4. Mapping the Adversary

As explained before, there is no threat hunting without good threat intelligence. Depending on the structure and the resources of your organization you may have some threat intelligence reports already processed for you. But either because you don’t have a specialized intelligence team, or because you want to carry some investigations yourself, you should know how to work with the MITRE ATT&CK Framework to carry out your own mapping of intelligence reports.

In this chapter we’re going to cover the following main topics:

• The ATT&CK Framework
• Mapping with ATT&CK
• Testing Yourself