
A 40-person SOC has just completed its first ATT&CK coverage assessment. The team maintains 118 Splunk detection rules and, after two weeks of mapping, reports 92 percent coverage of the Enterprise matrix.
840 words, about 4 min2AppLocker or EDR: Choosing Between a Mitigation and a Data Source
NorthBridge Insurance runs 2,400 Windows endpoints, 600 of them servers. EDR agents cover all servers and the 400 laptops bought in the last two years; the remaining 2,000 endpoints have antivirus only.
879 words, about 4 min3Layer Drift, Revoked Objects and a TAXII Feed That Overwrites Itself
Kestrel Financial's CTI team publishes six ATT&CK Navigator layers, one per intelligence source, all created against ATT&CK v13. In March the platform vendor upgraded the embedded ATT&CK data.
899 words, about 4 min4One Score for Three Worlds: Enterprise, Mobile and ICS in a Hospital Group
Harborview Health is a 900-bed hospital group. Its estate spans three worlds: 12,000 Windows and macOS workstations and servers; 4,000 iOS and Android tablets used by nurses for medication administration; and a clinical device network holding 300 infusion pumps, 40 building-automation controllers and a vendor-managed HMI, separated from the corporate LAN by a firewall but reachable from the clinical VLAN.
890 words, about 4 min5Two Vendor Names, One Loader: Modelling Attribution Without Overclaiming
Meridian Threat Intelligence tracks a cluster of intrusions against logistics firms. Two feeds describe it: Vendor A calls it 'Silent Chollima' and publishes a report covering January to March 2024; CERT-B publishes 'Storm-0921' covering April to June 2024.
897 words, about 4 min