Cybersecurity tools are inconsistent and incomplete in their coverage of the MITRE ATT&CK framework, according to research presented at MITRE ATT&CKcon.
“As Virkud’s abstract noted, “even when attempting to detect the same malicious entity, products completely disagree about the appropriate ATT&CK technique annotations 51% of the time, while fully agreeing just 2.7% of the time.”
That’s worse than I expected, and I had low expectations.
“As Virkud’s abstract noted, “even when attempting to detect the same malicious entity, products completely disagree about the appropriate ATT&CK technique annotations 51% of the time, while fully agreeing just 2.7% of the time.”
That’s worse than I expected, and I had low expectations.
Cool research, though.