Reverse Engineering and Malware Analysis
Sign in to save your progress, earn points, and unlock module exams.
Topic 7.2 of Analyst Practice and Reporting
MITRE ATT&CK is the industry-standard taxonomy for adversary behaviour. This topic covers how to map observed malware actions to the correct tactics and techniques, the difference between technique inference and technique observation, and the use of ATT&CK Navigator to communicate findings to defenders.
By the end of this topic, you will
Quadrant 1 · e-Tutorial
Video content coming soon.
Quadrant 2 · e-Content
Quadrant 3 · Web Resources
External links
MITRE ATT&CK Enterprise Matrix
The full ATT&CK Enterprise matrix. Bookmark and use during every analysis.
ATT&CK Navigator
Web-based tool for creating and exporting ATT&CK layer visualisations. The standard output format.
ATT&CK Mapping Methodology (MITRE)
MITRE's own guidance on how to map behaviours to techniques with appropriate confidence.
Quadrant 4 · Self-Assessment
Analyst Practice and Reporting
Final unit assessment covering IOC extraction and pivoting, MITRE ATT&CK technique mapping, and writing the malware analysis report. 20 questions, 60% to pass.
REMA: Complete Assessment
A comprehensive 120-question assessment covering the entire Reverse Engineering and Malware Analysis curriculum: malware taxonomy and reverse engineering fundamentals, static and dynamic analysis, reversing malicious code, malicious web and document files, in-depth analysis of packed and fileless malware, and self-defending malware techniques.
Quadrant 5 · Play
Ungraded practice for MITRE ATT&CK Technique Mapping: games and hands-on Skill Labs that use this topic, plus the crossword for Analyst Practice and Reporting. It never affects your unit assessment, and clearing a game or lab for the first time earns EZ Board points when you are signed in.
Sequence
The Cyber Kill Chain
7 steps from this unit. Free to play. Earn 30 EZ Board points on your first clear.
Discussion · 0 comments
This is the discussion thread for the lesson "MITRE ATT&CK Technique Mapping" (Reverse Engineering and Malware Analysis, Unit 7). Ask questions, share real-world examples, and help classmates who are stuck. Conversation starters. Try explaining one of these in your own words: - Identify the 14 ATT&CK tactics and locate techniques within them - Map a set of observed malware behaviours to ATT&CK techniques with appropriate confidence - Distinguish between technique observation, inference, and assumption
No comments yet. Start the conversation. Comments here also appear in the forum.
Open in forum