courses
Free

MITRE ATT&CK Defender™ ATT&CK® Adversary Emulation

Do you want to learn the exciting discipline of Adversary Emulation? In this MITRE ATT&CK® Defender™ (MAD) Adversary Emulation course, you’ll learn how to emulate real-world adversary threats to improve cybersecurity. Leveraging the MITRE ATT&CK Framework, you will research, plan, and execute adversary emulation activities in hands-on labs.
4
Share
Start CourseNeed to train your team? Learn more
Create Free AccountNeed to train your team? Learn more
8
H 
6
M
Time
intermediate
difficulty
9
ceu/cpe

Course Content

Adversary Emulation Fundamentals
Researching Adversary TTPs
Adversary Emulation Planning
Implementing Adversary TTPs
Executing Adversary TTPs
Identifying Detections and Mitigations (Lab 4.4 Walkthrough)

30m

Implementing Adversary TTPs
Identifying Detections and Mitigations (Lab 4.4 Overview)

10m

Implementing Adversary TTPs
Automating Adversary TTPs (Lab 4.3 Walkthrough)

10m

Implementing Adversary TTPs
Automating Adversary TTPs (Lab 4.3 Overview)

10m

Implementing Adversary TTPs
Implementing Adversary TTPs (Lab 4.2 Walkthrough)

30m

Implementing Adversary TTPs
Implementing Adversary TTPs (Lab 4.2 Overview)

10m

Implementing Adversary TTPs
Planning TTP Implementations (Lab 4.1 Walkthrough)

30m

Implementing Adversary TTPs
Planning TTP Implementations (Lab 4.1 Overview)

10m

Implementing Adversary TTPs
TTP Implementation Process

7m

Implementing Adversary TTPs
Implementing TTPs Overview

10m

Implementing Adversary TTPs
Defining Scope, Rules of Engagement, and Approving Authorities

8m

Adversary Emulation Planning
Planning Overview

7m

Adversary Emulation Planning
Addressing Intelligence Gaps

8m

Researching Adversary TTPs
Constructing the TTP Outline

7m

Researching Adversary TTPs
Selecting the Emulated TTPs

11m

Researching Adversary TTPs
Selecting the Emulated Threat

7m

Researching Adversary TTPs
Researching Adversary TTPs

8m

Researching Adversary TTPs
Adversary Emulation - Welcome to Module 2

4m

Researching Adversary TTPs
Executing the FIN6 Adversary Emulation Plan (Lab 1.3)

45m

Adversary Emulation Fundamentals
Optional Lab: Setting up Your Own Lab Environment

0m

Adversary Emulation Fundamentals
Lab: Touring the CTID Adversary Emulation Library

0m

Adversary Emulation Fundamentals
Introducing the Adversary Emulation Plan

5m

Adversary Emulation Fundamentals
Defining Engagement Objectives

7m

Adversary Emulation Fundamentals
Adversary Emulation Framework

10m

Adversary Emulation Fundamentals
Adversary Emulation Overview

10m

Adversary Emulation Fundamentals
Course Description

Who should take this course?

This course is designed for experienced and skilled cybersecurity practitioners who are interested in emulating real-world threats to assess cybersecurity effectiveness.

What are the prerequisites for this course?

You will gain the most benefit from this course if you have mastered the following:

  • MITRE ATT&CK® Defender™ (MAD) ATT&CK Fundamentals Training
  • Proficient in administering Windows and Linux systems from the command line
  • Proficient in basic networking concepts (OSI Model and TCP/IP)
  • Proficient in Virtual Machine software such as VMWare or VirtualBox
  • Familiar with common red team/pentester software and techniques (examples: Kali Linux distribution, Metasploit, Nmap, Mimikatz, etc.)

    • Why should I take this course?

    In this course, you will gain the following capabilities:

  • Understand cyber adversary emulation’s purpose, its characteristics, and common use
  • cases.
  • Leverage the MITRE ATT&CK Framework to inform adversary emulation planning activities, including defining engagement objectives, scope, and rules of engagement.
  • Use cyber threat intelligence to select emulated threats of salient interest to the sponsor organization.
  • Implement adversary emulation tactics, techniques, and procedures (TTPs) based on real-world cyber threats.
  • Execute adversary TTPs to assess and improve cybersecurity, while balancing realism against time and safety constraints.
  • Use the MITRE ATT&CK Framework to communicate adversary emulation activities, findings, and recommendations for improvement.

    • What makes this course different from other courses on similar topics?

    This course is part of the MITRE ATT&CK® Defender™ (MAD) cybersecurity training and certification program produced by MITRE's own subject matter experts. The lead instructor for this course, Michael C. Long II, is a principal cyber adversary emulation engineer at MITRE and is truly an expert in this field. You will be learning how to leverage ATT&CK for adversary emulation from the people who created the ATT&CK framework.

    Why should I take this course on Cybrary and not somewhere else?

    This course enables you to learn from one of the foremost experts in the field, and our on-demand format affords you the flexibility to learn at your own pace.

    This course is part of a Career Path:
    No items found.

    Instructed by

    Instructor
    Michael C. Long II

    Michael brings over 12 years of experience in offensive and defensive cyber operations and is a regular conference presenter and contributor to open source projects such as Metasploit, CALDERA, and the OffensiveGoLang project. Michael holds a Master of Science in Information Security Engineering with SANS Technology Institute and is working on his Ph.D. in Cyber Operations with Dakota State University.

    Instructor
    Govardhen Arunagiri

    Govardhen applies his background in offensive cyber security assessments and his experience in adversary emulation to improve the security of sensitive environments both within and external to MITRE. Govardhen earned his B.S. in Computer Engineering from the University of Maryland, College Park, and is currently pursuing his M.S. in Information Security Engineering at the SANS Technology Institute.

    Provider
    Cybrary Logo
    Certification Body
    MITRE Engenuity
    Certificate of Completion

    Complete this entire course to earn a MITRE ATT&CK Defender™ ATT&CK® Adversary Emulation Certificate of Completion