--- title: "#mitre-attack articles | Hashnode" description: "Explore 50 articles tagged #mitre-attack on Hashnode. Tutorials, guides, and how-tos from the community." url: "https://hashnode.com/tag/mitre-attack" --- Tag # #mitre-attack 50 posts · 0 followers [Jebitok](https://hashnode.com/@w1t3r) · [13h ago](https://hashnode.com/posts/quiet-as-the-grave-a-threat-hunt-case-study-tryhackme-soc/6af4b70cfe42279bc52ba7a2) ### [Quiet as the Grave: A Threat Hunt Case Study (TryHackMe SOC)](https://www.sharonjebitok.com/quiet-as-the-grave-a-threat-hunt-case-study-tryhackme-soc?utm_source=hashnode&utm_medium=feed) What this is Quiet as the Grave is a TryHackMe threat-hunting scenario, again set at TryHatMe Studios. Unlike an alert-driven SOC queue, a hunt starts from a hypothesis, not an alert: threat intellige 6 min read · [sharonjebitok.com](https://www.sharonjebitok.com/quiet-as-the-grave-a-threat-hunt-case-study-tryhackme-soc?utm_source=hashnode&utm_medium=feed) [Tirthak Likhar](https://hashnode.com/@tirthak10) · [Sep 11](https://hashnode.com/posts/climbing-the-pyramid-of-pain-from-hashes-to-ttp-based-detection/6aa4219dfef57149febae21c) ### [Climbing the Pyramid of Pain: From Hashes to TTP-Based Detection](https://tirthaklikhar.hashnode.dev/climbing-the-pyramid-of-pain-from-hashes-to-ttp-based-detection?utm_source=hashnode&utm_medium=feed) What TryHackMe Summit teaches beginner SOC analysts about building detections attackers cannot easily evade 22 min read · [tirthaklikhar.hashnode.dev](https://tirthaklikhar.hashnode.dev/climbing-the-pyramid-of-pain-from-hashes-to-ttp-based-detection?utm_source=hashnode&utm_medium=feed) [Kajal Dhanjal](https://hashnode.com/@kajalbuilds) · [Sep 9](https://hashnode.com/posts/mitre-attack-v18-v19-detection-strategies/6aa117b3ae200d6994aa1ad5) ### [The MITRE ATT&CK most people are learning was retired in October 2025.](https://kajalbuilds.hashnode.dev/mitre-attack-v18-v19-detection-strategies?utm_source=hashnode&utm_medium=feed) MITRE retired the Detections field and Data Sources in v18, and split Defense Evasion in v19. What replaced them, and how to read ATT&CK now. 6 min read · [kajalbuilds.hashnode.dev](https://kajalbuilds.hashnode.dev/mitre-attack-v18-v19-detection-strategies?utm_source=hashnode&utm_medium=feed) [Jebitok](https://hashnode.com/@w1t3r) · [Sep 9](https://hashnode.com/posts/cti-for-alert-triage-tryhackme/6aa1595aff545c973df10795) ### [CTI for Alert Triage (TryHackMe)](https://www.sharonjebitok.com/cti-for-alert-triage-tryhackme?utm_source=hashnode&utm_medium=feed) Link to the challenge on TryHackMe: CTI for Alert Triage Introduction CTI for Alert Triage shifts gears from SIEM pivoting to something a lot of security writeups skip past: how a single high-severity 6 min read · [sharonjebitok.com](https://www.sharonjebitok.com/cti-for-alert-triage-tryhackme?utm_source=hashnode&utm_medium=feed) [odufuwababajide77](https://hashnode.com/@mrkay) · [Aug 11](https://hashnode.com/posts/diving-into-the-unified-kill-chain-understanding-the-in-phase-initial-foothold/6a7b596bc4f6e65f38d5ad57) ### [Diving into the Unified Kill Chain: Understanding the "In" Phase (Initial Foothold)](https://kay-security-labs.hashnode.dev/diving-into-the-unified-kill-chain-understanding-the-in-phase-initial-foothold?utm_source=hashnode&utm_medium=feed) When mapping cyberattacks, understanding how an adversary moves from target selection to establishing a foothold inside your network is critical. In Task 5 of TryHackMe Unified Kill Chain (UKC) room, 3 min read · [kay-security-labs.hashnode.dev](https://kay-security-labs.hashnode.dev/diving-into-the-unified-kill-chain-understanding-the-in-phase-initial-foothold?utm_source=hashnode&utm_medium=feed) [Durga Madhav Chandra Vemulapalli](https://hashnode.com/@durgamadhavchandra) · [Aug 10](https://hashnode.com/posts/why-close-enough-fails-in-cyber-threat-intelligence-lessons-from-mitre-att-ck-misp-and-yara/6a7a01ed6f1d0bd654142d93) ### [Why 'Close Enough' Fails in Cyber Threat Intelligence — Lessons from MITRE ATT&CK, MISP, and YARA](https://durgamadhav.hashnode.dev/why-close-enough-fails-in-cyber-threat-intelligence-lessons-from-mitre-att-ck-misp-and-yara?utm_source=hashnode&utm_medium=feed) I expected this week to be the easy one. Two weeks of hands-on tooling behind me — Nmap, Wireshark, Metasploit, Burp — and now just frameworks to read and apply. Reading always feels safer than running an exploit. What I didn't expect was how easily "roughly right" could pass for "right" — a Tactic that was actually a Technique, a rotated IP that looked like new intel, an event I thought was shared but never published. Last week a wrong command errored out immediately. This week a wrong definition just sat there quietly, looking correct, until a practical room proved it wasn't. Durga Madhav Chandra · July 2026 11 min read · [durgamadhav.hashnode.dev](https://durgamadhav.hashnode.dev/why-close-enough-fails-in-cyber-threat-intelligence-lessons-from-mitre-att-ck-misp-and-yara?utm_source=hashnode&utm_medium=feed) [Jeevitha kumarswamy](https://hashnode.com/@jeevitha-13) · [Aug 3](https://hashnode.com/posts/attack-breakdown-01-hotel-network-compromise-microsoft-365-account-takeover/6a70661d5ada227182b67c7c) ### [Attack Breakdown #01: Hotel Network Compromise → Microsoft 365 Account Takeover](https://jeevitha-13.hashnode.dev/attack-breakdown-01-hotel-network-compromise-microsoft-365-account-takeover?utm_source=hashnode&utm_medium=feed) A technical breakdown of a hotel network compromise leading to Microsoft 365 account takeover through DNS manipulation, traffic redirection, and authentication phishing. 5 min read · [jeevitha-13.hashnode.dev](https://jeevitha-13.hashnode.dev/attack-breakdown-01-hotel-network-compromise-microsoft-365-account-takeover?utm_source=hashnode&utm_medium=feed) [Long Vo](https://hashnode.com/@ixa250) · [Jul 13](https://hashnode.com/posts/investigation-diary-htb-brutus/6a54af3f12d9ae90493844aa) ### [Investigation Diary: HTB — Brutus](https://longvh0904.hashnode.dev/investigation-diary-htb-brutus?utm_source=hashnode&utm_medium=feed) ⚠️ Disclaimer: This writeup documents my investigation of the "Brutus" Sherlock on HackTheBox, a legal lab environment built for learning and security research. All data is simulated log material provided by HTB. Every technique shown here is for educational purposes only. 22 min read · [longvh0904.hashnode.dev](https://longvh0904.hashnode.dev/investigation-diary-htb-brutus?utm_source=hashnode&utm_medium=feed) [Vũ Nhật Lâm](https://hashnode.com/@kami61) · [Jun 23](https://hashnode.com/posts/from-malspam-to-a-fileless-net-loader-abusing-google-doubleclick-and-a-five-stage-evasion-chain/6a39ed204a985dfa4235edf4) ### [From Malspam to a Fileless .NET Loader: Abusing Google DoubleClick and a Five-Stage Evasion Chain](https://blog.fiscybersec.com/from-malspam-to-a-fileless-net-loader-abusing-google-doubleclick-and-a-five-stage-evasion-chain?utm_source=hashnode&utm_medium=feed) A German-language "purchase order" email with an HTML attachment is the opening move of a five-stage attack chain in which the malicious link routes through ad.doubleclick\[.\]net — a high-reputation Go 13 min read · [blog.fiscybersec.com](https://blog.fiscybersec.com/from-malspam-to-a-fileless-net-loader-abusing-google-doubleclick-and-a-five-stage-evasion-chain?utm_source=hashnode&utm_medium=feed) [Vũ Nhật Lâm](https://hashnode.com/@kami61) · [Jun 8](https://hashnode.com/posts/open-directory-open-season-inside-red-lamassu-s-jfmbackdoor/6a261ef8130f85eb07410e89) ### [Open Directory, Open Season: Inside Red Lamassu's JFMBackdoor](https://blog.fiscybersec.com/open-directory-open-season-inside-red-lamassu-s-jfmbackdoor?utm_source=hashnode&utm_medium=feed) Executive Summary A misconfigured open directory did what years of stealth could not: it handed threat hunters the full toolkit of Red Lamassu (also tracked as Calypso and Bronze Medley), a China-nexu 13 min read · [blog.fiscybersec.com](https://blog.fiscybersec.com/open-directory-open-season-inside-red-lamassu-s-jfmbackdoor?utm_source=hashnode&utm_medium=feed)