Keith

@kwm

I don't get it.

ATT&CK is a model for describing events, inc. events that we care to:

- see/log
- detect
- block
- whatever

ATT&CK didn't change *what* we detect. It changed how we organize, classify, communicate.

Or I'm wrong: People/things really do "ATT&CK detection"? https://t.co/C46LDCbaJD

2/2/2021, 10:23:23 AM

Favs: 45

Retweets: 4