A Primer: Getting Started with MITRE Shield
summary
MITRE Shield presents a practical framework that maps defender actions to ATT&CK techniques and turns deception into measurable intel: examples include running malware in a pseudo‑real environment to detonate malware, deploying decoy accounts and decoy networks to legitimize lures, and building protocol decoders to recover command‑and‑control traffic. Real ops (from coffee‑shop rigs to virtual labs) produce orders‑of‑magnitude more indicators than static analysis, but require explicit planning, isolation, and caution—classic pitfalls include exposed USB artifacts that end engagements.
AI-written summary · about
chapters (9)
- 0:00Start
- 1:38Talk organization
- 2:00Shield builds on a variety of work from MITRE
- 3:05Bottom line: Shield maps to MITRE ATT&CK
- 11:06What does Adversary Engagement look like?
- 25:23Shield's ATT&CK Mapping
- 25:53Shield Website - ATT&CK Mapping
- 27:11Shield Website - Matrix View
- 32:39Apply Shield
