Workshop: Threat Hunting using MITRE ATT&CK (TM) TTPs to Identify Adversarial Behaviors

In this workshop, participants learn how to use Fortinet analytics products to hunt for threats using TTPs.

Participants will assume the role of a security analyst and be asked to identify any undetected threats on AcmeCorp's network. To do this they will make use of MITRE ATT&CK™, which is a knowledge base of adversary behavior based on real-world observations.

The challenge is set up with several exercises set around the technical goals the adversary is trying to achieve (ATT&CK™ Tactics), for example, Initial Access, Persistence, Privilege Escalation, Command and Control. Participants will be asked to detect any techniques being used by an adversary to achieve these goals.

In this Fast Track, attendees will gain hands-on experience developing and understanding the analytics needed to discover the techniques used by adversaries during a cyber security breach.

Participants who attend this workshop will learn how to:

• What is the MITRE ATT&CK framework and how it can be used
• What are the TTPs that threat Actor’s use to carry out a breach
• Use FortiEDR Threat Hunting capabilities to uncover threats on the network
• Use FortiSIEM analytics to discovery attacker behavior based on attack techniques
• Use FortiDecepter to find attacker activity and shorten attacker dwell time

Please Note: This Workshop is Intended for Public Sector Customers Only

Reminder: Please bring a laptop to participate in this Fast Track Workshop

Lab Requirements

• Access to a laptop computer
• A Training Institute log in