The exact report-to-action paper workflow is supplied, including source context, supported mappings, uncertainty, relevance, priorities and proposed validation evidence. It does not claim real intelligence validation or operational detection assurance.
Original editorial teaching and fictional application, informed by the linked primary passages. Compare your reasoning with the model; this is not independently marked learner work, an official examination key or a replacement for the selected course.
What this guide contributes.
Primary route: ISC2 CC. These are selected related scope positions, not a claim that the guide teaches the entire objective/application/statement. Full scope and remaining depth are in the coverage register.
See this guide’s exact scope links and remaining depth
What the source review checked
- Source/context/relevance/confidence
- Behavior-to-current-mapping reasoning
- Priorities and defensive action
- Proposed validation and evidence
- Management communication and historical extension
Assigned public passages and original model guidance were checked. No learner work, paid course or full licensed standard was assessed; the remaining-needs section controls any closure claim.
1. Read with a purpose.
CISA with HSSEDI / MITRE · CISA/HSSEDI best practices for ATT&CK mapping: evidence before technique labels
FREE PUBLIC READINGRead: Selected finished-report method and common mistakes.
Learn: Extract actions and context, justify mapping depth, state evidence gaps and avoid turning an indicator or port into a behaviour claim.
Exact scope and exclusionsPublic PDF returned HTTP 200 (912,219 bytes, 22 pages) through an ordinary direct request; assigned pages were read. The browser reader's 403 was not treated as proof of paywall or permanent access failure.
MITRE ATT&CK · MITRE CTI Module 1: finding behaviours and choosing supported mapping depth
FREE PUBLIC READINGRead: Selected process/context/mapping-depth slides.
Learn: A tactic asks why; a technique/sub-technique describes how. More specific mapping needs more specific evidence.
Exact scope and exclusionsFree public 65-page slide PDF, with selected slides read without registration.
MITRE ATT&CK · Current T1566.002 Spearphishing Link: definition, mitigations and detection
FREE PUBLIC READINGRead: Definition and selected current defensive rows.
Learn: Compare the actual fictional email delivery with a current definition and identify the data needed to validate a defence.
Exact scope and exclusionsFree public technique page read without registration.
MITRE ATT&CK · Current T1059.001 PowerShell: execution, legitimate use and contextual detection
FREE PUBLIC READINGRead: Definition, selected mitigation caveat and current detection row.
Learn: A legitimate interpreter can be abused; parent/child context and business dependencies matter.
Exact scope and exclusionsFree public technique page; selected passages read without an account.
MITRE ATT&CK · Current T1046 Network Service Discovery
FREE PUBLIC READINGRead: Definition and metadata.
Learn: Post-compromise remote-service enumeration supports T1046; its current name differs from older training.
Exact scope and exclusionsFree public page read without an account.
MITRE ATT&CK · MITRE CTI Module 4: prioritising and tailoring defensive recommendations
FREE PUBLIC READINGRead: Selected process, capabilities/constraints and trade-off slides, then the fictional case.
Learn: Prioritise relevant behaviours, use available evidence and propose locally testable defensive actions.
Exact scope and exclusionsFree public 46-page PDF and linked guided RTF worksheet; selected slides and worksheet text were read without an account.
MITRE ATT&CK · MITRE simulated incident ticket 473822 with publisher mapping answers
FREE PUBLIC READINGRead: Optional extension: simulated RTF ticket and complete one-page answer PDF, using the training's v8 context.
Learn: Compare with the genuine historical publisher mapping sheet without rewriting it. For example, its repeated parent T1059 labels can now be compared with T1059.003 Windows Command Shell because the ticket explicitly says cmd.exe; a query of firewall profiles can also be checked against current Security Software Discovery T1518.001 when the defensive-tool purpose is supported. Record the evidence/version and justify depth rather than assuming every old label is a current exclusive answer. The sheet has limited rationales and is not a CC readiness test.
Optional MITRE incident ticket
Publisher mapping answer sheet · historical version
Exact scope and exclusionsRTF returned HTTP 200 (1,120 bytes) and its full text was read. The one-page answer PDF was also opened and read at https://attack.mitre.org/docs/training-cti/ticket-473822%20answers.pdf . No account or payment.
MITRE ATT&CK · MITRE current definitions for comparing the historical ticket
FREE PUBLIC READINGRead: Only the opening current definitions and ID/tactic metadata; compare evidence and version with the optional historical ticket.
Learn: A current comparison needs evidence and justified depth; it does not silently replace an older publisher answer sheet.
Exact scope and exclusionsBoth current public technique definitions were opened and read in the source review; no account or payment.
2. Try the fictional case.
Turn a short fictional report into a justified defensive decision
Original editorial application. Fictional report R1, dated 29 October 2026, comes from a simulated service-provider analyst and says: B1: an email targeted at the studio's booking staff contained a link to download a fake update installer. B2: on a compromised test workstation, the downloaded installer launched a PowerShell script; the synthetic process record explicitly identifies PowerShell and its parent. B3: after that compromise, the actor enumerated services on remote internal hosts by probing multiple service ports. B4: the workstation also made an encrypted connection to a documentation-only example address using TCP 443; the report supplies no application-protocol or purpose evidence for that connection. These are invented premises for analysis, not real observations or a real vendor report. The studio uses Windows workstations; mail, web and endpoint process records are available, but encrypted network payloads are not visible to its network sensor. Administrators legitimately use PowerShell for booking maintenance. The decision-maker asks: which two defensive improvements should we investigate first, using existing data where possible, and what evidence would show whether they work?
Your tasks
- Create a source/context record separating what R1 reports from what the studio has actually observed. State relevance, confidence and a request for missing evidence.
- Write a mapping table for B1–B4: behaviour, purpose/tactic where supported, technique/sub-technique ID, rationale and excluded inference. Read the current definitions before selecting the IDs.
- Choose two prioritised defensive actions with owners, business trade-offs and data sources. Include a detection/response or prevention limitation rather than claiming guaranteed coverage.
- Design a paper validation table with a suspicious chain, a benign administrative event and missing telemetry. Do not execute code, scan a network or contact a listed address.
- Prepare a short management recommendation that states the decision, evidence and remaining uncertainty.
3. Compare your reasoning.
Decide and write your explanation first. Where a table is wider than your screen, focus it and use the arrow keys, or scroll it sideways.
Open explained model guidance
Source/context record: R1 is a fictional external analyst report whose stated observations are the exercise input; the studio has not independently corroborated a real compromise. Its described Windows/mail workflow is relevant to the studio's stated environment, so it is useful for a defensive hypothesis. Confidence is conditional on those supplied premises, not a numerical reliability score. Request original mail/web/process timestamps and record identifiers, the service-enumeration evidence and context for the encrypted connection. Record what is unreported; missing information is not evidence an action never happened. No actor name, country or motivation is established by the behaviours.
Mapping decision table (current MITRE pages checked 29 October 2026):
| Reported behaviour | Supported mapping and purpose | Justification / unsupported alternative |
|---|---|---|
| B1 targeted email link delivers a fake installer | Initial Access; Phishing: Spearphishing Link, T1566.002 | The report explicitly describes targeted mail with a delivery link. Do not call it Spearphishing Attachment: it says link, not attached installer. Delivery alone does not prove the user executed it. |
| B2 installer launches an explicitly identified PowerShell script on the compromised test workstation | Execution; Command and Scripting Interpreter: PowerShell, T1059.001 | The interpreter and execution are given, so the sub-technique is supported. 'PowerShell exists on the computer' would be insufficient. The case does not infer that every PowerShell event is hostile or that credentials were dumped. |
| B3 actor enumerates remote internal services after compromise | Discovery; Network Service Discovery, T1046 | The stated objective/action is service enumeration on remote internal hosts. The current page uses Network Service Discovery; the training's older Network Service Scanning title is historical. Do not substitute pre-compromise Active Scanning solely because both involve probes. |
| B4 an encrypted TCP 443 connection, with no protocol/purpose evidence | Leave unmapped pending context | Port 443 does not prove HTTP/S, command and control or exfiltration. Request endpoint/process and protocol evidence; do not assign Web Protocols or claim stolen data simply from reachability. |
The technique labels are justified classifications of the fictional actions. They are not attribution, a complete attack timeline or proof that corresponding controls work.
Prioritised defensive action record:
| Priority / owner | Proposed action and relevance | Trade-off and validation evidence |
|---|---|---|
| 1 / monitoring lead with mail/endpoint owners | Correlate targeted link mail and web events with the suspicious installer/PowerShell process chain, using the existing records. Preserve the linked IDs/times and route an investigated alert to the response role. This joins B1 and B2 instead of treating one URL or interpreter name as proof. | Confirm that mail, browser/download and process-parent fields are actually present and time-aligned. Legitimate maintenance must be distinguishable; a missing source means a visibility gap. Current MITRE detection rows are candidates, not a tested analytic for this studio. |
| 2 / endpoint/service owner | Investigate a tested application-control restriction for unapproved downloaded installers/scripts on booking workstations; retain explicitly approved administrative maintenance. Check necessity, dependencies and a recovery/exception route before enforcement. | Blocking every PowerShell use could interrupt booking maintenance. Evaluate the specific allowed/denied workflow in an authorized lab before any real rollout. The source supports considering execution prevention; this exercise does not assert a product, policy setting or configuration will prevent all PowerShell abuse. |
Also retain B3 for a service-enumeration detection/segmentation review using relevant network/host records; the two-priority request is an initial focus, not a reason to discard supported discovery evidence. Never treat opaque TCP 443 as inspected malicious content.
Paper validation/evidence record:
| Synthetic case | Expected decision | Evidence/limit |
|---|---|---|
| V1 mail-link event, matching web download and unapproved installer → PowerShell process chain on a booking workstation | The proposed correlation should identify the related chain and present its context to the response role; the proposed restriction should reject the unapproved workflow under the stated policy | On paper, check linked user/device/time/event IDs and parent-child records; in a future separately authorized lab, collect actual rule, block/allow and response records. A paper expectation is not an observed alert or block. |
| V2 approved administrator maintenance from the approved management context | Preserve useful logging and permit the approved work; avoid declaring the event malicious solely because PowerShell ran | Compare role, approved change/window, parent chain and expected activity. Investigate mismatches rather than globally suppressing all admin events. |
| V3 mail/web records present but process-parent telemetry missing | Report incomplete visibility and a collection/retention action; do not claim the chain was absent or prevented | Determine whether a missing field, collection failure, retention loss or actual absence explains the gap. |
| V4 only the B4 encrypted TCP 443 connection is supplied | Keep protocol/purpose unresolved | No application-layer mapping or exfiltration claim without supporting evidence. |
A future validation must measure relevant false positives, missed cases, operational effects and response follow-through; finding a technique in a catalogue is not such validation.
Management note: Start by checking whether our existing mail/web/process records can expose the reported delivery-to-execution chain, and assess a narrowly scoped restriction on unapproved downloaded code with the service owner. These actions fit the fictional Windows booking workflow and its available data, while preserving approved maintenance. The report supports three behaviour mappings, but we have no verified real incident, attribution, complete protocol evidence for the port-443 connection or tested control effectiveness. Approve investigation and a separately authorized safe validation plan before operational claims or changes.
Original editorial report, workflow, model and self-checks based on cited primary concepts. It is not a publisher-issued exam key, independent learner assessment, actual CTI attribution, tested detection, lab result or permission to run the described behaviours.
4. Check the work, not just the score.
- Each mapping cites a concrete reported action and current definition, not just a malware name, port, nationality or general suspicion.
- You can explain why B1 is a link rather than attachment, why B2 supports the PowerShell sub-technique, and why B3 has post-compromise discovery context.
- You leave B4 unresolved and ask for the evidence needed to narrow it rather than rewarding a more detailed unsupported mapping.
- The defensive choices answer the stated business question, account for available sensors and legitimate administration, and have owners and validation evidence.
- Suspicious, benign and missing-evidence cases have distinct expected outcomes; neither a proposed analytic nor an ATT&CK mapping is reported as a proven detection or prevention result.
These checks help you revise an explanation. They do not certify mastery or predict an examination result. Ask a qualified reviewer to assess a fresh case when independent feedback is needed.
5. Keep the limits in view.
Free coverage added
- Complete beginner workflow with a fictional source/context record, observed actions, justified current ATT&CK mappings, unsupported alternatives and explicit uncertainty.
- Prioritised defensive decision table that accounts for existing mail/process evidence, legitimate administration and encrypted-traffic visibility limits.
- Safe paper validation with suspicious, benign and missing-evidence cases, plus optional original MITRE practice whose real publisher answer and version limits were checked.
Still missing or outside this guide
- The fictional report is not independently corroborated real threat intelligence; current real intelligence needs source reliability, environment relevance and additional evidence assessed in its own context.
- No live adversary emulation, production alert tuning or validation of a specific product was performed.
- The historical MITRE exercises use earlier ATT&CK versions and do not supply current CC mixed practice, full answer rationales or independent readiness assessment.
Payment and access
FREE primary mapping lessons, technique pages, optional publisher ticket/key and the explained editorial case. No paid intelligence feed, software, commercial bank or course is required for this bounded objective. Independent assessment and advanced operational training remain separate optional choices.
Open this area in the gap register