Don't Boil the Ocean: Using MITRE ATT&CK to Guide Hunting Activity

on YouTube ↗31m

" summary

Argues that MITRE ATT&CK should drive focused hunts so teams stop "boiling the ocean," and demonstrates a Splunk-built adversary emulation (blue‑team CTF) that uses PowerShell Empire artifacts to create huntable hypotheses. Uses Sysmon + Sigma-like rules, ATT&CK Navigator overlays, and open‑sourced curated datasets to find frequent PowerShell techniques, map gaps (notably credential access), and convert findings into alerts and correlation searches — operationalized and reproducible.

AI-written summary · about

" chapters (12)

1. 0:00Introduction and speaker background
2. 1:04Why and what to hunt in cybersecurity
3. 3:36Overview of MITRE ATT&CK framework
4. 6:48Diamond model for threat intelligence
5. 10:15Time-bound threat hunting strategies
6. 11:40Building hypotheses with MITRE ATT&CK
7. 14:33Confirming or refuting hunt hypotheses
8. 17:02Operationalizing hunt findings
9. 25:08Turning hunts into actionable alerts
10. 27:16Using Sysmon and MITRE ATT&CK together
11. 29:23Identifying gaps in detection coverage
12. 30:04Resources and next steps

" related talks

• 48mMITRE ATT&CK: The Play at Home EditionRyan Kovar, Katie Nickels · Black Hat USA 2019
• 30mThe SOC Counter ATT&CKMathieu Saulnier · NorthSec 2019
• 01h 47mMITRE ATT&CK FundamentalsSean Whitley · FIRST & AfricaCERT Virtual Symposium for the African and Arab Regions 2021
• 36mBeing A Better Defender By Channeling Your Worst Adversary:John Stoner · 34th Annual FIRST Conference 2022
• 58mMITRE ATT&CK for DevelopersChris Ayers · NDC Security 2026
• 38mAdversary Detection Pipelines: Finally Making Your Threat Intel UsefulXena Olsen · Black Hat Asia 2020
• 31mThreat Hunting — DemystifiedAshish Thapar · RSAC 2020 Asia Pacific & Japan
• 11mReimagining the MITRE ATT&CK F...Keith Mokris, Ashley Ward · KubeCon + CloudNativeCon Europe 2021