MITRE ATT&CK

MITRE ATT&CK in Detective Settings: Avito Launches Cyberdetective Game for Security Awareness Training

Avito security awareness specialist Ilya Nikiforov has developed Cyberdetective, a browser-based detective game that trains employees against real-world attack techniques mapped to MITRE ATT&CK. The game places players in the fictional company Lumi where they control mascot Spock the honey badger, investigate six cases involving voice cloning, MFA fatigue, lookalike domains, and physical tailgating. Each scenario trains specific defensive habits such as callback verification and evidence preservation rather than simple rule recall. Development took 74 days with AI agents handling code, tests, art generation, voice synthesis, and video while the creator focused on scenario design and methodology. The project includes 21 additional training tasks on a firing range covering phishing, AI misuse, and supply-chain risks, supported by 2,200 automated tests and an editor system for future content updates. The initiative demonstrates how non-developers can build production-grade security tools using modern AI tooling while maintaining strict data-protection controls.

Personal Experience Passing HTB CJCA: What to Know Before the Junior Cybersecurity Analyst Exam

A cybersecurity professional who recently transitioned careers shares a detailed account of completing the Hack The Box Certified Junior Cybersecurity Analyst certification. The exam combines practical red team and blue team tasks in a lab environment rather than multiple-choice questions. Preparation involved completing the full Junior Cybersecurity Analyst path in HTB Academy, practicing on Easy and Medium machines, and following the SOC Analyst Path on LetsDefend. The five-day exam requires separate passing scores in both offensive and defensive sections, with strong emphasis on professional reporting using SysReptor. Key lessons include maintaining organized notes per host, documenting findings with MITRE ATT&CK mappings, and preparing thoroughly for the second phase of alert triage and incident handling.

Avanpost SmartPAM Adds 60 MITRE ATT&CK Signatures for Privileged Session Threat Detection

Avanpost has released an update to its SmartPAM 1.4 solution that incorporates a library of 60 signatures mapped to the MITRE ATT&CK framework. The new capability allows the Privileged Access Management system to monitor and analyze actions performed by administrators inside privileged sessions rather than simply controlling initial access. The signatures cover common attack techniques including credential access, persistence, lateral movement, and defense evasion such as disabling audit logs, antivirus, or firewalls and clearing system events. A built-in signature analysis engine normalizes session data, matches observed behavior against known attack patterns, and triggers automated responses including command blocking, session termination, or SIEM alerts. Customers can combine the vendor-supplied rules with custom policies and will receive regular subscription-based updates at no cost until the end of 2026. Avanpost claims SmartPAM is the first PAM product to offer a MITRE ATT&CK-structured signature library, shifting the tool from a basic access gatekeeper to an active behavioral observer capable of identifying malicious activity even when valid credentials are used.

Avito and BI.ZONE Launch Cyberdetective CTF for Non-Technical Employees Focused on Phishing and Social Engineering

Avito's Security Awareness team, in partnership with BI.ZONE, created the Cyberdetective jeopardy-style CTF competition specifically for non-technical staff who do not write code. The three-day event targeted 104 registered participants, with 44 completing tasks and 16 achieving maximum scores across scenarios involving phishing, OAuth consent abuse, file metadata analysis, and prompt injection. Tasks awarded flags not only for investigation but also for refusing risky actions such as granting excessive application permissions or clicking suspicious links. The design incorporated MITRE ATT&CK techniques including T1566.002 Spearphishing Link, T1528 Steal Application Access Token, and T1204.004 Malicious Copy and Paste. Organizers emphasized indirect hints to help participants recognize when an object required action, avoiding the common barrier where employees fail to understand that a strange string or domain needs examination. Feedback highlighted the value of hands-on decision-making over passive lectures, though some technical employees completed the set rapidly.

Detecting Lateral Movement with Neural Networks Trained Solely on Synthetic Data

A researcher generated entire corporate network histories using a 135-line configuration file to create synthetic authentication logs containing lateral movement attacks. Neural networks trained exclusively on these artificial datasets were then evaluated against 1.65 billion real authentication events from Los Alamos National Laboratory, including 749 red team events across 301 compromised machines. The best ensemble of six models flagged 3.6 million hourly machine windows and placed 16 genuine attacks among the top 23 highest-scoring entries, producing only seven false positives. In comparison, a simple threshold counter required 161,000 false alarms to reach the same detection level. The approach also demonstrated an iterative feedback loop where detector errors directly informed refinements to the synthetic world generator. The work shows that synthetic data can reach AUC performance comparable to models trained on real labeled attacks while providing full control over the underlying attack definitions.

Security Vision SIEM Tackles Alert Overload with Data Quality Monitoring and MITRE ATT&CK Coverage

The article examines persistent SIEM challenges illustrated by the 2013 Target breach, where FireEye detected the compromise but response processes failed. It cites recent statistics showing organizations receive nearly 3,000 daily alerts with 46 percent false positives and 63 percent left uninvestigated. Security Vision SIEM, built on the Low-Code Security Vision 5 platform, integrates event collection, normalization, correlation, asset context, and basic response. Key July 2026 updates add collection stability monitoring, SLA dashboards, statistical anomaly detection, Sigma rule exchange, and retrospective process chain reconstruction. The product offers more than 1,200 correlation rules covering over 70 percent of MITRE ATT&CK techniques along with FSTEC BDU mappings and expert response recommendations. It supports remote and agent-based collection across 150 integrations while providing visual No-Code tools for connectors, rules, and dashboards.

MEPhI Opens 2026 Admissions for Online Cybersecurity Master's Program with Yandex Practicum

The National Research Nuclear University MEPhI, in partnership with Yandex Practicum, is accepting applications for its online master's program in Cybersecurity for the 2026 intake. The two-year program leads to a state diploma in Information Security under code 10.04.01 and a professional retraining certificate from Yandex Practicum. Students can choose from four specialized tracks covering AppSec, DevSecOps, network security, and AI security. Admission is fully online and includes document submission via Gosuslugi, an entrance exam, and a motivation letter requiring at least 80 points. The program runs entirely remotely with evening and weekend classes, allowing students to combine studies with work while accessing student benefits and an educational loan at a subsidized 3% rate.

LangGraph Architecture Combines Hybrid RAG with YARA and Sigma Engines for Streaming Log Analysis

A new architectural pattern integrates LangGraph with a hybrid RAG system and deterministic signature engines to process large volumes of unstructured cybersecurity logs efficiently. The pipeline uses Vector for chunking logs into 250-line segments with 20-line overlap, Kafka for streaming, and an 8-node asynchronous DAG that runs AI and rule-based branches in parallel. Agent 1 groups events and generates hypotheses, while a hybrid RAG module performs query reformulation, vector plus BM25 search with 0.6/0.4 weighting, and LLM re-ranking against a translated MITRE ATT&CK knowledge base stored in ChromaDB. Parallel YARA and Sigma engines scan parsed logs using custom text-based rule implementations, with automatic YARA rule generation triggered when coverage gaps are detected. Final aggregation occurs in Agent 3, which validates findings, deduplicates confirmed incidents, and routes unconfirmed events for manual review while storing reports in PostgreSQL. Tested on a 43-minute synthetic dataset containing 38 MITRE techniques, the system achieved 85.7% precision and 78.9% recall at 3.5 lines per second using Gemini 2.5 Flash.