A Primer: Getting Started with MITRE Shield
summary
MITRE Shield presents an actionable active‑defense knowledge base: an MITRE ATT&CK–linked matrix with eight tactics and 33 techniques, plus an attack‑mapping section pairing ATT&CK techniques with opportunity spaces, use cases and implementable techniques. It documents building an instrumented synthetic network where real malware is detonated to observe TTPs, seeding decoy credentials and content to detect, channel, contain, or study adversaries; origin story: an APT engagement from a decade ago that succeeded in ejecting the intruder.
AI-written summary · about
chapters (17)
- 0:00Intro
- 0:19RSAC 365 Virtual Series
- 0:59Active Defense greatly improves defenses Shield introduces the way forward
- 1:54Setting the stage for Shield
- 2:53Defensive Adversary Engagement without engagement, the adversary has uncontested advantage
- 4:09What does Defensive Adversary
- 5:48MITRE Shield contains Active Defense building blocks
- 6:57Shield Website Matrix View
- 7:44Shield Website - ATT&CK Mapping
- 8:43Shield's ATT&CK Mapping
- 9:07Opportunity Spaces
- 10:39Use Cases
- 11:20Techniques
- 12:23The Shield Matrix
- 15:27Using Shield for Basic Detection
- 19:56Using Shield for Adversary Engagement
- 21:44Next Steps in Active Defense and Adversary Engagement
related talks
40mA Primer: Getting Started with MITRE Shield
01h 47mMITRE ATT&CK Fundamentals
39mThe PR3TACK Initiative: Building the World’s First Preemptive Tactics & Countermeasures Knowledgebas
58mMITRE ATT&CK for Developers
13mMITRE D3FEND
34mMITRE Attack Flow: Laying Foundations for Predictive Intelligence
13mMITRE D3FEND
31mDon't Boil the Ocean: Using MITRE ATT&CK to Guide Hunting Activity