I don't get it.
ATT&CK is a model for describing events, inc. events that we care to:
ATT&CK didn't change *what* we detect. It changed how we organize, classify, communicate.
Or I'm wrong: People/things really do "ATT&CK detection"? https://twitter.com/Hexacorn/status/1352329193703563265
2/2/2021, 11:23:23 AM