Skip to content
Quest Training

MITRE ATT&CK Framework for Cyber Defense Training Course

Uses MITRE ATT&CK tactics and techniques to map adversary activity, profile threats and find gaps in detection, hunting and incident response coverage.

TICM · Threat Intelligence & Cyber Threat ManagementAll Levels#2537ClassroomEnglish , Arabic
Duration
5 Days
Download BrochureView Upcoming Dates

Free substitution at any time · 30+ days' notice: full refund minus 10%. Cancellation policy

Sectors:Information Technology & CybersecurityCategories:Threat Intelligence & Cyber Threat Management

Course Overview

This advanced practical course develops the skills required to use the MITRE ATT&CK framework as a structured foundation for cyber defense, threat analysis, detection engineering, threat hunting, and incident response. Participants learn how adversary behaviours can be mapped to a common framework and translated into practical defensive actions. The program focuses on ATT&CK tactics, techniques, sub-techniques, procedures, data sources, detection opportunities, and defensive controls. It helps security teams understand how attackers operate across different stages of an intrusion and how ATT&CK can be used to evaluate detection coverage, identify defensive gaps, and strengthen security operations. Through practical attack-mapping exercises and defense scenarios, participants will analyse adversary behaviours, map observed activities to ATT&CK techniques, develop detection and hunting opportunities, assess existing security controls, and prioritize improvements based on organizational risk and threat exposure.

Learning Objectives

  • Analyse the structure, purpose, and core concepts of the MITRE ATT&CK framework.
  • Interpret ATT&CK tactics, techniques, sub-techniques, and procedures.
  • Map adversary behaviours and attack activities to relevant ATT&CK techniques.
  • Apply ATT&CK to threat intelligence and adversary profiling.
  • Use ATT&CK to develop threat hunting hypotheses and detection opportunities.
  • Evaluate security telemetry and data sources against ATT&CK techniques.
  • Assess detection coverage and identify defensive gaps.
  • Develop detection and monitoring requirements based on adversary techniques.
  • Apply ATT&CK to incident investigation and attack reconstruction.
  • Use ATT&CK to support defensive control assessment and security improvement.
  • Prioritize security improvements according to threat relevance and organizational risk.
  • Develop an ATT&CK-based cyber defense improvement framework.

Who Should Attend

This course is designed for cybersecurity analysts, SOC analysts, threat hunters, detection engineers, incident responders, threat intelligence analysts, security engineers, and digital forensic professionals who use or plan to use MITRE ATT&CK in cyber defense activities. It is also suitable for cybersecurity managers, SOC managers, security architects, threat researchers, vulnerability management professionals, security operations leaders, and technical decision-makers responsible for improving enterprise detection and response capabilities. The program is particularly relevant to organizations seeking to establish a common language for adversary behaviour, improve detection coverage, strengthen threat hunting, and align security operations with realistic attack techniques.

Learning Outcomes

  • Explain the structure and purpose of the MITRE ATT&CK framework.
  • Distinguish between tactics, techniques, sub-techniques, and procedures.
  • Map observed adversary activities to relevant ATT&CK techniques.
  • Build structured profiles of adversaries and attack behaviours.
  • Develop threat hunting hypotheses using ATT&CK techniques.
  • Identify relevant telemetry and data sources for specific techniques.
  • Design detection opportunities based on adversary behaviour.
  • Assess organizational detection coverage using ATT&CK mappings.
  • Identify gaps between current defensive capabilities and relevant attack techniques.
  • Apply ATT&CK during incident investigation and attack reconstruction.
  • Prioritize defensive improvements based on threat relevance and security risk.
  • Develop an integrated ATT&CK-based framework for continuous cyber defense improvement.

Course Outline

Day 1

MITRE ATT&CK Framework Fundamentals & Adversary Behaviour

  • Introduction to MITRE ATT&CK and its role in cyber defense
  • ATT&CK structure and core components
  • Tactics, techniques, sub-techniques, and procedures
  • Enterprise attack lifecycle and adversary objectives
  • Understanding adversary behaviour
  • Threat actor and campaign analysis
  • ATT&CK groups, software, and procedure examples
  • Attack technique relationships and dependencies
  • Using ATT&CK as a common security language
  • ATT&CK navigation and analytical workflows
  • Practical Application: Analysing a simulated attack and mapping observed adversary activities to ATT&CK techniques
Day 2

ATT&CK for Threat Intelligence & Adversary Analysis

  • Using ATT&CK to structure threat intelligence
  • Adversary profiling and behaviour analysis
  • Threat actor tactics and techniques
  • Campaign and intrusion analysis
  • Mapping intelligence reports to ATT&CK
  • Identifying attack patterns and technique relationships
  • Threat-informed defense principles
  • Comparing adversary techniques across campaigns
  • Identifying organizationally relevant techniques
  • Translating intelligence into defensive priorities
  • Practical Application: Building an ATT&CK-based adversary profile from a simulated intelligence package
Day 3

ATT&CK for Threat Hunting & Detection Engineering

  • ATT&CK-driven threat hunting
  • Developing hunting hypotheses from techniques
  • Data sources and telemetry requirements
  • Detection opportunities across endpoint, network, identity, and cloud environments
  • Behaviour-based detection
  • Detection logic and security analytics
  • Mapping detection rules to ATT&CK techniques
  • Detection coverage assessment
  • Identifying blind spots and monitoring gaps
  • Detection validation and tuning
  • Practical Application: Developing threat hunting hypotheses and detection requirements for selected ATT&CK techniques
Day 4

ATT&CK for Incident Response & Defensive Assessment

  • Using ATT&CK during incident investigations
  • Attack reconstruction and technique sequencing
  • Mapping incident evidence to ATT&CK
  • Identifying attacker progression
  • Supporting incident containment and response
  • Security control assessment using ATT&CK
  • Defensive coverage and control gaps
  • Prioritizing detection and prevention improvements
  • Security posture analysis
  • Communicating ATT&CK-based findings to technical and management teams
  • Practical Application: Reconstructing a simulated cyber incident using ATT&CK and identifying defensive opportunities
Day 5

ATT&CK-Based Cyber Defense Strategy & Continuous Improvement

  • ATT&CK-based security maturity assessment
  • Building an ATT&CK coverage matrix
  • Prioritizing techniques based on organizational risk
  • Threat-informed security planning
  • Integrating intelligence, hunting, detection, and response
  • Measuring defensive coverage and effectiveness
  • Managing ATT&CK mappings and security content
  • Identifying emerging threats and updating defensive priorities
  • Governance and operational use of ATT&CK
  • Continuous improvement of cyber defense capabilities
  • Final Workshop: Developing an integrated ATT&CK-based cyber defense framework covering threat intelligence, adversary analysis, threat hunting, detection engineering, incident response, defensive coverage, risk prioritization, and continuous improvement

Upcoming Dates

Selected date

London · 15 – 19 Mar 2027 · Classroom

Need more details?Chat with us on WhatsApp

CityDatesPrice per ParticipantEarly Bird
ParisScheduled
9 – 13 Nov 2026€6,700—
SelectDownload Brochure
RiyadhScheduled
16 – 20 Nov 2026€4,800—
SelectDownload Brochure
RomeScheduled
23 – 27 Nov 2026€7,000€6,300until 2 Nov
SelectDownload Brochure
SalalahScheduled
23 – 27 Nov 2026€6,300€5,670until 2 Nov
SelectDownload Brochure
SingaporeScheduled
30 Nov – 4 Dec 2026€8,000€7,200until 9 Nov
SelectDownload Brochure
TrabzonScheduled
7 – 11 Dec 2026€5,300€4,770until 16 Nov
SelectDownload Brochure
TunisiaScheduled
14 – 18 Dec 2026€4,300€3,870until 23 Nov
SelectDownload Brochure
ViennaScheduled
21 – 25 Dec 2026€6,400€5,760until 30 Nov
SelectDownload Brochure
AmmanScheduled
27 – 31 Dec 2026€4,000€3,600until 7 Dec
SelectDownload Brochure
AmsterdamScheduled
4 – 8 Jan 2027€6,000€5,400until 14 Dec
SelectDownload Brochure
BakuScheduled
4 – 8 Jan 2027€5,300€4,770until 14 Dec
SelectDownload Brochure
BarcelonaScheduled
11 – 15 Jan 2027€6,000€5,400until 21 Dec
SelectDownload Brochure
CairoScheduled
18 – 22 Jan 2027€3,800€3,420until 28 Dec
SelectDownload Brochure
CasablancaScheduled
25 – 29 Jan 2027€4,700€4,230until 4 Jan
SelectDownload Brochure
DammamScheduled
1 – 5 Feb 2027€4,800€4,320until 11 Jan
SelectDownload Brochure
DohaScheduled
8 – 12 Feb 2027€4,700€4,230until 18 Jan
SelectDownload Brochure
DubaiScheduled
14 – 18 Feb 2027€4,700€4,230until 25 Jan
SelectDownload Brochure
GenevaScheduled
22 – 26 Feb 2027€7,300€6,570until 1 Feb
SelectDownload Brochure
IstanbulScheduled
22 – 26 Feb 2027€5,300€4,770until 1 Feb
SelectDownload Brochure
Kuala LumpurScheduled
1 – 5 Mar 2027€4,700€4,230until 8 Feb
SelectDownload Brochure
LisbonScheduled
8 – 12 Mar 2027€6,000€5,400until 15 Feb
SelectDownload Brochure
LondonScheduled
15 – 19 Mar 2027€5,800€5,220until 22 Feb
✓ SelectedDownload Brochure
MadridScheduled
22 – 26 Mar 2027€6,000€5,400until 1 Mar
SelectDownload Brochure
MakkahScheduled
29 Mar – 2 Apr 2027€4,800€4,320until 8 Mar
SelectDownload Brochure
ManamaScheduled
5 – 9 Apr 2027€5,300€4,770until 15 Mar
SelectDownload Brochure
MilanScheduled
12 – 16 Apr 2027€7,000€6,300until 22 Mar
SelectDownload Brochure
MarrakeshScheduled
12 – 16 Apr 2027€4,700€4,230until 22 Mar
SelectDownload Brochure
MunichScheduled
19 – 23 Apr 2027€6,000€5,400until 29 Mar
SelectDownload Brochure
MuscatScheduled
26 – 30 Apr 2027€6,300€5,670until 5 Apr
SelectDownload Brochure
OnlineScheduled
2 – 6 May 2027€2,700€2,430until 12 Apr
SelectDownload Brochure

Available in: Istanbul · Dubai · London · Riyadh · Doha · Amsterdam

Related Courses

Ready to Elevate Your Team's Capabilities?

Speak with our advisors about upcoming programmes or a bespoke corporate training plan.

Download BrochureContact Our Team