All of the Threats: Threat Intelligence Modeling Beyond ATT&CK
Tim Wadhwa-Brown demonstrates how to construct threat intelligence models and hypotheses from first principles when standardized ATT&CK data is missing.
Summary
The Strengths and Limitations of MITRE ATT&CK
While MITRE ATT&CK has unified communication between red and blue teams, it relies heavily on documented adversary TTPs and struggles when facing novel threats.
Building Threat Hypotheses from First Principles
Tim Wadhwa-Brown explores constructing predictive threat intelligence models by decomposing target systems, crown jewels, and feasible adversary objectives.
Synthesizing Adversary Motivations with Technical Attack Paths
The speaker illustrates how to map geopolitical threat actor motivations and organizational vulnerabilities into actionable adversary emulation plans.
Operationalizing Threat Models for Collaborative Defense
The presentation provides purple teams with structured methodologies for validating detection coverage against bespoke and hypothetical threat scenarios.
Related talks
Red Team Village·57 min
Adam Pennington
MITRE ATT&CK lead Adam Pennington shares strategies for crafting realistic adversary emulation plans even when threat intelligence reports are incomplete or vague.
Blacks in Cybersecurity Village·37 min
Malachi Walker
Introduces Domain Intelligence Analysis, leveraging proactive DNS artifacts and registration telemetry to detect adversary infrastructure before public IOC disclosures.
Creator Stage·49 min
Security leaders analyze recent high-profile breaches, state-sponsored TTPs, and effective containment strategies for enterprise defenders.