Making Defensive Recommendations Unguided Exercise

Techniques identified from the previous exercise:
•	Phishing: Spearphishing Attachment
•	Phishing: Spearphishing Link
•	Scheduled Task/Job: Scheduled Task
•	Command and Scripting Interpreter
•	User Execution
•	Boot or Logon Autostart Execution: Registry Run Keys/Startup Folder
•	OS Credential Dumping
•	Network Service Scanning
•	System Network Configuration Discovery
•	Proxy

Useful links:

ATT&CK:
–https://attack.mitre.org
Cyber Analytics Repository: 
–https://car.mitre.org/
Threat Hunter Playbook
–https://github.com/Cyb3rWard0g/ThreatHunter-Playbook
Windows ATT&CK Logging Cheatsheet
–https://www.malwarearchaeology.com/cheat-sheets

0. Pick a technique to focus on from the above list

1. What defensive options can you identify for dealing with the chosen technique?

2. Using either your own organization or a notional one, what are your 
organizations capabilities and constraints that may impact the identified 
defensive options?

3. Given your organization’s capabilities and constraints, what are the 
tradeoffs for each of the defensive options?

4. What are your final recommendations? Are they technical, policy, or 
risk acceptance?

©2019 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public 
release. Distribution unlimited 18-1528-44.