🚧 Under construction — VoTechWorks is being built. A free tech program — complimentary, as our commitment to get America working.
voTechWorksGrade 13 · a vocational technology learning center, by urbanicity
newSchoolWorks.com › VoTechWorks › Technology & Design › Cybersecurity › Cybersecurity Threats: Attack Types, Threat Actors, and Vulnerability Analysis › Lesson 12
TEC-CYBE44-02 · Lesson 12 · 15 clock hours · practice

Threat Scenario Capstone: Attack Analysis and Defensive Briefing

Objective. Students will independently analyze a multi-stage attack scenario, produce a complete threat analysis report mapped to the ATT&CK framework, and deliver a five-minute defensive briefing to the class.

⚠ Pending professional review

This lesson, its worked examples and its practice questions has not yet been verified by an industry-certified professional or by a certification or approval body. It is a study draft and may contain errors. Do not use it as instructions for work on a job site or on live equipment. Always follow your instructor, your supervising professional, and current official references and regulations.

VoTechWorks program approval and accreditation are still in progress. Credentials are issued only by the certifying bodies named in each program, after their own exams.

Threat Scenario Capstone: Attack Analysis and Defensive Briefing

This capstone lesson asks you to do what real security analysts do every day: receive raw evidence from an incident, reconstruct what happened, and explain it clearly to others so that defenses improve. You will work independently through a fictional but realistic incident package and produce both a written report and an oral briefing.

What a Threat Analysis Report Contains

A professional threat analysis report answers five questions.

1. Who attacked? Identify the threat actor category — nation-state, cybercriminal group, hacktivist, insider, or script kiddie. Use observable behaviors and tooling to support your classification; you rarely know the actor's true identity.

2. How did they attack? Map every technique you can identify to the MITRE ATT&CK framework. Each technique has a unique ID in the format T####, and sub-techniques are written T####.###. Record the tactic category (e.g., Initial Access, Execution, Lateral Movement) alongside the ID.

3. What evidence do they leave? List indicators of compromise (IOCs): suspicious IP addresses, domain names, file hashes, registry keys, user-agent strings, and unusual process names found in the logs or captures.

4. What was affected? Identify every asset — workstation, server, user account, data store — that was touched, accessed, or modified.

5. What should change? Provide specific, prioritized countermeasures. Tie each recommendation to the vulnerability or technique it addresses.

Using the ATT&CK Framework Precisely

MITRE ATT&CK is a publicly available knowledge base of adversary tactics, techniques, and procedures (TTPs). The Enterprise matrix organizes 14 tactics from Reconnaissance through Impact. When you analyze logs, ask which tactic phase fits each observed behavior, then look up the matching technique.

ATT&CK Navigator is a free browser tool that lets you highlight techniques on the matrix, color-code them by confidence level, and export the annotated matrix. Include your Navigator export or a screenshot in your report so the reader can see your mapping at a glance.

Common mistakes to avoid: do not list only tactic names without technique IDs; do not map a behavior to a technique unless the evidence actually supports it; and do not skip sub-techniques when they apply, because specificity improves remediation choices.

Scoring Vulnerabilities with CVSS

The Common Vulnerability Scoring System (CVSS) gives each vulnerability a numeric score from 0.0 to 10.0. The Base Score captures properties that do not change over time — attack vector, attack complexity, privileges required, user interaction, scope, and impact on confidentiality, integrity, and availability. The free CVSS calculator at first.org lets you select each metric and generates the score automatically.

In your report, note the CVSS Base Score for each exploited vulnerability, explain which metrics drove the score, and use that score to justify your remediation priority. A Critical score (9.0–10.0) should generally be remediated before a High (7.0–8.9), which comes before Medium (4.0–6.9).

Structuring the Five-Minute Briefing

Your five slides map directly to the five content areas your audience needs.

Speak to your audience, not to your slides. Prepare for questions by anticipating what a skeptical manager or peer analyst might ask: Why that threat actor category? What other techniques could explain the same evidence? What would you do first if you had only 48 hours?

Responding to Questions Professionally

When a peer or instructor asks a question you cannot fully answer, say what you do know and acknowledge the limit: "Based on the evidence in the package, I assessed X because of Y. I did not find enough data to confirm Z, so that would be my next investigative step." This approach demonstrates analytical integrity, which employers value more than false confidence.

Accuracy, Integrity, and Professional Responsibility

Everything in your report must be traceable to evidence in the incident package or to a named, verifiable source such as the ATT&CK knowledge base or the CVSS specification. Do not invent IOCs or inflate severity to make the report look more dramatic. In real incidents, an inaccurate report can direct response teams to the wrong systems, waste resources, and leave the actual threat active. Professional accuracy is an ethical obligation in this field.

Portfolio Value

Your completed report and slides become a portfolio artifact. CompTIA Security+ and CySA+ employers expect candidates to demonstrate threat analysis skills. Keeping polished work samples — with any real-world or sensitive data removed — gives you concrete evidence to discuss in interviews.

Key terms10

MITRE ATT&CKA publicly maintained knowledge base of adversary tactics, techniques, and procedures organized into a matrix, used to describe and categorize attack behaviors observed in real incidents.
Indicator of Compromise (IOC)A piece of forensic evidence — such as a suspicious IP address, domain name, file hash, or registry key — that suggests a system may have been accessed or compromised by a threat actor.
CVSS Base ScoreA numeric score from 0.0 to 10.0 produced by the Common Vulnerability Scoring System that reflects the inherent severity of a vulnerability based on fixed technical characteristics such as attack vector and impact.
Cyber Kill ChainA model developed by Lockheed Martin that describes seven stages of a cyberattack — Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives — used to understand how far an attacker has progressed.
Tactic (ATT&CK)The adversary's tactical goal during an attack phase, such as Initial Access or Lateral Movement; tactics provide context for why a technique is used.
Technique (ATT&CK)A specific method an adversary uses to achieve a tactic goal, identified by a unique ID in the format T####; sub-techniques add further specificity and are written T####.###.
Threat Actor CategoryA classification of who is behind an attack based on observable behaviors and motivations — common categories include nation-state, cybercriminal, hacktivist, insider threat, and script kiddie.
ATT&CK NavigatorA free, browser-based tool provided by MITRE that allows analysts to annotate, color-code, and export the ATT&CK matrix to visualize which techniques are present in an incident or campaign.
RemediationSpecific, actionable steps taken to fix a vulnerability or eliminate a threat actor's foothold, reducing the likelihood or impact of future incidents.
TTP (Tactics, Techniques, and Procedures)The behaviors, methods, and operational patterns that characterize how a specific threat actor or category of actor conducts attacks; used in attribution and defense planning.
In class: Students receive a comprehensive fictional incident package (instructor-authored: email logs, network captures, vulnerability scan output, and an event log excerpt) and independently produce a written threat analysis report identifying threat actor category, attack techniques with ATT&CK IDs, IOCs, affected assets, and recommended countermeasures. · Students prepare a five-slide briefing presentation summarizing: threat actor profile, Kill Chain stage reached, top three ATT&CK techniques used, CVSS-scored vulnerabilities exploited, and three prioritized remediation recommendations. · Each student delivers their five-minute briefing to the class and instructor, responds to at least two peer or instructor questions, and submits their written report and slides as a complete portfolio artifact.
Materials: Instructor-authored incident package (printed), ATT&CK Navigator (web), MITRE ATT&CK website, CVSS calculator (first.org), slide deck software (LibreOffice Impress or Google Slides), threat analysis report template, CompTIA Security+ SY0-701 and CySA+ study guides
Check: Graded on written report rubric (ATT&CK mapping accuracy, IOC identification, remediation quality) and presentation rubric (clarity, accuracy, response to questions); pass requires 80% on both rubrics independently. Missing ATT&CK IDs or absent remediation section results in automatic revision required before credit.

Practice check8

Answer each question, then check it. Nothing is recorded; this is your own practice.

CompTIA Security+ SY0-701: Threats, Attacks and Vulnerabilities
1. A student's incident package shows that an attacker sent a phishing email with a malicious macro-enabled document. Which ATT&CK tactic best describes the moment the email was sent to the target?
CompTIA CySA+ CS0-003: Threat and Vulnerability Management
2. While mapping an incident, a student identifies that the attacker used a scheduled task to maintain access after a reboot. Which ATT&CK tactic does this behavior belong to?
CompTIA CySA+ CS0-003: Threat and Vulnerability Management
3. A vulnerability found during analysis has a CVSS Base Score of 9.4. According to CVSS qualitative ratings, how should this be classified?
ISC2 CC: Security Concepts
4. In a defensive briefing, a student states 'the attacker reached the Actions on Objectives stage.' According to the Lockheed Martin Cyber Kill Chain, what does this mean?
CompTIA CySA+ CS0-003: Threat Intelligence
5. Which of the following is the correct format for an ATT&CK sub-technique ID?
CompTIA Security+ SY0-701: Threats, Attacks and Vulnerabilities
6. A student's report lists the following as IOCs from a network capture: an unfamiliar external IP address, a suspicious domain contacted every 60 seconds, and a large outbound data transfer at 2 a.m. Which item is LEAST likely to be treated as a reliable IOC on its own?
ISC2 CC: Security Concepts
7. A student cannot fully answer an instructor's question about whether the attacker used living-off-the-land techniques. Which response best demonstrates professional analytical integrity?
CompTIA CySA+ CS0-003: Incident Response
8. An incident report shows that an attacker exploited a known CVE with a CVSS Base Score of 5.5 and also used credential dumping (T1003) to harvest passwords. When prioritizing remediation, what is the best approach?
Record this lesson on my transcript. Sign in with your key and enrollment email to record lessons (enroll free if you have no key). This page stays open to read and practise.
← Previous lessonProgram plan