English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Context: Cybersecurity vendors often publish cyber threat intelligence (CTI)reports, referring to the written artifacts on technical and forensic analysisof the techniques used by the malware in APT attacks. Objective: The goal ofthis research is to inform cybersecurity practitioners about how adversariesform cyberattacks through an analysis of adversarial techniques documented incyberthreat intelligence reports. Dataset: We use 594 adversarial techniquescataloged in MITRE ATT\&CK. We systematically construct a set of 667 CTIreports that MITRE ATT\&CK used as citations in the descriptions of thecataloged adversarial techniques. Methodology: We analyze the frequency andtrend of adversarial techniques, followed by a qualitative analysis of theimplementation of techniques. Next, we perform association rule mining toidentify pairs of techniques recurring in APT attacks. We then performqualitative analysis to identify the underlying relations among the techniquesin the recurring pairs. Findings: The set of 667 CTI reports documents 10,370techniques in total, and we identify 19 prevalent techniques accounting for37.3\% of documented techniques. We also identify 425 statistically significantrecurring pairs and seven types of relations among the techniques in thesepairs. The top three among the seven relationships suggest that techniques usedby the malware inter-relate with one another in terms of (a) abusing oraffecting the same system assets, (b) executing in sequences, and (c)overlapping in their implementations. Overall, the study quantifies howadversaries leverage techniques through malware in APT attacks based onpublicly reported documents. We advocate organizations prioritize their defenseagainst the identified prevalent techniques and actively hunt for potentialmalicious intrusion based on the identified pairs of techniques.

Attackers reveal their arsenal: An investigation of adversarial techniques in CTI reports