Visão Geral

Este curso apresenta o framework MITRE ATT&CK e sua aplicação na identificação, análise, detecção e resposta a comportamentos adversários. O participante compreenderá táticas, técnicas e sub-técnicas, com foco especial em ambientes Windows, Active Directory, credential access, privilege escalation, lateral movement e defesa baseada em comportamento.

Objetivo

Após realizar este curso, você será capaz de:

• Compreender a estrutura do MITRE ATT&CK
• Diferenciar táticas, técnicas e sub-técnicas
• Mapear comportamentos adversários
• Criar estratégias de detecção baseadas no ATT&CK
• Utilizar o framework em threat hunting e incident response

Publico Alvo

• Analistas de Cybersecurity
• Profissionais de SOC e Blue Team
• Threat Hunters
• Incident Responders
• Pentesters e Red Teamers
• Engenheiros de Detection Engineering

Pre-Requisitos

• Conhecimentos básicos de Cybersecurity
• Familiaridade com Windows
• Noções de redes e autenticação
• Conhecimentos básicos de Active Directory
• Familiaridade com SIEM é recomendada

Conteúdo Programatico

Module 1: MITRE ATT&CK Fundamentals

1. MITRE ATT&CK framework
2. ATT&CK objectives
3. Tactics
4. Techniques
5. Sub-techniques
6. Procedures
7. Groups and threat actors
8. Software and malware
9. ATT&CK knowledge base
10. ATT&CK terminology and relationships

Module 2: ATT&CK Enterprise Tactics

1. Reconnaissance
2. Resource Development
3. Initial Access
4. Execution
5. Persistence
6. Privilege Escalation
7. Defense Evasion
8. Credential Access
9. Discovery
10. Lateral Movement
11. Collection
12. Command and Control
13. Exfiltration
14. Impact

Module 3: Windows and Active Directory Techniques

1. Windows credential access
2. LSASS-related techniques
3. NTLM abuse
4. Kerberos abuse
5. Account manipulation
6. Privilege escalation
7. Lateral movement
8. Active Directory discovery
9. Domain Controller targeting
10. Authentication abuse
11. Remote services
12. Windows administrative tools

Module 4: Credential Access Techniques

1. Credential Access tactic
2. OS Credential Dumping
3. Credentials from Password Stores
4. Unsecured Credentials
5. Steal Web Session Cookie concepts
6. Input Capture concepts
7. Authentication process abuse
8. LSASS credential exposure
9. Credential material protection
10. Credential Access detection opportunities

Module 5: Detection with MITRE ATT&CK

1. ATT&CK-based detection
2. Detection data sources
3. Security telemetry
4. Windows Event Logs
5. Endpoint telemetry
6. Network telemetry
7. SIEM detection rules
8. Behavioral analytics
9. Detection coverage mapping
10. Technique-specific detection strategies

Module 6: Threat Hunting and Incident Response

1. ATT&CK-driven threat hunting
2. Hunt hypothesis development
3. Technique-based investigation
4. Attack chain analysis
5. Adversary behavior analysis
6. Incident classification
7. Evidence collection
8. Incident response mapping
9. Investigation timelines
10. ATT&CK-based response strategies

Module 7: ATT&CK Coverage and Security Operations

1. ATT&CK Navigator concepts
2. ATT&CK coverage assessment
3. Security control mapping
4. Detection gaps
5. Visibility gaps
6. Purple Team methodology
7. Red Team and Blue Team collaboration
8. Detection maturity
9. Security operations improvement
10. Continuous ATT&CK coverage assessment

Module 8: Practical ATT&CK Mapping and Case Studies

1. Mapping security events to techniques
2. Windows authentication scenario
3. Credential access scenario
4. Privilege escalation scenario
5. Lateral movement scenario
6. Active Directory compromise scenario
7. Attack chain mapping
8. Detection coverage exercise
9. Threat hunting exercise
10. Practical MITRE ATT&CK case studies