Start here

The vocabulary everything else uses. Do this first even if you have been in the field a while, because the rest of the path assumes the terms.

By the end you should be able to

• Explain what a tactic, a technique and a sub-technique are, and read a technique ID
• Say what ATT&CK is not: a score, a product requirement, or a threat model
• Use a technique page as a study plan rather than a reference

1. What ATT&CK actually is, and how to stop being intimidated by it

   Deliberately does not open with the matrix, which is where most people bounce off.

   4 min read

One tactic, worked four ways, on your own machine. The order matters: each lab is more powerful and more visible than the one before, and the last one only makes sense once you have seen the other three.

By the end you should be able to

• Find the same persistence through the event log, the filesystem, the registry and Autoruns
• Explain the difference between state and history, and why you need both
• Say why detections built on process ancestry survive where ones built on process name drown
• Use frequency analysis to find what is rare rather than trying to know what is bad
• Decide when a technique needs a detection and when it needs a hunt

1. Guided lab: find the Run key before it finds you

   The simplest case. Establishes the method the rest of the module reuses.

   6 min read

2. Guided lab: the scheduled task that looks like Windows

   The same technique class with a harder problem: a hundred legitimate neighbours to hide among.

   5 min read

3. Guided lab: a service that starts before you do

   Runs as SYSTEM before anyone logs in, and introduces frequency analysis.

   5 min read

4. Guided lab: the persistence that leaves almost no logmembers

   Last on purpose. It logs nothing by default, which is only interesting once you know how loud the others are.

   5 min read

5. Guided lab: nine hours at Northwind Freight, from lure to scheduled taskoptionalmembers

   Puts the module in a whole intrusion, where persistence is the last step rather than the only one.

   9 min read

Not written yet. Northwind already turns on an LSASS dump, and this module will take that apart properly.

By the end you should be able to

• Recognise credential dumping in process access telemetry
• Scope an incident correctly once credentials are known to be gone

Nothing published for this module yet. It is listed because the path is a plan, and a plan that hides its gaps is not much use to anyone building a term around it.