Mitre Att&ck Framework Courses and Certifications

Starweaver

Offensive Cyber Operations for Defenders

Think like an adversary: map attack surfaces, walk the cyber attack life cycle, classify tactics with MITRE ATT&CK, and study phishing, malware, and AI-driven exploits.

• Coursera
• 6 weeks, 1 hour a week
• Self-Paced
• Paid Course

Threat Detection and Security Engineering

Engineer SIEM detections in Microsoft Sentinel with KQL and MITRE ATT&CK, run purple team exercises, automate SOC playbooks, and protect data with Microsoft Purview DLP.

• Coursera
• 12 weeks, 1 hour a week
• Self-Paced
• Paid Course

Starweaver

Advanced Cyber Threat Intelligence Training

Produce defensible threat intelligence: frame intelligence requirements, collect OSINT and malware-derived data, map adversary TTPs with MITRE ATT&CK, and turn assessments into detection and hunting improvements.

• Coursera
• 4 weeks, 2 hours a week
• Self-Paced
• Paid Course

Certified Kubernetes Security Specialist (CKS): Unit 7

Harden running Kubernetes clusters: enforce container immutability, configure audit logging and log storage, detect threats with Falco rules, and investigate incidents via MITRE ATT&CK.

• Coursera
• 4 hours 44 minutes
• Self-Paced
• Paid Course

Packt

SOC Operations for Blue Team Professionals (2026)

Analyze cyber threats and strengthen blue-team defenses using MITRE ATT&CK, Splunk, VirusTotal, PCAP files, log analysis, and static and dynamic malware techniques.

• Coursera
• 9 weeks, 1 hour a week
• Self-Paced
• Paid Course

Starweaver

Modern Cyber Effects Management for Security Leaders

Design and coordinate cyber effects operations: map campaigns to the Cyber Kill Chain and MITRE ATT&CK, assess impact with FAIR-Lite, and report mission-tied KPIs to executives.

• Coursera
• 4 weeks, 2 hours a week
• Self-Paced
• Paid Course

Plan and run adversary emulation engagements: use ATT&CK and threat intelligence to select TTPs, define scope and rules of engagement, then implement, automate, and execute them.

• Cybrary
• 8-9 hours
• Self-Paced
• Paid Course

Map adversary behaviors to ATT&CK from narrative reports and raw data, store and display mapped intelligence, compare layers in ATT&CK Navigator, and make defensive recommendations.

• Cybrary
• 2-3 hours
• Self-Paced
• Paid Course

Hunt threats by TTPs rather than indicators: develop hypotheses around low-variance adversary behaviors, build abstract analytics, determine data requirements, and close collection gaps using ATT&CK.

• Cybrary
• 2-3 hours
• Self-Paced
• Paid Course

Build and run a threat intelligence program: collect internal, OSINT and community data, analyze campaigns with ACH, the Cyber Kill Chain and MITRE ATT&CK, and disseminate reports.

• Cybrary
• 4-5 hours
• Self-Paced
• Paid Course

Detect and mitigate lateral tool transfer: see how FIN10-style adversaries stage files and Meterpreter payloads across a network, then hunt the indicators in a hands-on lab.

• Cybrary
• Self-Paced
• Paid Course

Detect adversary user discovery: learn how attackers enumerate accounts, process and directory ownership, and practice spotting the technique in a hands-on detection lab.

• Cybrary
• Self-Paced
• Paid Course

Learn to detect, validate, and mitigate adversary data exfiltration to cloud storage through a hands-on lab.

• Cybrary
• 1 hour
• Self-Paced
• Paid Course

Turn Windows' built-in Event Forwarding into a free log collection pipeline, then hunt Active Directory lateral movement with MITRE ATT&CK.

• Cybrary
• 1-2 hours
• Self-Paced
• Paid Course

Learn to detect and mitigate adversary command-and-control traffic hidden on non-standard or encrypted ports such as HTTPS 443.

• Cybrary
• 1 hour
• Self-Paced
• Paid Course