NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a lab♥ Codelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us
[>_] ROOM · Cybersecurity
MITRE ATT&CK and Adversary Behavior Analysis
Read the ATT&CK knowledge base correctly, map real observations to tactics and techniques with evidence, and avoid the mapping mistakes that make intelligence unreliable.
Room tasks
1How the ATT&CK Knowledge Base Is Structured
2Mapping Observations to Techniques with Evidence
3Common Mapping Mistakes and How to Catch Them
4From Mappings to Analysis: Navigator Layers, Comparison and the Kill Chain
5Lab: Map a Port Operator Intrusion to ATT&CK
MITRE ATT&CK and Adversary Behavior Analysis | Codelivly
Frequently Asked Questions
What is MITRE ATT&CK?
MITRE ATT&CK is a knowledge base of adversary tactics and techniques based on real-world observations. Defenders use it as a common language for describing behavior, planning detections and assessing coverage.
What is the difference between tactics and techniques?
Tactics are the adversary's goals, such as persistence or credential access. Techniques are the specific methods used to reach those goals, such as scheduled tasks or credential dumping.
How should I map observations to ATT&CK?
Describe what actually happened, find the matching technique and cite the evidence rather than guessing. The Codelivly room is free and hands-on, helping you avoid common mapping mistakes.