MITRE ATT&CK Threat Detection Engineering Training Course

Course overview

Security operations teams often collect more telemetry than they can investigate, yet still lack reliable detections for the techniques most likely to affect their organisation. Analysts may work from isolated alerts, threat reports or vendor rules without a defensible method for deciding which ATT&CK techniques matter, what evidence should exist, how to write detection logic, and how to validate that it works. This course gives practitioners a repeatable detection-engineering process that connects threat behaviour, data sources, analytic rules, testing and operational handover.

Participants use MITRE ATT&CK as a structured detection design method rather than a static reference library. They map adversary behaviours to ATT&CK tactics and techniques, identify required telemetry and data-quality gaps, develop hypotheses, and create detections in Sigma and SIEM query formats. The course covers ATT&CK Navigator heat maps, data-source mapping, Windows and cloud telemetry, Splunk Enterprise Security and Microsoft Sentinel queries, false-positive reduction, detection coverage measurement, and validation with controlled attack simulations.

Instructor-led demonstrations are followed by guided labs using realistic endpoint, identity and cloud investigation data. Teams work through a threat scenario, prioritise techniques, build and tune analytics, document assumptions and test results, then present their decisions in an engineering review. Each participant leaves with a practical ATT&CK-aligned detection engineering pack: a prioritised technique matrix, telemetry assessment, detection specifications, sample rules and queries, test cases, tuning notes, and a 90-day improvement plan for their own SOC or security programme.

The course suits practitioners moving from alert monitoring into detection development, as well as security leaders who need an evidence-based way to invest in logging, SIEM content and detection coverage.

Course objectives

By the end of this course, participants will be able to:

• Map adversary behaviours to MITRE ATT&CK tactics, techniques and sub-techniques using a defined threat scenario
• Prioritise ATT&CK techniques with a risk-based detection backlog and ATT&CK Navigator coverage matrix
• Assess endpoint, identity, network and cloud telemetry against ATT&CK data components and detection requirements
• Write detection hypotheses that specify attacker behaviour, observable evidence, analytic logic and expected limitations
• Build portable Sigma rules and translate their logic into Splunk SPL and Microsoft Sentinel KQL queries
• Tune detection analytics by analysing benign patterns, defining suppressions and documenting false-positive decisions
• Validate detections with ATT&CK-aligned test cases and record detection, visibility and response results
• Produce an operational detection specification containing ownership, severity, triage guidance, test evidence and review dates

Benefits of attending

Target competencies

Who should attend

• SOC Analysts — who need to progress from alert triage to creating and improving detections
• Detection Engineers — who require an ATT&CK-based method for designing, testing and maintaining analytic content
• Threat Hunters — who need to turn hunt findings and adversary tradecraft into durable detection rules
• Incident Responders — who need to identify telemetry gaps and create detections from lessons learned during investigations
• Security Engineers — who configure SIEM, EDR and logging platforms and must make collection decisions defensible
• SOC Managers — who need measurable detection coverage and a prioritised roadmap for content investment

Requirements and prerequisites

Participants should understand basic security operations concepts, including events, alerts, indicators, logs and incident triage. Familiarity with Windows authentication events, common attacker behaviours such as credential access and lateral movement, and the purpose of a SIEM will be helpful. The labs use introductory Splunk SPL, Microsoft Sentinel KQL and Sigma examples; participants do not need to be proficient query authors, but should be comfortable reading simple filters and fields. Prior ATT&CK experience is not required. This is not a penetration-testing course, and no malware development, exploit development or advanced programming knowledge is assumed.

Training methodology

The five days combine short instructor-led design sessions with progressively harder labs in ATT&CK Navigator, Sigma, Splunk Enterprise Security and Microsoft Sentinel. Participants analyse a common adversary scenario, inspect available telemetry, write hypotheses and build analytics against supplied event data. Facilitated peer reviews challenge technique selection, evidence thresholds and false-positive controls. Daily exercises add artefacts to an individual detection engineering pack. The final workshop uses a simulated ATT&CK technique to validate rules, capture evidence and produce a prioritised implementation plan for the participant’s own environment.

Course outline

Day 1: ATT&CK as a detection engineering framework

• MITRE ATT&CK structure: tactics, techniques, sub-techniques, procedures and groups
• Distinguishing ATT&CK technique mapping from alert classification and incident tagging
• Detection engineering lifecycle from threat hypothesis to operational review
• ATT&CK Navigator layers, scoring, annotations and coverage visualisation
• Threat-informed prioritisation using business assets, adversary relevance and likely attack paths
• Detection versus prevention controls and the role of compensating visibility
• Writing a detection hypothesis with behaviour, evidence, analytic and limitation statements

Workshop: Build an ATT&CK Navigator layer for a ransomware intrusion scenario and produce a ranked shortlist of techniques for detection development.

Day 2: Telemetry and data-source engineering

• ATT&CK data sources, data components and detection-relevant observables
• Windows Security Event Logs, Sysmon events and endpoint telemetry selection
• Identity telemetry from Active Directory, Entra ID and authentication services
• Cloud audit evidence from Microsoft 365 and Azure activity logs
• Network, DNS, proxy and firewall telemetry for command-and-control detection
• Log normalisation, timestamps, host identifiers and entity correlation fields
• Telemetry quality assessment for completeness, fidelity, retention and queryability

Workshop: Assess a supplied logging architecture against five prioritised ATT&CK techniques and produce a telemetry gap register with remediation actions.

Day 3: Building detection analytics

• Translating ATT&CK behaviours into observable detection logic
• Sigma rule structure: logsource, detection selections, conditions, fields and metadata
• Splunk SPL searches for process, authentication and network behaviour analytics
• Microsoft Sentinel KQL queries using SecurityEvent, DeviceProcessEvents and sign-in data
• Correlation logic, time windows, thresholds and entity joins
• Detection severity, confidence, MITRE tags and triage context
• Rule documentation using a detection specification template

Workshop: Author a Sigma rule and equivalent SPL and KQL analytics for suspicious PowerShell execution, then complete the associated detection specification.

Day 4: Tuning, testing and operationalising detections

• False-positive analysis using baselines, allowlists and environmental context
• Suppressions, exclusions and exception governance without masking adversary behaviour
• Detection test cases and expected evidence for ATT&CK techniques
• Atomic Red Team concepts and controlled adversary emulation
• Measuring true positives, false positives, visibility failures and analytic failures
• Triage runbooks, enrichment requirements and escalation criteria
• Detection-as-code versioning, peer review and scheduled content review

Workshop: Run a controlled technique test against sample telemetry, record the detection result, tune the analytic and produce a triage runbook entry.

Day 5: Coverage measurement and detection roadmap

• Technique-level coverage models: detected, partially detected, visible and not visible
• Using ATT&CK Navigator to communicate coverage and investment priorities
• Detection backlog scoring by threat relevance, exposure, telemetry readiness and effort
• Mapping incident lessons learned and threat intelligence to new detection requirements
• SOC metrics for analytic quality, testing cadence and detection maintenance
• Detection ownership, approval workflows and service-level review dates
• Ninety-day roadmap planning for telemetry, content, testing and capability development

Workshop: Present a completed ATT&CK-aligned detection engineering pack and produce a 90-day roadmap for improving coverage in a selected business environment.

Tools & standards covered

MITRE ATT&CK Navigator, Sigma, Splunk Enterprise Security, Microsoft Sentinel

A typical training day

Live online deliveries follow the same structure in the East Africa Time zone, with shorter screen blocks and longer breaks.

What the fee includes

How you can take this course

Certification

Participants who complete the full five days receive the Skillset Development Certificate of Completion, stating the course title, course code, dates and delivery format — suitable for professional-development records and employer reimbursement.

Frequently asked questions