MITRE ATT&CK Defender

ATT&CK Cyber Threat Intelligence Certification is an intermediate level program that affirms your ability to identify, develop, analyze, and apply ATT&CK-mapped intelligence. You must earn five distinct badges to achieve the ATT&CK® for CTI Certification.

The ATT&CK SOC Assessments Certification affirms your ability to conduct Security Operations Center (SOC) assessments that are rapid, have low overhead, and are broad enough to help the SOC get on their feet with ATT&CK. The certification affirms your mastery at analyzing SOC technologies, like tools and data sources, savviness at interviewing and discussing ATT&CK with SOC personnel and recommend improvements based on the assessments’ results. You must earn four distinct badges to achieve the ATT&CK® for SOC Certification.

The ATT&CK® Adversary Emulation Methodology Certification validates a practitioner’s ability to conduct adversary emulation activities based on real-world threats. The certification affirms mastery at researching, implementing, and ethically executing adversary TTPs to help organizations assess and improve cybersecurity.

After completing the ATT&CK® Threat Hunting Instructional Training Program you should be able to demonstrate foundational knowledge that supports the execution of a six-step TTP-based hunting methodology centered on use of the ATT&CK® Framework. This program is designed for practitioners who can apply a solid understanding of the ATT&CK® Framework, adversarial behaviors of interest, and possess the ability to articulate hunt-directing hypotheses that inform the development of written analytics that drive information needs and data collection requirements. The ability to apply the TTP-based hunting methodology, as demonstrated by successful completion of this program, supports your dedication to securing critical networks and systems against attacks from advanced cyber adversaries.

This certification verifies that the holder knows the fundamentals of how to leverage purple teaming to emulate adversarial behavior, and deliver actionable, robust defensive recommendations, such as new data collection requirements, mitigations, system reconfigurations, and analytics.