User Training
Mitigation · ATTACK:enterprise:M1017
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:M1017",
"title": "User Training",
"type": "Mitigation",
"source_url": "https://attack.mitre.org/mitigations/M1017",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "course-of-action--2a4f6c11-a4a7-4cb9-b0ef-6ae1bb3a718a",
"external_id": "M1017",
"domain": "enterprise",
"created": "2019-06-06T16:50:04.963Z",
"modified": "2026-05-12T15:12:00.730Z",
"version": "1.3",
"aliases": [
],
"tactics": [
],
"source_references": [
]
}Explicit source assertions (64)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1697
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0dc82354-8b3b-47f7-9bf3-31f9928ae395
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1566.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--11643b79-aef3-4322-ab3c-06f6569a1583
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1566.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1c0eac30-db03-47d4-933a-113d8d365f86
CISA PhishingATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1204
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1d1525e6-74f2-447d-ba11-9e9c9c552403
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1213.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e610bf7-149f-46f2-9177-cf5f745488ad
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1552
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--246e4d06-8646-4f9a-8d7c-1efd98fd11c1
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1213.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--24f93862-49f9-4222-a9c1-d230239462bf
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1036
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2c595799-aebe-40f3-baa1-0e52cacee8b5
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1213
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2ffde834-36f9-463d-93c4-77048f020cf9
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1598
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3de6d2ba-842b-4f60-b177-d8082eebbb1e
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1213.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4afd3659-dcb7-4f0a-938f-91599a4c4861
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4d0c0d1b-94a7-4518-b57e-e79212354bbf
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1557.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--59c65423-347b-4a09-a24d-c228faaa5119
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1598.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--59f80c0d-e8d7-48f6-960a-3d4b593f8b33
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1213.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5db540e2-7f7d-4816-96f2-6498b3f14e5e
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1700
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--635477d8-e634-4f6b-acdf-2cccb27061fa
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1598.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--72d641a0-126d-4bb2-98de-9f8ec46a8d9d
CISA PhishingATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1213.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--73d139f6-f976-4a5d-950d-adb2f0f1d242
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1684.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--74a8ec0f-20d4-4175-bfc3-517d57956eff
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1598.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--756acf5d-6765-4611-b451-f855eefcbb77
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1557
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7833393c-1a00-432b-beed-8225f754a5bd
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1003.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7a5b9104-1fa8-4c55-9e03-f2faa3d2a6f7
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7e8ca453-aee5-48c1-a891-f44a742a95ed
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1003.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--85b3d881-a9d2-45ff-a980-95d0bd9a3dd1
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1185
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8d6d88c3-dbfe-492a-8c4c-ee4bfc10bdc3
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1072
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8f4b9d5d-6ad7-4cca-9869-551604450f91
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1204.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8f76b879-a168-4d87-b9f1-a06706d48e33
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1699
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8fee4a4e-5467-4dd8-a55b-3a2764b34319
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1657
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--90922ab5-2463-4e3a-a23e-13958cce9795
Cyber Safety Review Board: Lapsus · SWAT-hospitalATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1555.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--92cfd4ff-3a37-485a-a0bf-4ee3996da44b
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1552.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--934be676-4444-4ab3-a411-dc9a8dc9c4bb
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1036.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--95020349-b1e3-41ad-9fd2-814d36e906c5
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1111
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--96213379-cdf0-4ee0-8f0c-a9c0d5ffca7e
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1204.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--97d77f42-8b8e-48e1-b772-b6cb5c435249
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1528
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9c3d1701-b0ed-4a20-a864-d2681535cfa8
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1555.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a454aae7-c327-4df5-af79-1191f8128f4e
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1598.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a581fb2c-604a-4417-b782-cafd76b11c37
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1176.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a591d4cc-d03b-45f6-833f-3831dfaf9bbe
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1176
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--addd3fbe-3ab2-4086-a367-af369db04eb7
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1221
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b2dac45d-0bd8-488a-a00d-d54db8d3507c
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1003.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b6583fd8-89f7-4494-8690-3456391bf193
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1056.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b921aed3-07ce-49b0-8051-48807fa82ea7
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1556.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bb30a4b2-90e2-4b29-87f8-f01654b487be
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1557.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bb6edf0f-f2c3-4f6d-b545-f79a57423cd2
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1176.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bef3018a-1a38-4d1f-83ae-094f6c18f2a4
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bfa95fdc-6f4f-48a9-a155-189c81dc9ebd
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1189
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c041783a-0746-49fd-aa9c-3c680029b3a5
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1078.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c43e411a-6615-47f5-ba14-b62c78a61572
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1213.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c8e05047-85f2-4c28-8918-12d6874a45c2
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d4f9d2ab-70d0-4aaf-9c7f-d94fc0818ecb
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1684
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d9f8babb-0b1b-4eb9-aa0c-13c5507561ce
Sophos User Interaction · Unit 42 Global Incident Response Report 2026 · SE SentinelOne 2ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1552.008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--db85d1cf-9aff-4214-9a56-2b21335c7cb7
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1204.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--df82dc71-a168-4af3-9526-8449400777dc
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e49a1c79-5aa0-4d1a-906d-806c5253bd3e
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1003.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e51a1670-52b4-4a0e-b123-7b0ddcf30060
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1003.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e643eb2e-c309-48dc-b105-ffedb4a61247
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1078
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--edaeb27a-9226-4805-ae45-87312a2dc013
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1566
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ee935350-f68f-4bd7-bfca-878ae48a2b97
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1667
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f494bf94-fe0e-4590-8991-470da4bcb4e0
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f4d1e337-60ba-4e28-89d1-ff206bae1750
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1547.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f5499769-be56-4995-b993-0a2bc59a0f08
Re-Open windows on MacATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1539
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f780f9d8-1baa-41b7-b7a1-acba717df0ab
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1621
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f78baa1d-e84a-4f32-a1a4-67972bdd94ea
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1698
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fead3aa3-33ff-4355-a0fa-91bfd5bb61b5