MITRE ATT&CK Fundamentals study plan
MITRE ATT&CK Fundamentals · Give each week a clear focus.
8 weeks · About 7 hours per week
ATT&CK Overview and History & Adversary Tactics and the Enterprise Matrix
Explain how ATT&CK originated from adversary observation work and what problem it was designed to solve versus prior enumerations of threats
Describe the structure of tactics, techniques, and sub-techniques and state why tactics are ordered as an adversary lifecycle rather than a severity ranking
Recite from memory the enterprise tactic columns in order and give one sentence on the adversary goal each represents
Distinguish ATT&CK from adjacent frameworks by stating what each models and where they complement rather than replace ATT&CK
Sketch the three ATT&CK technology domains and the platform scope each covers
Your checkpoint
A one-page written map of all enterprise tactics in lifecycle order, each with an adversary goal and two techniques that belong to it, produced without consulting the matrix
Adversary Tactics and the Enterprise Matrix & Techniques, Sub-techniques, and Procedure Examples
Walk every enterprise tactic and write a plain-language definition of the adversary objective it captures
For each tactic, list three techniques and state the observable behavior that would indicate each one
Explain the difference between a technique and a sub-technique and when a sub-technique exists versus a standalone technique
Read three procedure examples and identify which parts describe behavior versus which parts describe a specific tool
Explain why techniques are platform-agnostic while procedures are not
Your checkpoint
A tactic-by-tactic table with three techniques each, the observable behavior for each, and a short note on one sub-technique that refines its parent
Techniques, Sub-techniques, and Procedure Examples & Software, Groups, and Campaigns
Trace one technique from definition through its sub-techniques to the procedure examples that reference it
Explain what a group entry represents, how aliases work, and why attribution in ATT&CK is deliberately conservative
Explain what a software entry represents and distinguish tools from malware in the ATT&CK sense
Describe what a campaign adds beyond a group entry and when analysts should model activity as a campaign
Identify the relationship links that connect groups, software, campaigns, techniques, and mitigations in the data model
Your checkpoint
A relationship diagram for one group of your choosing showing its software, campaigns, and at least five techniques, with a paragraph on why the attribution is qualified
Software, Groups, and Campaigns & Mitigations and Data Sources
Explain what a mitigation entry does and does not claim, including why it is mapped to techniques rather than to threats
For five techniques, name a mitigation and state the residual risk that remains after it is applied
Describe how data sources and data components support detection of a technique
Explain the relationship between ATT&CK data sources and the telemetry a SOC actually collects
Identify techniques that have weak detection coverage and explain why
Your checkpoint
A mitigation and detection worksheet covering ten techniques with, for each, one mitigation, one data source, and a stated residual risk
ATT&CK for Mobile and ATT&CK for ICS
Describe how ATT&CK for Mobile differs in scope and platform coverage from the enterprise matrix
List the mobile tactics and explain which enterprise tactics have no mobile counterpart and why
Describe how ATT&CK for ICS is organized and why safety, availability, and physical consequence change the analysis
Compare one technique that appears in both enterprise and ICS and explain how its impact differs across the two domains
Explain why mitigations in ICS emphasize architecture and segmentation over endpoint controls
Your checkpoint
A two-column comparison of enterprise versus ICS treatment of the same technique, plus a list of mobile tactics mapped against enterprise tactics showing gaps
Navigator, STIX/TAXII, and ATT&CK Data Model
Explain what STIX objects represent ATT&CK content and how relationships are expressed between them
Describe how TAXII enables collection sharing and what problem it solves over static file distribution
Explain the ATT&CK object identifier scheme and why stable identifiers matter for tooling and reporting
Use the Navigator to build a layer, apply a score, and export it in a shareable format
Explain how versioning works and why technique deprecations and revocations must be tracked
Your checkpoint
An exported Navigator layer covering the techniques from your week 3 group diagram, with a short note on how you would keep it current across ATT&CK versions
Threat-Informed Defense and Mapping to ATT&CK & Mitigations and Data Sources
Map a described intrusion scenario to specific techniques and justify each mapping with observed behavior
Apply a defensible mapping standard and explain why mapping to too many techniques weakens analysis
Prioritize techniques for defense using threat intelligence about which groups target your sector
Translate a prioritized technique list into detection engineering requirements and control gaps
Explain what threat-informed defense means operationally and how it differs from compliance-driven control selection
Your checkpoint
A threat-informed defense brief mapping a realistic scenario to techniques, ranking them by relevance, and naming the top three detection gaps to close
Threat-Informed Defense and Mapping to ATT&CK & ATT&CK Overview and History & Navigator, STIX/TAXII, and ATT&CK Data Model
Re-derive the tactic lifecycle and the structure of the data model from memory without notes
Revisit every missed practice question and write the correct reasoning for each
Complete a timed mixed-domain practice set and record per-domain accuracy
Explain to a non-specialist, in under two minutes, what ATT&CK is, what it is not, and how it is used
Identify your two weakest domains and state the specific remediation you will do after the exam window
Your checkpoint
A timed full-length practice result with per-domain accuracy recorded, plus a one-page remediation list for the two weakest domains
Milestones
Week 2: Can recite all enterprise tactics in lifecycle order and place any given technique under the correct tactic without notes
Week 4: Can explain the group, software, campaign, and mitigation object types and how they relate to techniques, and has produced the ten-technique mitigation and detection worksheet
Week 6: Can describe the STIX and TAXII roles, the identifier scheme, and versioning, and has exported a working Navigator layer
Week 8: Scores at or above 80 percent overall on a timed mixed-domain practice set with no domain below 70 percent