Cyber attacks are becoming more sophisticated and changing rapidly. Well-trained cyber security professionals are needed to keep track of these attacks, and this begins with a well-educated and well-trained graduate. As cyber security students struggle to develop knowledge and skills that are scattered over the internet, frameworks like MITRE ATT&CK are trying to solve this issue by collecting as much information as possible about tactics, techniques, and procedures (TTPs) of adversary groups, making it easier to provide the relevant data in a single place. Unfortunately, this huge amount of information can be overwhelming for early-career professionals and students, and not knowing how to use such frameworks challenges their ability to operate efficiently in cases of crises. This paper proposes a serious game called Attack to Defend designed and evaluated based on a framework for cyber security serious games called COFELET, to investigate the effectiveness of using a COFELET-based serious game in introducing the ATT&CK framework, as an effective method for teaching and training, where complex knowledge is presented in an engaging and pedagogically informed way. The game was evaluated qualitatively and quantitatively, by researchers, teaching staff, and students, where the learning, instructional, and gaming components of the game were tested and evaluated, and the results were collected via questionnaires. The evaluation led to the conclusion that by combining field-related methodologies with educational theories in a game, students will gain a better learning experience with positive learning outcomes. It was found that besides the field-related methodologies and educational theories, light should be shed on the game components and mechanics that make the learning experience more fun and engaging.