The document discusses the MITRE ATT&CK framework, which is a knowledge base of tactics, techniques, and procedures utilized by cyber adversaries, aiding in threat understanding and incident response. It emphasizes the role of triage in evaluating security events, prioritizing responses, and mapping events to specific ATT&CK techniques for improved detection. The document also highlights best practices including continuous learning and collaboration within security operations centers (SOCs) to adapt to evolving threats.

1. Using MITRE ATT&CK to Triage
Events
[Your Name]
[Presentation Date]

2. Introduction
• • Overview of MITRE ATT&CK
• - A comprehensive knowledge base of tactics,
techniques, and procedures (TTPs) used by
cyber adversaries.
• - Assists in understanding potential threats,
improving detection, and refining incident
response strategies.
• - Importance in triage: Provides a structured
approach to evaluate security events,
prioritize responses, and mitigate risks.

3. Understanding the ATT&CK
Framework
• • Tactics and Techniques
• - Tactics: High-level objectives (e.g., Initial
Access, Execution, Persistence).
• - Techniques: Specific methods used to
achieve those objectives (e.g., phishing,
PowerShell).
• - Examples: Tactic: Credential Access;
Technique: Keylogging or credential dumping.
• • ATT&CK Matrices: Overview of matrices for
different environments (Enterprise, Mobile,

4. The Role of Triage in Incident
Response
• • What is Triage?
• - Evaluating incoming security alerts to
determine their severity, relevance, and
potential impact.
• - Essential for efficient resource allocation
and response prioritization in a SOC.
• • How Triage Fits into the SOC Workflow
• - Detection → Triage → Investigation →
Response.
• - Triage acts as a filter to ensure high-priority

5. Leveraging MITRE ATT&CK for
Triage
• • Mapping Events to ATT&CK
• - Correlate observed security events with
specific ATT&CK techniques.
• - Example: Unusual login attempts may map
to 'Brute Force' under 'Credential Access'
tactic.
• • Prioritization of Events
• - Assess threat levels based on known TTPs.
• - Factors: Severity, Confidence Level.

6. Example Triage Scenario
• • Case Study
• - Scenario: Employee reports phishing emails;
SIEM alerts for multiple login attempts.
• - Analysis Using ATT&CK:
• - Identify techniques: Initial Access via
phishing, Credential Access through brute
force.
• - Investigate logs for suspicious IP addresses.
• • Decision Making

7. Integrating ATT&CK into Security
Tools
• • SIEM and Threat Hunting
• - Integrate ATT&CK into SIEM systems for
improved detection capabilities.
• - Create alerts based on known techniques.
• • Automated Detection
• - Use MITRE Caldera for automated adversary
emulation to test detections.
• - Implement custom detection rules based on
ATT&CK.

8. Best Practices for Using MITRE
ATT&CK
• • Continuous Learning
• - Update knowledge on emerging techniques
and adversary behaviors.
• - Participate in workshops and training
sessions.
• • Collaboration
• - Encourage teamwork within the SOC and
sharing insights.
• • Documentation

9. Future Trends and Challenges
• • Adapting to Evolving Threats
• - MITRE ATT&CK evolves as new TTPs are
identified, requiring teams to stay informed.
• • Challenges in Implementation
• - Resource Constraints: Limited staffing/tools
can hinder effective implementation.
• - Skill Gaps: Ensuring SOC personnel are
trained in using ATT&CK effectively.

10. Conclusion
• • Key Takeaways
• - MITRE ATT&CK is a powerful tool for
enhancing event triage.
• - Structured approaches improve incident
response efficiency and effectiveness.
• - Continuous education and adaptation to
evolving threats are crucial.

11. Q&A
• • Open the floor for questions from the
audience.

12. References
• • Useful Resources:
• - MITRE ATT&CK Framework:
https://attack.mitre.org
• - SANS Institute - Using the ATT&CK
Framework: https://www.sans.org/white-
papers/38096/
• - Cybint - Triage Using MITRE ATT&CK:
https://cybintsolutions.com