ATT&CK Threat Hunting study plan

Draw the ATT&CK Enterprise matrix structure from memory: list all 14 tactics in order and state each tactic's role in the adversary lifecycle

Differentiate techniques, sub-techniques, procedures, and software/groups, and label 10 randomly chosen technique IDs by tactic and platform

Map the ATT&CK data model objects (STIX domain objects for tactic, technique, group, software, mitigation, data component) to what each is used for in a hunt

Inventory the telemetry available in your own lab or employer environment across Windows, Linux, macOS, cloud, and network, and tag each source with the ATT&CK data components it can satisfy

Identify three high-value data sources (e.g., process creation with command line, EDR telemetry, cloud audit logs) and write down what each can and cannot prove

Configure or collect real logs for at least three platforms (e.g., Sysmon with command-line auditing, Linux auditd or eBPF, and one cloud audit trail) and verify field fidelity

Document normalization gaps: compare raw field names against your query schema and list at least 8 mappings that must be handled

Assess data quality risks: clock skew, log latency, missing parent processes, truncated command lines, and sampling, and state the hunt impact of each

Build a query that reconstructs process ancestry from parent-child fields and validate it against a known benign chain

Write retention and coverage notes stating which ATT&CK tactics your current telemetry cannot observe

Decompose three public threat intelligence reports into observable behaviors and assign each behavior an ATT&CK technique or sub-technique ID with justification

Distinguish actor-level, campaign-level, and malware-level reporting and note which level supports which hunting scope

Convert one report into a ranked hunt priority list using likelihood, impact, and current telemetry coverage

Identify and discard at least three pieces of intel that are not actionable for hunting (IOC-only, unverifiable, or out of scope)

Practice confidence labeling: mark each mapping as high, medium, or low confidence and state the evidence behind each label

Write three hunt hypotheses in a falsifiable form (who, what behavior, which data source, what would confirm or refute)

Derive each hypothesis from an ATT&CK technique and specify the exact data components and fields needed to test it

Define scope, time window, and success criteria for each hypothesis before querying

Draft a hunt plan template covering hypothesis, technique IDs, data sources, queries, expected benign baselines, and abort conditions

Peer-review or self-review the three hypotheses and rewrite any that cannot be refuted by available telemetry

Write behavioral queries for at least four techniques across two platforms, avoiding brittle IOC-only logic

Apply baseline-first analysis: compute frequency of parent-child pairs or command-line patterns and flag rare outliers

Use stacking and least-frequency analysis to surface anomalies in a real dataset

Tune one query to reduce false positives and document the tuning decisions and residual noise

Execute the week 4 hunt plans and record raw query output plus analyst notes

Triage hunt hits using a documented decision tree: benign, suspicious, true positive, and unknown

Validate at least two findings by reconstructing the full event timeline and confirming the behavior is not a known administrative or software pattern

Perform false-positive root cause analysis on at least three hits and record the benign explanation

Document one end-to-end finding with evidence, timeline, technique mapping, and confidence

Practice escalating a validated finding with the minimum evidence an incident responder needs

Convert two validated hunt analytics into production-ready detection rules with metadata, severity, and false-positive notes

Write detection rule documentation covering logic rationale, data dependencies, testing steps, and known blind spots

Map your current detection portfolio to ATT&CK techniques and compute coverage per tactic

Identify coverage gaps and rank them by threat relevance from week 3 intel

Define a feedback loop for how hunt findings update detection content and intel priorities

Re-derive the tactic list and data model from memory and correct any errors against the matrix

Re-run one week 5 hypothesis end-to-end within a time limit to simulate exam pacing

Review all deliverables and consolidate weak areas into a one-page remediation list

Answer practice questions or self-quiz on mapping, data sources, and hypothesis design, and log every miss with its cause

Finalize a personal reference sheet of data components, common technique IDs, and query patterns for last-minute review