MAD Training and Certification Curriculum 

ATT&CK Cyber Threat Intelligence Certification and Training Program 

This is an intermediate-level program to inform and affirm a defender’s mastery in the skill to identify, develop, analyze, and apply ATT&CK-mapped intelligence. Defenders must earn five distinct badges to achieve the ATT&CK for CTI certification: 

• ATT&CK Cyber Threat Intelligence from Narrative Reporting Badge 
• ATT&CK Cyber Threat Intelligence from Raw Data Badge 
• ATT&CK Cyber Threat Intelligence Storage and Analysis Badge 
• ATT&CK Cyber Threat Intelligence Defensive Recommendations Badge 
• ATT&CK Cyber Threat Intelligence Certification 

Pre-requisites: 

• Practitioners should have a solid understanding of the ATT&CK Framework 
• An understanding of security concepts, previous training, or prior CTI field experience 
• We highly recommend taking the ATT&CK Cyber Threat Intelligence course to facilitate success 

Training Modules 

ATT&CK subject matter experts, Adam Pennington, Amy Robertson, and Jaclyn Lasky, produced MITRE ATT&CK Defender’s ATT&CK for Cyber Threat Intelligence course. This training may be completed solo or as a team. This training will: 

• Introduce learners to ATT&CK and why it’s useful for CTI
• Show learners how to map to ATT&CK from both finished reporting and raw data 
• Share why it’s challenging to store ATT&CK-mapped data and what to consider when doing so
• Visualize how to perform CTI analysis using ATT&CK-mapped data
• Familiarize learners with making defensive recommendations based on CTI analysis

Module 1: Mapping to ATT&CK from Narrative Reports

Module 2: Mapping to ATT&CK from Raw Data 

Module 3: Storing and Analyzing ATT&CK-Mapped Data 

Module 4: Making Defensive Recommendations from ATT&CK-Mapped Data 

ATT&CK Security Operations Center Assessments Certification and Training Program 

This is an intermediate  level program that educates and endorses mastery in the skill to conduct Security Operations Center (SOC) assessments that are rapid, have low overhead, and are broad enough to help the SOC get on their feet with ATT&CK. The certification affirms your mastery at analyzing SOC technologies, like tools and data sources, savviness at interviewing and discussing ATT&CK with SOC personnel, and recommend improvements based on the assessments’ results. Defenders must earn four distinct badges to achieve the ATT&CK for SOC Assessments certification: 

• ATT&CK Fundamentals 
• ATT&CK Security Operations Center Assessment Fundamentals 
• ATT&CK Security Operations Center Assessment Analysis 
• ATT&CK Security Operations Center Assessment Synthesis 

Pre-requisites: 

• Practitioners should have a solid understanding of the ATT&CK Framework 
• An understanding of information security technology and security operations 
• We highly recommend taking the ATT&CK SOC Assessments course to facilitate success 

Training Modules 

ATT&CK subject matter experts, Andy Applebaum and Dr. Clem Skorupka produced the ATT&CK SOC Assessments course to familiarize learners with how to implement ATT&CK for visibility into where a SOC needs improvements and inform how to apply ATT&CK to design a rapid, low overhead, and broad SOC Assessment. This training will: 

• Provide tips on how to analyze SOC technologies like tools and data sources 
• Share best practices for performing interviews and leading discussions on ATT&CK with SOC personnel 
• Educate on how to recommend changes based on assessment results 

Module 1: Mapping to ATT&CK from Narrative Reports 

Module 2: Mapping to ATT&CK from Raw Data 

Module 3: Storing and Analyzing ATT&CK-Mapped Data 

ATT&CK Adversary Emulation Methodology Certification and Training Program

The program educates and validates a practitioner’s ability to conduct adversary emulation activities based on real-world threats. The defender learns and proves mastery at researching, implementing, and ethically executing adversary TTPs to help organizations assess and improve cybersecurity. Defenders must earn five distinct badges to achieve theAdversary Emulation Methodology certification: 

• ATT&CK Fundamentals 
• ATT&CK Adversary Emulation Fundamentals 
• ATT&CK Adversary Emulation TTP Research 
• ATT&CK Adversary Emulation Planning 
• ATT&CK Adversary Emulation TTP Implementation 
• ATT&CK Adversary Emulation Execution

Pre-requisites: 

• Practitioners should have a solid understanding of the ATT&CK Framework 
• Competent with basic Windows and Linux command-line tools 
• We highly recommend taking the ATT&CK Adversary Emulation Fundamentals course to facilitate success
• (Recommended) Familiarity with common red team tools and techniques (example: Metasploit) 
• (Recommended) An understanding of cyber threat intelligence practices through the ATT&CK Cyber Threat intelligence course 

ATT&CK Threat Hunting and Detection Engineering Certification and Training Program

The program enables defenders to demonstrate foundational knowledge that supports the execution of a six-step TTP-based hunting methodology centered on the use of the ATT&CK Framework. It is designed for practitioners who can apply a solid understanding of the ATT&CK Framework, adversarial behaviors of interest, and possess the ability to articulate hunt-directing hypotheses that inform the development of written analytics that drive information needs and data collection requirements. The credential verifies the ability to apply the TTP-based hunting methodology and supports dedication to securing critical networks and systems against attacks from advanced cyber adversaries. 

Defenders must earn six distinct badges to achieve the Threat Hunting and Detection Engineering Certification:  

• ATT&CK Threat Hunting Fundamentals 
• ATT&CK Threat Hunting Hypotheses 
• ATT&CK Threat Hunting Data Collection Requirements 
• ATT&CK Threat Hunting Addressing Data Collection Gaps 
• ATT&CK Threat Hunting Tuning Analytics 
• ATT&CK Threat Hunting Application 

Purple Teaming Methodology Certification and Training Program 

The program enables defenders to demonstrate foundational knowledge on how to effectively prepare for, execute, and leverage purple teaming. It is designed for practitioners who want to run or strengthen their purple team. The credential verifies the ability to run a collaborative purple team which deviates from a traditional approach, facilitates collaboration between red and blue team to advance the capabilities and defenses of the blue team. While delivering actionable robust defensive recommendations, such as new data collection requirements, mitigations, system reconfigurations, and analytics. Defenders must earn six distinct badges to achieve the Purple Teaming Methodology Certification: 

• ATT&CK Adversary Emulation Fundamentals 
• ATT&CK Threat Hunting Fundamentals 
• ATT&CK Cyber Threat Intelligence (CTI) Defense Recommendations 
• ATT&CK Purple Teaming Fundamentals