MITRE ATT&CK has long been the de facto standard for sharing TTPs of different threat actors and for planning and executing various threat emulation exercises. However, especially in the last few years, I've seen more and more Security Operations Centers start using it as well, for mapping of their defensive capabilities, detection use cases and SIEM correlation rules.

On Monday, a new version of the framework was released[], which (among other changes) extends its content a little in order to make its use more straightforward when it comes to mapping of existing detections and for implementation of new ones. In versions 9[] and 10[], the framework was extended by an updated list of "Data Sources" relevant to the detection of each technique and sub-technique, and the current version adds an explicit description of how information available in specific Data ...