Teach MITRE ATT&CK with hands-on labs, not slides
A student can recite that T1547 is persistence and still not spot a malicious Run key in front of them. ATT&CK taught from the matrix is a vocabulary quiz. Taught from evidence, it's a lens.
The ATT&CK matrix is a wonderful reference and a terrible lecture. Walk a class through fourteen tactics and a few hundred techniques on slides, and what sticks is the shape of the grid, not the behavior behind each cell. Students learn to match a name to a definition. They don't learn to look at a process tree and say "that's credential dumping", which is the whole point.
The fix is to make a technique something you find, not something you memorize. Every incident response case in Red Herrings is mapped to the ATT&CK tactics and techniques it contains, so a student works real evidence and then names what they're seeing in ATT&CK's terms. The reference becomes the output of the investigation, not the input.
A technique is a thing in the evidence
When a student finds a scheduled task that re-launches a payload at logon, the lab doesn't ask them to recall a cell on a chart. It asks them to recognize persistence, identify the specific technique, and point to the artifact that proves it. The abstraction and the evidence are welded together from the first time they meet it:
- Initial access and execution: the phishing attachment, the spawned shell, the suspicious command line in the EDR feed.
- Persistence and privilege escalation: the Run key, the service install, the scheduled task, seen in the registry and event logs.
- Defense evasion, credential access, discovery: cleared logs, dumped credentials, the recon commands that precede lateral movement.
- Lateral movement, collection, exfiltration, impact: the remote logons, the staged archive, the bulk transfer, the encryption.
ATT&CK should be the answer a student gives after reading the evidence, not the thing they memorize instead of reading it.
Exploit versus detect, made concrete
ATT&CK describes adversary behavior; the responder's job is to detect it. Because the cases hand a student the defender's own tooling (an EDR detection feed and a SIEM alert export) the framing is always exploit-versus-detect. For each technique in play, a student answers the question that matters on the job: what did the adversary do, and what in my telemetry reveals it? That turns ATT&CK from a catalog of attacker tricks into a map of what to hunt for.
Coverage you can see and plan around
Because every case carries its technique mappings, you can build a curriculum that spans the matrix on purpose rather than by accident. Filter the library by tactic, see which techniques a case exercises, and assemble a sequence that walks a cohort across the kill chain, from initial access early in the term to a capstone that touches a dozen techniques at once. The IR cases are tagged with the NIST 800-61 phases too, so a student always knows which phase of the response their next action belongs to. Our ATT&CK coverage page lays out which tactics and techniques the library reaches.
Different for every student, verified before it ships
Each case is individually seeded, so every student investigates their own incident (their own hostnames, accounts, IPs and timestamps) and reaches the same techniques by their own evidence. A copied answer is the wrong answer, but the ATT&CK mapping is the same lesson for everyone. And every generated variant is independently re-solved and verified before release, so the technique on the key is genuinely present in that student's feed.
The First Look cases are free, and a 30-day trial adds a set of sample cases. It runs on your machine, and you can generate an ATT&CK-tagged incident for every student.
