Keith

@kwm

I don't get it.

ATT&CK is a model for describing events, inc. events that we care to:

- see/log
- detect
- block
- whatever

ATT&CK didn't change *what* we detect. It changed how we organize, classify, communicate.

Or I'm wrong: People/things really do "ATT&CK detection"? https://twitter.com/Hexacorn/status/1352329193703563265

2/2/2021, 11:23:23 AM

Favs: 50

Retweets: 5