SoK: The MITRE ATT&CK Framework in

Research and Practice

Shanto Roy, Emmanouil Panaousis, Cameron Noakes, Aron Laszka, Sakshyam Panda, and George Loukas

Abstract—The MITRE ATT&CK framework, a comprehensive models that utilize or extend the MulVal method and mapped
knowledge base of adversary tactics and techniques, has been these MulVAL interaction rules to ATT&CK techniques for
widely adopted by the cybersecurity industry as well as by evaluation in attack scenarios. Sadlek et al. [28] explored the
academic researchers. Its broad range of industry applications in-
arXiv:2304.07411v1 [cs.CR] 14 Apr 2023

clude threat intelligence, threat detection, and incident response, current challenges of threat identification using public enu-
some of which go beyond what it was originally designed for. merations. The authors studied the usability of ATT&CK for
Despite its popularity, there is a lack of a systematic review of the threat modeling. Bodeau et al. [2] discussed various security
applications and the research on ATT&CK. This systematization frameworks, including NIST 800 − 154, STRIDE, DREAD,
of work aims to fill this gap. To this end, it introduces the first tax- OCTAVE, TARA, TAL, STIX, CAPEC, alongside ATT&CK
onomic systematization of the research literature on ATT&CK,
studies its degree of usefulness in different applications, and for threat modeling and cybersecurity risk assessment pur-
identifies important gaps and discrepancies in the literature poses. These works are not systematizations highlighting a
to identify key directions for future work. The results of this dearth of systematic research that addresses ATT&CK use
work provide valuable insights for academics and practitioners cases, application domains, and research methodologies. Our
alike, highlighting the need for more research on the practical paper fills this gap by addressing the following research
implementation and evaluation of ATT&CK.
questions.
RQ1: How does the use of ATT&CK contribute to cyber-
I. I NTRODUCTION security research, and in what application domains and use
ATT&CK presents a curated and actionable repository of cases has ATT&CK been employed in the literature?
adversarial Tactics, Techniques and Procedures (TTPs) [1] The aim of RQ1 is to determine the effectiveness of using
and details the characterization of adversary behavior after a ATT&CK in creating novel and impactful research. Addi-
successful system exploitation [2]. The cybersecurity industry tionally, this inquiry may serve as a foundation for future
uses ATT&CK for various applications including threat detec- studies exploring the application domains and use cases for
tion, adversary emulation, red teaming, behavioral analytics, which ATT&CK has been investigated, thus expediting the
defensive gap assessment, cyber threat intelligence (CTI) and learning curve and enhancing the framework’s practicality.
threat modeling [3], [4], [5], [6], [7]. Our analysis reveals that ATT&CK plays a critical role in
At the same time, ATT&CK is embraced in various do- cyber threat intelligence, intrusion detection and prevention,
mains, including ICS [8] and Enterprise [9]. Many vendors, risk assessment and mitigation, red/purple team exercises and
including Cisco, Fortinet and Claroty have stated the impor- professional training. We also highlight the diverse application
tance of ATT&CK in CTI and how security experts can align domains of ATT&CK, which include enterprise networks,
their research with ATT&CK [10], [11], [8]. Cloud platforms industrial control systems, IoT and mobile communication
such as Microsoft Azure Security have also been mapped systems.
to ATT&CK using TTPs [12]. Even organizations like the RQ2. How is ATT&CK correlated, mapped, or integrated
North Atlantic Treaty Organization and the U.S. Department with other security frameworks in practice?
of Homeland Security have been using ATT&CK for CTI and Understanding this correlation will illuminate the value of
modeling [13], [14]. the framework for industrial applications, which frequently
There is a number of academic [15], [16], [17], [18], [19], need to comply with various frameworks to meet cyberse-
[20], [21], [22], [23] and industrial [24], [25], [26] surveys curity requirements. This insight can clarify the possibility
that present the state-of-the-art approaches in CTI and discuss of integrating ATT&CK and these frameworks into a unified
the necessity and impact of ATT&CK in CTI [16], [22], [23]. global framework. Our investigation reveals that several stud-
There are also works that survey threat modeling approaches. ies have attempted to combine ATT&CK with other security
For example, Tayouri et al. [27] surveyed attack graph-based frameworks such as the cyber kill chain, NIST CSF, ISMS,
CAPEC, D3FEND and Diamond models. The integration of
S. Roy is with the University of Houston, Houston, TX, USA. E-mail: these frameworks results in more comprehensive solutions
[email protected]. E. Panaousis, C. Noakes, S. Panda, and G. Loukas enabling us, for example, to identify more effective sets of
are with the Internet of Things and Security Centre, University of Green-
wich, London SE10 9LS, UK. E-mail: {e.panaousis, c.noakes, s.panda, security controls.
g.loukas}@greenwich.ac.uk. A. Laszka is with the Pennsylvania State Uni- RQ3.What are some examples of how industry utilizes
versity, University Park, PA, USA. E-mail: [email protected]. ATT&CK, and what research trends, as mentioned in RQ1,
“This work has been submitted to IEEE S&P 2024 for possible publication.
Copyright may be transferred without notice, after which this version may no have not yet been observed in the industrial applications of
longer be accessible.” ATT&CK?
Understanding the gap between the use of ATT&CK in indus- subcategories for each application. UC defines the specific
try and academia can motivate the adoption of research meth- applications where ATT&CK has been utilized and is further
ods that are better suited to realistic environments, thereby categorized into Cyber Threat Intelligence (CTI), Intrusion
enabling the development of solutions to emerging societal Detection (ID), Offensive Security (OS), Cyber Risk As-
and industrial problems. Our findings show that academic sessment (CRA), Professional Training (PT), Threat-driven
researchers tend to use ATT&CK to develop models for attack Approaches (TA) and Product Evaluation (PE). AD defines
scenarios, analyze threat intelligence datasets and investigate the specific domains where ATT&CK has been applied and
system vulnerabilities using mathematical and statistical mod- we identify three application domains: Enterprise Networks
els. The utilization of ATT&CK enables them to demonstrate (EN), Mobile Communication Systems (MCS) and Industrial
the applicability of their work to real-world scenarios, pro- Control Systems (ICS). We categorize RF into Cyber Kill
viding a stronger basis for their proposals and facilitating the Chain (CKC), CAPEC (CA), STRIDE (ST), Security Controls
assessment of their research. In contrast, the industry focuses (SC) and the Miscellaneous (MI) subcategory for the rest of
more on developing CTI tools and frameworks, evaluating security frameworks.
products against ATT&CK tactics and techniques, improving We classify the research approaches in our study into three
red or purple team exercises and providing offensive security categories: Scientific Method (SM), Implementation (I) and
training. Evaluation (E). SM identifies the research fields that used
RQ4. What scientific methods have academic researchers ATT&CK in any capacity and we further categorize it into
employed to construct attack scenarios, models, or methods five subcategories: Machine Learning (ML), Natural Language
using ATT&CK matrices? Processing (NLP), Probability Theory (PT), Graph Modeling
By examining these methods, we enable researchers to identify (GM) and Game Theory (GT). Implementation (I) defines how
areas where these scientific methods are not being utilized researchers utilized ATT&CK in implementing the proposed
to their full potential and determine the shortage of research works and we define two subcategories: Testbed (TE) and
that employs equally appropriate methods. These scientific Tools (TO), developed to implement certain attack scenarios
methods include machine learning (ML), natural language pro- or models. Finally, we categorize Evaluation (E) into three
cessing (as subfield of ML), probability theory, graph theory subcategories: Numeric Evaluation (NE), Human Evaluation
and game theory. We examine how the ATT&CK framework (HE) and Model Evaluation (ME). This category shows how
has been implemented in different projects. Specifically, we researchers evaluated their testbeds, tools and models.
analyze the testbed environments and tools that researchers
have used to evaluate their work based on ATT&CK and III. A PPLICATIONS (A) OF ATT&CK
how they have applied these tools to achieve their objectives.
Finally, we investigate the methods used to evaluate research In this section, we explore ATT&CK’s application domains
that utilizes ATT&CK. These methods include numerical or and use cases, examine how other security frameworks are
statistical, human-based and model-based evaluations. mapped to or combined with ATT&CK and finally delve into
The rest of this paper is structured as follows: Section II the different ways in which ATT&CK is utilized by academia
proposes a novel taxonomy of concepts used to answer the and industry.
research questions. Section III outlines the application domains
and use cases in which ATT&CK has been used to address A. A-UC: Use Cases
significant cybersecurity challenges and how ATT&CK has 1) A-UC-CTI: Cyber Threat Intelligence: According to
been combined with other security frameworks (answering Legoy et al. [45], Cyber Threat Intelligence (CTI) is a con-
RQ1-RQ3). Section IV describes the research approaches used tinuous process that necessitates the use of text classification
in conjunction with ATT&CK in the literature (answering techniques for retrieving TTP-oriented information. Mundt et
RQ4). Finally, Section V summarizes the key points of this al. [74] combined CTI with Information Security Management
systematization work, including the significance and limita- Systems (ISMS) and automate CTI by utilizing ATT&CK.
tions of ATT&CK and offers suggestions for future work. Al et al. [5] examined the connections between ATT&CK
techniques enabling the prediction of previously unobserved
II. P ROPOSED TAXONOMY ones. Kriaa et al. [42] used ATT&CK to create their detection
To answer the research questions, we have defined a taxon- and prediction module by constructing a knowledge graph of
omy (shown in Figure 1) that categorizes ATT&CK-oriented TTPs. Zhang et al. [107] proposed a model that uses ATT&CK
applications, use cases and research approaches from the to assess CTI reports automatically to extract Indicators of
literature. By utilizing this taxonomy, researchers can classify Compromise (IoC) timely. Here, the authors used ATT&CK
the literature and gain insights into the usefulness of ATT&CK to identify attack techniques related to IoC.
and identify any gaps in research to date. Table I classifies all The increasing number of connected IoT devices, which
surveyed papers using our taxonomy. bear security vulnerabilities, is contributing to the constantly
The first level classification in our taxonomy considers evolving operational technology (OT) cyber threat landscape.
ATT&CK-based Applications (A) and Research Approaches To address this issue, Kwon et al. [43] developed a Cyber
(RA) found in the literature. We divide ATT&CK applica- Threat Dictionary utilizing the ATT&CK ICS matrix and
tions into three primary categories: Use Cases (UC), Appli- mapped security controls to the ATT&CK ICS matrix. Odemis
cation Domains (AD) and Related Frameworks (RF), with et al. [108] utilized ATT&CK to create a cyber expertise test

2
 Fig. 1: Taxonomy of papers that use ATT&CK.

to detect and categorize adversarial behavior for their CTI 2) A-UC-ID: Intrusion Detection: ATT&CK techniques
research. Similarly, ATT&CK was also used for further threat can be used to categorize adversary behavior and detect
analysis and adversarial TTP classification in the works of advanced intrusions [32]. Common Vulnerabilities and Expo-
Lee et al. [50], Mendsaikhan et al. [51] and Jo et al. [109]. sures (CVEs) can be linked to specific exploitation strategies
Hemberg et al. [37] and Kurniawan et al. [48] utilized the and then mapped to ATT&CK techniques.
framework for linking ATT&CK techniques to vulnerabilities. Golushko et al. [41] applied ATT&CK to identify effective
Additionally, Bromander et al. [44] developed a CTI data techniques under the Command and Control and Defense
model that identifies threats with ATT&CK being used as a Evasion tactics and provided recommendations for detection
source for tactics, techniques, tools, and threat actors. and prevention. Kriaa et al. [42] proposed a novel approach
for building knowledge graphs using ATT&CK and utilizing
Insight 1. ATT&CK is valuable for security teams seeking prediction techniques on event logs to identify and prevent 5G
to keep up with the latest threats and enhance their CTI radio access network attacks. Additionally, Kwon et al. [43]
capabilities. Many studies link CTI reports with ATT&CK extended the ATT&CK ICS matrix leading to the creation of
matrices to create effective mitigation strategies. It has been new categories for threat detection and mitigation.
observed that the majority of research papers in this field The DeTT&CT (Detect Tactics, Techniques & Combat
utilize ATT&CK to improve CTI. However, there is a lack Threats) framework [110], [111] was introduced by the indus-
of investigation into how insights gained from CTI research try [112] to enhance intrusion detection. DeTT&CT helps blue
can be used to enhance ATT&CK itself. teams evaluate and analyze the quality and visibility of data log

3
 TABLE I: Taxonomy classification of papers using ATT&CK
Description Application Research Approach
Literature Application Related Scientific
Use-cases Implementation Evaluation
Domain Frameworks Methods
Ahn et al. (2020) [29] PT EN 7 GM TE NE
Ampel et al. (2021) [30] OS EN 7 ML TE NE,ME
Choi et al. (2020) [4] CTI ICS 7 7 TE, TO 7
Georgiadou et al. (2021) [1] PT, OS, CRA EN 7 7 7 7
Hong et al. (2019) [31] PT, OS EN 7 ML TE 7
Kuppa et al. (2021) [32] OS EN 7 NLP 7 ME, NE
Munaiah et al. (2019) [33] OS EN 7 GM 7 NE
Outkin et al. (2021) [34] TA, PE EN 7 GM 7 ME
Pell et al. (2021) [35] TA MCS 7 7 7 7
Xiong et al. (2021) [36] TA EN MI GM TE ME
Hemberg et al. (2020) [37] CTI EN CA GM TE NE
Kim et al. (2021) [38] PT, OS, PE EN CKC GM 7 NE
Choi et al. (2021) [39] OS, PT ICS 7 GM TO ME
Al et al. (2020) [5] CTI, OS EN 7 ML,GM TO NE, HE
Amro et al. (2021) [?] CRA ICS CA GM 7 NE
Arshad et al. (2021) [40] OS, PT EN 7 GT TO ME
Golushko et al. (2020) [41] IDS, OS EN, ICS, MCS 7 7 TO 7
Kriaa et al. (2021) [42] CTI EN, ICS, MCS CA GM TO ME
Kwon et al. (2020) [43] CTI, TA ICS MI, CKC 7 TO 7
Bromander et al. (2020) [44] CTI ICS CA GM TO ME
Legoy et al. (2020) [45] CTI EN, MCS, ICS 7 ML TO ME
Fairbanks et al. (2021) [46] CTI MCS 7 GM, ML 7 NE
Huang et al. (2021) [47] CTI, TA EN, MCS, ICS MI ML TO NE, ME
Kurniawan et al. (2021) [48] CTI EN, MCS, ICS MI GM TO ME
Lakhdhar et al. (2021) [49] CTI, TA EN, MCS, ICS CA, MI ML TO NE, ME
Lee et al. (2021) [50] CTI EN, MCS, ICS 7 GM, ML TO NE, ME
Mendsaikhan et al. (2020) [51] CTI, TA EN, MCS, ICS CA ML TO NE, ME
Parmar et al. (2019) [13] CTI EN, MCS, ICS 7 GM TE, TO NE
Purba et al. (2020) [52] CTI EN, MCS, ICS 7 NLP TO NE, ME
Aghaei et al. (2019) [53] CTI, TA EN, MCS, ICS CA, MI 7 7 7
Ajmal et al. (2021) [54] CTI, OS, PT EN 7 PT TE, TO NE, ME
Brazhuk et al. (2021) [55] CTI, TA EN, MCS, ICS CA, ST, SC, MI GM, PT TO NE
Elitzur et al. (2019) [56] CTI, TA EN, MCS, ICS SC GM, PT TO NE, ME
Fairbanks et al. (2021) [57] CTI EN, MCS, ICS 7 GM, ML 7 NE, ME
Franklin et al. (2017) [58] TA EN, MCS, ICS 7 ML TO 7
Gourisetti et al. (2019) [59] CTI, TA, CRA ICS SC, MI 7 TE, TO NE
Gylling et al. (2021) [60] CTI, TA EN, MCS, ICS 7 GM TO NE
Hacks et al. (2021,2022) [61], [62] CTI, TA EN, MCS, ICS SC 7 TO NE, ME, HE
Hassanzadeh et al. (2020) [63] CTI, TA ICS SC ML TE, TO NE, ME
Ahmed et al. (2022) [64] CRA, TA EN, MCS, ICS SC PT, GM 7 ME
Bolbot et al. (2022) [65] CRA, TA EN, MCS, ICS ST, MI 7 TO NE
Oruc et al. (2022) [66] CRA ICS SC PT TO NE
TJ OConnor (2022) [67] PT EN 7 7 TE, TO NE, HE
Kim et al. (2020) [68] PT, PE EN CKC GM TE, TO ME
Sadlek et al. (2022) [28] CTI, TA EN CA, MI 7 7 NE
Rao et al. (2023) [69] TA MCS MI GM 7 ME
Chen et al. (2022) [70] TA, PE EN MI NLP, GM TO NE
Adam et al. (2022) [71] CTI EN CA, MI NLP, ML 7 NE, ME
Sadlek et al. (2022) [72] CTI, TA EN, MCS, ICS ST, CKC, SC GM TE, TO ME
Jadidi et al. (2021) [73] CTI, TA ICS SC GM TO ME
Mundt et al. (2022) [74] CTI EN MI GM TO ME
Niakanlahiji et al. (2018) [75] CTI EN MI NLP TO NE, ME
Ayoade et al. (2018) [76] CTI EN CKC, MI NLP, PT, ML TO NE, ME
Karuna et al. (2021) [77] CTI EN, MCS, ICS 7 NLP 7 7
Shin et al. (2021) [78] CTI EN, MCS, ICS 7 PT, ML TO NE
He et al. (2021) [79] CTI, CRA EN, MCS, ICS MI PT, GM 7 NE
Johnson et al. (2018) [80] TA, OS EN, MCS, ICS SC, MI PT, GM TO NE
Tayouri et al. (2023) [27] TA, CTI EN MI GM TO NE
Bodeau et al. (2018) [2] CTI, TA, CRA EN, MCS, ICS CA, CKC, ST, SC, MI 7 7 7
Manocha et al. (2021) [81] CRA, OS EN, MCS, ICS MI PT 7 NE
Mashima et al. (2022) [82] CTI, PE ICS SC, MI 7 TE, TO ME
Dhirani et al. (2021) [83] TA, PE, CRA ICS SC, MI 7 7 7
Luh et al. (2022) [84] TA, OS EN, ICS CA, SC, MI GT TE, TO HE, NE
Husari et al. (2019) [85] CTI EN, MCS, ICS CKC, MI NLP TO 7
Nisioti et al. (2021) [86] TA, OS EN, MCS, ICS CKC, MI GT, GM TO NE, ME
Halvorsen et al. (2019) [87] CTI, TA, ID EN SC, MI PT TE, TO NE

4
 TABLE I: Taxonomy classification of papers using ATT&CK (continued)
Description Application Research Approach
Literature Application Related Scientific
Use-cases Implementation Evaluation
Domain Frameworks Methods
Wong et al. (2021) [88] TA, OS EN ST 7 7 7
Dhir et al. (2021) [89] TA, OS EN 7 PT 7 ME
Holder et al. (2021) [90] TA, CRA EN 7 PT TE NE
Ahn et al. (2022) [91] ID, CTI, TA EN 7 PT, GM, NLP TE, TO NE
Stoleriu et al. (2021) [92] ID EN SC, MI ML TE, TO NE
Bagui et al. (2022) [93] ID EN 7 ML 7 NE, ME
Zurowski et al. (2018) [94] TA, OS EN SC ML TO NE
Alnafrani et al. (2022) [95] TA EN 7 PT, ML TE, TO ME
Samtani et al. (2022) [96] CTI, TA EN 7 ML 7 7
Grigorescu et al. (2022) [97] CTI EN CA, MI NLP, ML, GM TO NE, ME
Hasan et al. (2019) [98] ID EN, ICS CA, CKC, MI ML, GM TO NE, ME
Maymı́ et al. (2017) [99] CTI EN, MCS, ICS CKC, MI ML, GM 7 7
Drašar et al. (2020) [100] TA, OS EN, MCS, ICS MI GT, GM TE, TO NE, ME
Kim et al. (2022) [101] CTI, TA EN ST, CKC ML TO NE, ME
Kim et al. (2021) [102] CTI, TA MCS 7 ML 7 ME, NE
Sahu et al. (2021) [103] TA EN MI 7 7 ME
Zhao et al. (2021,2022) [104], [105] PT EN MI 7 7 7
Van et al. (2022) [106] TA EN MI, SC PT, GM TO ME

sources and detection coverage using ATT&CK. In addition to Kim et al. [38] developed an offensive security taxonomy
DeTT&CT, the industry is continuously creating frameworks and provided a systematic cyber attack scoring model. They
and tools for detecting and responding to security incidents. employed artifacts from attacks to identify the techniques
These frameworks and tools are exemplified by ATT&CK. For used. They constructed the technology and stages used by
instance, Security Information and Event Management (SIEM) malware based on ATT&CK and grouped the identified attack
tools are adopting ATT&CK for better detection and alert techniques used in a few real cyber-attack incidents. Other
management [63], [113], [114], [6]. studies such as [30], [5], [40], [54] have also utilized ATT&CK
Insight 2. ATT&CK assists researchers identify behavior for offensive security practices, red teaming exercises, and
patterns of known threats and recognize the use of particular penetration testing.
techniques and tools, which can aid in intrusion detection. Insight 3. ATT&CK is a valuable tool for offensive security
There is a lack of studies that evaluate the effectiveness teams to plan and execute simulated attacks in order to test
of ATT&CK in supporting intrusion detection frameworks an organization’s security measures. By utilizing ATT&CK,
in real-world settings as well as research on how to adapt organizations can identify weaknesses in their defenses and
ATT&CK to detect new threats. improve their overall security posture. This proactive security
3) A-UC-OS: Offensive Security: ATT&CK is a valuable approach can help organizations better protect themselves from
resource to conduct effective adversary emulation as it con- real-world attacks. A potential research gap in the application
tains comprehensive information on techniques employed by of ATT&CK to offensive security is the development of
various threat actors. By utilizing the ATT&CK knowledge metrics for evaluating the effectiveness of defensive measures
base, organizations can simulate realistic attack scenarios and against specific TTPs, as well as standardized methods for
proactively identify potential security gaps thus enhancing mapping defensive measures to specific TTPs.
their overall security posture. 4) A-UC-CRA: Cyber Risk Assessment: ISO 27005, CO-
Kuppa et al. [32] leveraged a CVE regular expression BIT 5, NIST SP 800-30 and other frameworks are widely
dataset to identify frequently exploited CVEs created by used for cyber risk assessment. Researchers have recently
collecting different APT reports1 from 2008 to 2019, zero-day combined these frameworks with ATT&CK for more effective
exploits2 from Google project zero, 63720 vulnerability reports risk assessment. For example, Ahmed et al. [64] proposed a
and 37000 threat reports3 . The researchers obtained a sample methodology that uses ATT&CK, NIST SP 800-30 Rev.1, and
of 200 CVEs from publicly available threat reports along attack graphs to assess and characterize cyber risk. Sadrazamis
with their corresponding ATT&CK techniques to extract the [115] proposed a hierarchical risk assessment system based
relevant context phrases. Munaiah et al. [33] used data from on ATT&CK knowledge graph. Amro et al. [116] employed
the 2018 National Collegiate Penetration Testing Competition semantics and components of ATT&CK to quantify risks
and codified their approach in terms of ATT&CK tactics and associated with cyber-physical systems. Ahmed et al. [64]
techniques that it is possible to characterize attacker campaigns analyzed and characterized TTPs used by different threat
as a chronological series of them. actors for informed cyber risk assessment. In their study, Kure
1 https://github.com/CyberMonitor/APT CyberCriminal Campagin
et al. [117] presented an integrated cyber risk management
Collections
framework that utilizes an ATT&CK-driven threat modeling
2 https://googleprojectzero.blogspot.com/p/0day.html approach. Oruc et al. [66] used ATT&CK to assess risks
3 https://www.broadcom.com/support/security-center/a-z associated with cyber threats and vulnerabilities for integrated

5
navigation systems on board shipping vessels. date with the latest threats and using ATT&CK to develop
The use of cyber risk and vulnerability assessment data effective defensive strategies, security professionals can better
mapped to ATT&CK tactics and techniques has been ex- protect their organizations against cyber threats. While there
plored by the industry to identify mitigation strategies [118], are studies proposing different ways to use ATT&CK in
[119]. Grantek [120] has detailed an approach to utilizing training, a research gap exists in the form of comprehensive
ICS ATT&CK strategies for risk management, which involves evaluation studies that assess the effectiveness and efficiency
system identification and characterization, vulnerability identi- of these programs. Therefore, there is a need for more empir-
fication and threat modeling, and risk calculation and manage- ical research to compare and measure the impact of different
ment. AttackIQ, a security research organization focused on approaches on the development of cybersecurity skills and
prioritizing vulnerability management, published a whitepaper knowledge.
proposing the use of ATT&CK and CVE for better risk 6) A-UC-TA: Threat-driven Approaches: Jadidi et al. [73]
management [121]. MITRE presented cyber resiliency metrics emphasized that threat hunting and modeling rely on various
and scoring for better risk management in a whitepaper by inputs, such as CTI, third-party notifications and data from
Bodeau et al. [2]. security analysts, to identify threat actor behavior or vulnera-
On the research front, Georgiadou et al. [1] associated bilities. In this way, security professionals can be empowered
individual and organizational culture dimensions with adver- to stay ahead of emerging threats. To enhance mitigation
sarial behavior and patterns documented in ATT&CK, using strategies, Ampel et al. [30] developed a model that auto-
a cybersecurity culture framework. They developed a hybrid mates the mapping of CVEs to ATT&CK techniques within
ATT&CK for Enterprise and ICS matrix to identify cyber risks the matrix. They extracted data from 24,863 CVEs across
to which an organization lacks resilience. various exploitation databases. Hacks et al. [61] proposed a
Insight 4. By mapping threat behaviors with vulnerabilities, solution that offers CTI capabilities by utilizing ATT&CK
researchers have been able to provide essential mitigation and mapping its components to attack graphs labeled with
tactics for assessing cyber risk. ATT&CK provides a consistent CTI. Rao et al. [69] introduced a threat modeling framework
and repeatable approach to evaluating security risks, enabling named Bhadra, designed specifically for MCS. Bhadra aligns
organizations to make more informed decisions about the with ATT&CK for enterprise networks and can be used with
threats they are facing. Investigating further the integration or without ATT&CK for threat modeling purposes. Since there
of ATT&CK with other risk assessment methodologies has was not any dedicated threat modeling framework for MCS,
the potential to enhance its utility and effectiveness. Addi- the authors looked into ATT&CK for Enterprise and reused
tionally, conducting empirical studies in collaboration with the structure and terminology of ATT&CK.
practitioners to assess the impact of using ATT&CK on cyber Sadleck et al. [28] introduced an approach for managing
risk quantification can contribute to advancing cyber risk and modeling threats by leveraging Common Platform Enu-
management practice. meration for asset management, CVEs and CWE for vulner-
5) A-UC-PT: Professional Training: Georgiadou et al. [1] ability management, and CAPEC and ATT&CK for threat
focused on cyber warfare simulations for training offense and management. By using ATT&CK and CAPEC together, the
defense from real-world cyber scenarios related to ATT&CK. authors were able to provide a comprehensive description of
Hong et al. [31] proposed an automated script to generate sim- adversarial tactics and techniques and attack patterns, leading
ulated threats for training professionals with practical methods to better threat management. Kim et al. [102] proposed an
for real-world defensive scenarios. O’Connor [67] shared ex- automated framework for attributing mobile threat actors by
periences, lessons and materials from an undergraduate course analyzing the mobile malware using automated ATT&CK-
that suggests using ATT&CK to combine theoretical learning based TTP and Indicators of Compromise. Similarly, Fox et
and exploratory labs. al. [14] developed an enhanced cyber threat model for the
Kim et al. [68] analyzed real-world data from ATT&CK to financial service sector that utilizes ATT&CK and CAPEC.
propose CyTEA, a model that can generate simulated cyber In another study, Jadidi et al. [73] presented a threat-hunting
threats for a cybersecurity training system. The simulation framework to detect cyber threats against ICS devices during
level was evaluated based on procedural, environmental and the early stages of the attack lifecycle. The authors leveraged
consequential similarities to determine if the model is suitable ATT&CK to generate hunting hypotheses and predict the
for real-world use and acceptable for industry usage. Arshad future behavior of potential adversaries.
et al. [40] proposed an attack specific language (ASL) based Numerous other research papers have used ATT&CK for
on ATT&CK that is used to streamline and automate the threat modeling [70], [43], [47], [49], [51], [53], [55], [56],
functions of a cyber range, which is used for training. The [59], [60], [61], [63], [122]. Among these, Elitzur et al. [56]
authors used ATT&CK to specify procedure classification and utilized a CTI-based knowledge graph, based on ATT&CK,
map corresponding tactics and techniques. Other researchers to demonstrate increased accuracy in detecting attack patterns
have also utilized ATT&CK to improve or design professional on enterprise networks. They used information and knowl-
training programs, including Ahn et al. [29] and Ajmal et edge about past, present, and future cyber attacks that help
al. [54]. build a comprehensive understanding of the TTPs used by
Insight 5. ATT&CK enables professionals to enhance their cyber attackers. Gourisetti et al. [59] developed a framework
knowledge of the threat landscape and improve their hands- that provides functions for identifying, protecting, detecting,
on skills in responding to cyber attacks. By staying up-to- responding to, and recovering from cyber threats, aligning

6
recorded events or alerts with relevant attack vectors from key features between ATT&CK and a Meta Attack Language
ATT&CK. Gylling et al. [60] used ATT&CK as the basis for framework, combining knowledge from both to define attack
their CTI when creating their probabilistic attack graph. Xiong steps, defenses, and asset associations. Munaiah et al. [33]
et al. [122] introduced a language to model and describe cyber carried out a penetration testing competition for enterprise
threats and attacks against an enterprise security system using systems. The authors analyzed a dataset of over 500 million
ATT&CK for the enterprise. events generated by six teams of attackers during a penetration
Insight 6. ATT&CK is used to model threat scenarios and testing competition. The authors examined the competition
assess their impact. This helps security teams prioritize their data set to identify ATT&CK tactics and techniques and
defenses and focus on the most critical cyber risks. We believe found that it is possible to describe attackers’ campaigns in a
there is a need for further research on how to effectively chronological sequence by analyzing their behavior.
integrate CTI sources beyond ATT&CK into existing security Previous research that uses ATT&CK has explored the
operations workflows and how to leverage the wealth of data connection between CVEs and ATT&CK tactics to develop
generated by CTI for more proactive and effective threat effective mitigation strategies [32]. Additionally, Kim et al.
hunting and mitigation. [68], [38] gathered data to develop a training system for
7) A-UC-PE: Product Evaluation: Since ATT&CK is a cybersecurity that focuses on threats to internal infrastructure
well-maintained knowledge base, it can be used for evaluations and enterprise systems, which the simulation aims to address.
of cybersecurity products and research tools. Researchers have The authors identified different ATT&CK techniques and
utilized ATT&CK to evaluate security systems with scoring obtained scoring results for some APT groups. Hemberg et
metrics. For example, Manocha et al. [81] developed a security al. [37] attempted to link ATT&CK, NIST CWEs, CVEs, and
assessment rating framework that enables precise security CAPEC. This paper takes five browsers and compares their
rating for security systems. They developed a prediction score severity ratings, in terms of CVEs, to determine the motives
that involves weighted exploitability and impact of different behind attacks and how they will be executed. In general, most
levels of an attack technique. In addition, academic research threat modeling works that use ATT&CK, including [31], [34],
has started to analyze the data stemming from ATT&CK- [44], [107], [74] discuss internal infrastructure attacks and
based product evaluations. For example, Outkin et al. [123] the simulated threats are related to the enterprise systems’
developed a game-theoretic framework that utilizes data from internal infrastructure. Here, Outkin et al. [34] developed
MITRE’s APT3 ATT&CK Evaluations. From this data, authors reliable criteria for allocating resources across such detection
were able to generalize defender capabilities.m Mashima et and response opportunities at different steps in the attack. To
al. [82] evaluated an in-network deception technology in a evaluate defender policy, the authors incorporated the results
smart grid, named DecIED based on ATT&CK for ICS. The of ATT&CK Evaluation into attack success and defender
work tests the mitigation against a few APT groups including response metrics.
Stuxnet and CrashOverride. It appeared that DecIED was able Additionally, ATT&CK is also being used for cloud security
to mitigate only around half of the total number of ATT&CK [103], [122], [104], [105], [106]. Sahu et al. [103] developed
techniques. an Infrastructure-as-a-Service (IaaS) security model named
Insight 7. ATT&CK is used to evaluate the capabilities MISP, where the authors considered the ATT&CK matrix
of cybersecurity technologies such as assessing their ability for enterprises and a subset of it for cloud computing. The
to respond to ATT&CK tactics and techniques. In this way, authors filtered the necessary TTPs related to the cloud for
organizations can make informed decisions when choosing the evaluation of the adversary’s behavior. Zhao et al. [104],
cybersecurity solutions. There is a lack of standardization in [105] developed a board game to improve cloud security
how cybersecurity products implement ATT&CK and since the that includes an automated evaluator to check defense plans
framework is flexible and customizable, organizations may use and attack plans built by invited players. The attack cards,
it differently or interpret it differently, making it challenging to defense cards, and the mapping between them are derived from
compare the effectiveness of different cybersecurity products ATT&CK and CSA cloud control matrix.
across organizations. 2) A-AD-MCS: Mobile Communication Systems: Mobile
Communication Systems (MCS) are evolving and require
B. A-AD: Application Domains standardized threat modeling frameworks [124]. Authors state
1) A-AD-EN: Enterprise Networks: This section discusses that ATT&CK and Bhadra [69] are most useful for MCS-based
works that study attacks and threats related to popular CVEs of threat modeling. Rao et al. [69] claimed that Bhadra aligns
enterprise systems (vulnerabilities commonly used for internal conveniently with ATT&CK. Nevertheless, within the MCS
infrastructure exploitation) [29], [30], [54]. Ahn et al. [29] domain, most works utilize ATT&CK for threat modeling and
proposed a system configuration model (specific elements that threat detection. Early stage 5G networks have incorporated
define or prescribe what a system is composed of) based the use of ATT&CK to demonstrate the exploitation of net-
on the Cyber Kill Chain (CKC) and ATT&CK to produce work functions NFV and SDN. 5G threat assessments and
analytical data on threat actors resulting in providing infras- industry reports offer studies on how the domain-specific tech-
tructure protection mitigation strategies. The authors utilized niques can be used by Advanced persistent threats in multi-
ATT&CK for cyber warfare simulation and threat analysis. step attacks for 5GCN networks. Pell et al. [35] discusses how
Xiong et al. [36] proposed a threat modeling language for to exploit front-facing network functions to compromise 5G
enterprise network security based on ATT&CK. They analyzed networks. This work has contributed to the MITRE FiGHT,

7
which is a knowledge base of adversary Tactics and Tech- all existing attack knowledge bases. For instance, Brazhuk et
niques for 5G systems [125]. al. [55] established relationships between ATT&CK, CAPEC,
3) A-AD-ICS: Industrial Control Systems: Industrial Con- CWE and CVE security enumerations to create a generic
trol Systems (ICS) are critical environments such as Gas, knowledge base that offers improved threat modeling over
Oil, and nuclear industries. ATT&CK literature has studied previous threat-based approaches.
ICS and its equipment, including evaluation testbeds for ICS 2) A-RF-CKC: Cyber Kill Chain: ATT&CK consists of 14
systems [4], [39], [43], [59], [126]. Choi et al. [4] introduced a tactics that can be mapped to the phases of Lockheed Martin’s
method to expand existing testbeds for ICS so that information Cyber Kill Chain (CKC): Reconnaissance, Weaponization,
can be collected during a cyber incident based on ATT&CK. Delivery, Exploitation, Installation, Command & Control and
This method is useful for creating attack simulations for Actions on Objectives. Unlike the traditional CKC, ATT&CK
ICS. In a later work, authors introduced a probabilistic attack is a globally accessible knowledge base, which makes it more
sequence generator to leverage ICS datasets [39]. Here, the comprehensive but is also regularly updated with new tech-
authors proposed a method for generating attack sequences niques based on real-world observations. By understanding
based on the characteristics desired by the user using tactics the different stages of an attack and the specific TTPs used
and techniques from ATT&CK. They overcame difficulties by attackers, organizations can detect and prevent attacks
in developing an ICS dataset by implementing a hidden earlier in the CKC. By mapping known TTPs to the different
Markov model-based attack sequence generation method that stages of CKC, organizations can develop a more targeted and
uses probabilities to produce the attack sequence. Dhirani et effective response to an attack. Naik et al. [129] have studied
al. [83] utilized ATT&CK along with other standards (e.g. characteristics, advantages and disadvantages of ATT&CK and
NIST 800 − 82, ISO 27001, IEC 62443, etc.) to build unified CKC and provide a comparative study to highlight the most
an Industrial IoT standards roadmap. They specifically used suitable attack models for different applications.
ATT&CK for identifying different aspects of ICS/SCADA 3) A-RF-ST: STRIDE: A few works integrated multiple
security. threat modeling frameworks for specific tasks including risk
analysis and mitigation, defense framework design, and vul-
C. A-RF: Related Frameworks nerability analysis. Bolbot et al. [65] integrated ATT&CK
As a well-documented knowledge base of adversarial behavior, and STRIDE alongside cybersecurity analysis methodologies
ATT&CK has been widely adopted and combined with other for risk analysis and mitigation. Sadlek et al. [72] also used
cybersecurity frameworks by both academic and industrial both ATT&CK and STRIDE to identify attack paths. Straub
researchers to achieve specific goals. [130] compared the capabilities of ATT&CK, STRIDE, and
1) A-RF-CA: CAPEC: In addition to ATT&CK, various Cyber Kill Chain in the context of offensive and defensive
threat frameworks are utilized, including the Common At- use. He concludes that while STRIDE is useful for defensive
tack Pattern Enumeration and Classification (CAPEC) [127]. purposes, it lacks the features required for direct offensive
CAPEC is a threat modeling framework that focuses on use. Additionally, STRIDE does not have an explicit steps to
application security and is primarily associated with Common deploy an attack against the targeted vulnerability, which is a
Weakness Enumeration (CWE) [128]. On the other hand, key feature of ATT&CK. Overall, Straub’s analysis suggests
ATT&CK concentrates on network defense. Although CAPEC that while STRIDE and ATT&CK both have their strengths
describes common patterns frequently employed by specific and weaknesses, they serve different purposes and can be used
techniques described in ATT&CK, the cross-reference helps in different ways depending on the specific goals of a given
to improve threat management by identifying potential vul- security operation.
nerabilities. For example, Adam et al. mapped CWEs to 4) A-RF-SC: Security Controls: To achieve threat-informed
ATT&CK techniques via CAPEC [71], while Aghaei et al. defense, native security controls can be mapped to ATT&CK.
[53] created a mapping between all CVEs, CAPEC and Security Stack Mappings [131] produces mapping files for
ATT&CK. Also, CAPEC can provide valuable insights into different cloud platforms, including Microsoft Azure, Amazon
potential vulnerabilities within an application, while ATT&CK Web Service, and Google Cloud Platform, to aid organizations.
can provide information on how attackers might exploit those The online repository offers supporting resources, including
vulnerabilities to achieve their goals. scoring rubrics, mapping data formats, and mapping tools that
The integration of ATT&CK and CAPEC helps organiza- produce the ATT&CK navigator for mapping files. In practice,
tions to detect and mitigate a wide range of threats, including the security teams are utilizing the mapping of ATT&CK
attacks against applications (which is the primary focus of TTPs to Azure-native security controls [12]. Bromander et
CAPEC) and network infrastructure (which is the primary al. [44] developed a graph-based data model that linked ob-
focus of ATT&CK). As a result, organizations can have a jects obtained from ATT&CK, STIX [132], detection maturity
more comprehensive view of the threat landscape and develop model [133] and the Diamond model [134].
a more effective response to cyber threats. Sadlek et al. [28] The National Institute of Standards and Technology (NIST)
have combined CAPEC and ATT&CK for more effective Cybersecurity Framework (CSF) was developed in 2014 and
threat management. Similarly, Fox et al. [14] have integrated utilized to strengthen the defense and resiliency of federal
ATT&CK and CAPEC to construct an extensive high-level networks and critical infrastructure. Kwon et al. [43] proposed
threat modeling framework. Interestingly, some researchers a Cyber Threat Dictionary that can map all attack and defense
have developed a formal knowledge base or model that unites tactics to the Facility Cybersecurity Framework (FCF) through

8
a correlation matrix [135]. FCF is specifically designed for build their attack scenarios while Osquery-ATT&CK [139]
facility-related control systems and operational technology, maps ATT&CK to Osquery [140] for enterprise threat hunting.
which motivated the authors to use the ATT&CK for ICS Osquery performs continuous testing for memory leaks, thread
matrix for mapping with FCF. safety and binary reproducibility on all supported platforms,
Although ATT&CK includes mitigation techniques against including Windows, macOS and Linux (e.g. CentOS) [141].
the TTPs, MITRE provides a separate and comprehensive Sigma rules tagged with a attack.tXXXX tag can generate
framework named D3FEND [136], which is a knowledge the ATT&CK Navigator [142] heatmap from a directory
graph of cybersecurity countermeasures [137]. ATT&CK is containing sigma rules. Last, the Atomic Red Team [143] is a
designed from the adversaries perspective while D3FEND was collection of atomic tests that are mapped to ATT&CK. The
built from the defenders’ perspective. D3FEND was also used tests can be performed using command-line and aids security
in academic research works such as Luh et al. [84]. teams to conveniently test their environments.
5) A-RF-MI: Miscellaneous: Threat modeling frameworks
include ATT&CK, CAPEC, PASTA, WASC and OWASP. D. Use of ATT&CK in Academia and Industry
Other frameworks including Microsoft’s DREAD, OCTAVE, ATT&CK has gained significant attention from cybersecurity
Intel’s Threat Agent Risk Assessment (TARA) and Threat researchers in both academia and industry. While initially used
Agent Library (TAL) are used for supporting security design, by the industry to improve their tools and services, academic
analysis and testing. PASTA (Process for Attack Simulation researchers have also recognized its usefulness in evaluating
& Threat Analysis) has been used for threat modeling in their research. This has resulted in a rapid development of
industrial IoT [138]. Some frameworks including STIX (the new tools that integrate and incorporate ATT&CK tactics and
Structured Threat Information eXpression), PRE-ATT&CK techniques. Security analysts and specialists use ATT&CK
and ODNI’s CTF (Cyber Threat Framework) are useful for in conjunction with other security frameworks, standards,
supporting attack information sharing. These frameworks can policies, compliance and guidelines to obtain comprehensive
be integrated with ATT&CK to generate more comprehensive recommendations on how to secure systems. Considering
and valuable risk models, thereby facilitating the identification ATT&CK as a baseline knowledge-base of TTPs, industrial
of more effective security controls. research heavily involves the framework to evaluate their
Jadidi et al. [73] proposed a unified threat-hunting model products, including SIEM (Security, Information, and Event
for ICS that combines ATT&CK for ICS and the Diamond Management), EDR (Endpoint Detection and Response) and
model of intrusion analysis to predict the future behavior deception tools.
of the adversaries. The model can provide endpoint security Cyber Threat Intelligence. Academic researchers primarily
logs, user behavior analytics and network or application threat focus on text classification and NLP for retrieving intelligence
analytics, which are useful to organizations. The authors from CTI reports. On the other hand, the industry primarily
evaluated their model against real-life attacks including the uses ATT&CK matrices and navigators to filter and score
Ukrainian power grid attack by Black Energy 3, the DoS attack threats based on threat groups, techniques, platform and as-
on SIEMENS PLC and Tank 101 underflow. sociated mitigation. They also develop tools and APIs (using
According to Mundt et al. [74], integrating CTI with In- ATT&CK) for standard CTI sharing between organizations and
formation Security Management Systems (ISMS) can result developing extended threat detection tools.
in robust data security approaches. They suggest that im- Intrusion Detection. Academia mostly attempts to catego-
plementing and automating CTI processes within an ISMS rize ATT&CK tactics and techniques, build knowledge graphs
can be facilitated using the ATT&CK framework, which is and apply machine learning for detection and mitigation. The
commonly used by security researchers in conjunction with industry adopts and tailors ATT&CK to develop their incident
ISMS. To illustrate the interactions between the CTI and ISMS management and response tools.
processes, including communication and data exfiltration, the Offensive Security. Academia uses ATT&CK to create of-
authors use Business Process Modeling Notation (BPMN) dia- fensive security taxonomies, analyze past offensive security
grams. The proposed approach involves human actors such as competition data and model adversarial behavior. The industry
a cyber analyst or Chief Information Security Officer (CISO) involves red and purple team exercises and organizes penetra-
and follows the guidelines outlined in ISO/IEC 27000:2018. tion testing using ATT&CK.
By incorporating the ATT&CK framework into their ISMS, Cyber Risk Assessment. Both academic and industrial re-
organizations can improve their ability to detect and respond searchers use ATT&CK for assessing cyber risk by mapping
to threats, thus enhancing their overall data security [74]. threat behaviors with vulnerabilities and then proposing ways
Hemberg et al. [37] proposed a framework to combine to mitigate the identified risks. Academic scholars attempt
ATT&CK, NIST, CWEs, CVEs and CAPEC. The authors to connect other frameworks with ATT&CK for development
proposed a bidirectional data graph named BRON to gain of better risk management. Security vendors adhere to this
further insight from alerts, threats and vulnerabilities by cre- mapping for conducting bespoke cyber risk management for
ating links between collected information of the frameworks their users.
mentioned above. The relational links were achieved via Professional Training. Academic work focuses on the-
linking ATT&CK techniques to attack patterns, then attack oretical analysis and modeling whereas industry addresses
patterns to CWEs and finally, CWEs to CVEs. Luh et al. [84] the training of their employees (red/purple teams), staff and
considered ATT&CK, D3FEND and the NIST SP 800-53 to clients, with practical exercises.

9
 Threat-driven Approaches. Academic research primarily at- capabilities. Mayami et al. [99] created a semantic represen-
tempts to propose new threat modeling frameworks aligned tation of adversarial TTPs, where the authors built a model
with ATT&CK. In contrary, the industry focuses on tailoring of APT28 using ATT&CK. Similarly, other works ([49], [53])
threat modeling frameworks to use them in commercial prod- built ML models to map vulnerabilities to adversarial tactics
ucts. listed in ATT&CK.
Product Evaluation. Academia undertakes research regard- 2) RA-SM-NLP: Natural Language Processing: Natural
ing the ATT&CK evaluation process. Industrial work involves Language Processing (NLP) is a field of study that involves
product evaluations to determine if their developed security the application of ML algorithms and models to analyze, un-
solutions can detect and consequently mitigate known threat derstand and generate human language data. NLP has proven
actors. useful for CTI, particularly in retrieving summaries from threat
reports. Liu et al. [145] used an attention transformer hierarchi-
cal recurrent neural network to extract ATT&CK information
IV. R ESEARCH A PPROACHES (RA) USING ATT&CK
from CTI. Kuppa et al. [32] employed NLP techniques, such
In this section, we first discuss scientific methods used to build as the Multi-Head Joint Embedding Neural Network model, to
attack scenarios, models and methods based on ATT&CK automatically map CVEs to ATT&CK techniques. Chen et al.
matrices. These approaches include machine learning (includ- [70] developed an anomaly detection and threat hunting system
ing natural language processing), probability theory, graph that utilizes NLP and graph modeling. The authors used
theory and game theory. Second, we study how ATT&CK ATT&CK APT3 evaluation data and applied NLP techniques
has been used in implementation of testbeds and security to process Windows logs for seeking suspicious patterns.
tools. Third, we study the different methods (e.g. numerical Niakanlahiji et al. [75] presented an NLP-based trend analysis
or statistical, human-based and model-based evaluations) of to present how to obtain knowledge regarding APTs from
evaluating research that has used ATT&CK. unstructured reports and developed an information retrieval
system named SECCMiner that combines NLP processes
and information retrieval system concepts to categorize APTs
A. RA-SM: Scientific Methods
based on ATT&CK tactics. Husari et al. [85] also utilized NLP
1) RA-SM-ML: Machine Learning: Machine learning has to characterize the temporal relationship of attack actions of an
widely been used for different ATT&CK-based research APT using ATT&CK and a machine readable language named
works. Al et al. [5] used statistical machine learning analysis STIX. Apart from the above-mentioned works, [76], [52], [77],
on APT and software attack data (270 total attack instances), [146], [28], [70], [147] have involved NLP and ATT&CK for
reported by ATT&CK, to identify correlations and associations automated threat intelligence, modeling and mapping.
among attack techniques. Dhir et al. [89] proposed to encode 3) RA-SM-PT: Probability Theory: Choi et al. [39] utilized
the labels of ATT&CK into a set of matrices to develop the a hidden Markov model to generate varied attack sequences
relationship between reports and labels. The authors utilized based on user objectives. The authors considered the prob-
a transformer for the semantic representation of CTI reports ability of starting each ATT&CK tactic as the initial state
and built causal inference to ATT&CK. Holder et al. [90] also probability, probability of movement between each tactic
focused on causal inference applied to ATT&CK. The authors as transition probability and probability of the occurrence
utilized explainable AI (XAI)-oriented defense recommenda- of a particular technique (under the same tactics) as the
tions and attack predictions based on ATT&CK patterns. emission probability. The attack sequence generation can
ML and neural networks are often used for detection leverage ICS datasets and provide various attack scenarios
purpose. For example, Ahn et al. [91] performed ML-based performed in real life by different malware including Stuxnet
malicious file detection and visualization based on dynamic- (Iran nuclear facilities), BlackEnergy3 & Industroyer (Ukraine
analysis-based ATT&CK. Stoleriu et al. [92] proposed ML- power grid), Triton (Saudi Arabia petrochemical plant), Bad
based analysis and detection of APT attacks using ELK Rabbit (Ukrainian transportation) and LockerGoga (Norway
stack (Elasticsearch, Logstash and Kibana), where the au- aluminum company). Other works including [64], [148], [79]
thors retrieved a series of APT-based attacks included in the calculated probabilities of different attack scenarios to assess
ATT&CK matrix. Hasan et al. [98] developed a decision and mitigate risks. All these works recognized ATT&CK as
support system for cyber threat detection and protection using a standard knowledge base of TTPs and utilized listed tactics
ATT&CK tactics and techniques. Huang et al. [47] used and techniques for their simulated attack scenarios.
deep learning and ATT&CK knowledge to develop a behavior 4) RA-SM-GM: Graph Modeling: Kriaa et al. [42] used
analysis system for Windows malware. Hemberg et al. [144] graph theory due to the complex nature of APTs and com-
built ATT&CK-based datasets for predicting threat techniques prehensive attack methods, which provides a better evaluation
and attack patterns. Zurowski et al. [94] created a public than some other existing methods. Here, the authors combined
dataset that includes ML-based tools, which are mapped to knowledge graphs and machine learning to detect and prevent
ATT&CK Enterprise techniques. Bagui et al. [93] developed adversarial techniques. Xiong et al. [36] proposed algorithms
an ML-based ATT&CK-oriented big data analysis framework and graph-based mapping to provide insights into certain
for detecting reconnaissance and discovery tactics. Alnafrani attacks, such as MAL file Access Token Manipulation. The
et al. [95] developed an AI-based forensic investigative system, authors proposed a threat modeling language called enterprise-
where authors used ATT&CK to understand potential attacker Lang, which presents a domain-specific language based on the

10
Meta Attack Language (MAL [80]) framework. Here, MAL certain adversary emulation tools including Red or Purple
is directly associated with ATT&CK and leverages TTPs to team tools. Defensive tools are also designed and developed
define attack steps in the language. Hacks et al. [61] proposed considering ATT&CK-based tactics and techniques. Halvorsen
an approach for integrating user actions and security behavior et al. [87] developed the TOMATO (Threat Observability and
to attack simulations by mapping Security Behavior Analysis Monitoring Assessment) tool that can evaluate the observabil-
(SBA) to MAL through ATT&CK techniques. Hemberg et ity of network security monitoring strategies. TOMATO pro-
al. [37] proposed a graph-based linking technique called vides observability scores and monitoring technique efficiency
BRON that links ATT&CK techniques to attack patterns, scores while using ATT&CK-based simulated attacks.
patterns to weaknesses and weaknesses to CVEs. More works, Red Teaming Tools. There are a few open-source ATT&CK
including [46], [57], [100] utilized ATT&CK and graphs for test tools including CALDERA [149], Endgame Red teaming
threat intelligence and modeling. Automation [150], Red Canary Atomic Red [143] and Uber
5) RA-SM-GT: Game Theory: Outkin et al. [123] proposed Metta [151]. These tools have adapted ATT&CK and provided
a game-theoretic framework, called GPLADD, to constantly platforms for red teams to simulate attacks. Each tool features
allocate resources (e.g. to sensing and assessment of attack in- a different set of tactics for penetrating a network and helps
dicators) against an uncertain stream of attacks. The attack data the administrator find out the security weaknesses or entry
used for the evaluation of the framework are from ATT&CK. points. Since ATT&CK itself is always under development,
Nisioti et al. [86] utilized game theory to determine optimal these tools follow the same path, and new features are added
investigating policies after a cyber incident. The proposed on a regular basis.
framework considers the cost for investigating an ATT&CK Purple Teaming Tools. Purple Team ATT&CK Automation
technique and available actions for the investigator with the [152] is another automated adversary tactics emulation plat-
attacker type and anti-forensics techniques being unknown. form that is built on top of the Metasploit framework [153].
Luh et al. [84] proposed a game-theoretic framework, called The platform integrated codes and techniques from ATT&CK,
PenQuest, to support security education and cyber risk as- tools like CALDERA, and libraries like the Atomic Red
sessment by simulating a game whether an attacker attempts Team [143] and RE:TERNAL [154], which is a centralized
to compromise an infrastructure and the defender attempts purple team orchestration service to test blue-team capabilities
to protect it. As in the previous papers, attack data for the against red-team techniques. All included simulations of the
evaluation of PenQuest were drawn from ATT&CK. tool are mapped and aligned to ATT&CK. There are other
ATT&CK-oriented tools as well, which are used for generating
B. RA-I: Implementations detection rules (e.g. sigma rules). For example, S2AN [155]
1) RA-I-TE: Testbeds: Choi et al. [4] outlined vulnera- is a standalone tool that creates an ATT&CK Navigator [142]
bilities and threats for ICS and implemented a testbed to based on a directory containing sigma rules [156] and Suricata
help fix cybersecurity issues by offering a better understand- signatures. Kriaa et al. [42] used the Grakn tool to create
ing of how to mitigate vulnerabilities. The authors set 52 targeted knowledge graphs and query them using the graql
techniques excluding duplicates in ten tactics mapped to 92 language. The authors built a knowledge graph for their
intrusion detection rules using the ATT&CK for Enterprise. proposed approach using ATT&CK, to gather knowledge on
Hong et al. [31] implemented a testbed where a simulated attacks from different sources. This offers capabilities to detect
threat generator automatically generates cyber threats based attack techniques and then learn to predict them by processing
on ATT&CK to help improve the coping ability of system event logs.
security officers in dealing with cyber threats. Here, the threat Appropriate datasets are necessary to aid the community
generator allows for the addition of evolving cyber threats with mapping real data to open source projects such as Sigma,
and the selection of the next threat. Halverson et al. [87] Atomic Red Team, Threat Hunter Playbook, and ATT&CK
developed a testbed to evaluate the effectiveness of their knowledge base. The project entitled Security Datasets [157]
developed tool TOMATO, which uses MITRE ATT&CK to is an open-source dataset collection that facilitates adversary
simulate attacks and evaluate the observability and efficiency emulation, enables security and threat actor analysis and
of a set of deployed monitoring techniques. The approach was adversarial behavior, and provides datasets for Capture-The-
integrated into an ELK stack, and evaluated on real SCADA Flag (CTF) competitions.
devices within the Washington State University smart city
testbed. Most papers that use ATT&CK for offensive security
C. RA-E: Evaluations
or professional training implemented a testbed to deploy the
attack scenarios. For example, Ajmal et al. [54] developed a 1) RA-E-NE: Numeric Evaluation: Al et al. [5] utilized
simulated environment to implement different attack scenarios. hierarchical clustering to investigate the association among
Luh et al. [84] developed a testbed for human experimentation- techniques included in ATT&CK and later discovered 98
based evaluation of their proposed game model. Drašar et different clusters representing these associations. The authors
al. [100] created a small-scale network to emulate various evaluated the mutual information (of the techniques in the
ATT&CK-based attack scenarios. fine-grain clusters, as well as the coarse-grain clusters directly
2) RA-I-TO: Tools: ATT&CK aids adversarial emulation from the datasets) by measuring fine-grain associations (within
and consequent defensive tools that can assess certain attack the same cluster) for APTs using both technique-based and
scenarios. ATT&CK has been used to design and develop cluster-based normalized mutual information (NMI). The max-

11
imum predictability of each technique can be calculated based sequence from initial access to impact follows the pattern of
on its cluster assignment. real-life malware. The authors adopted ATT&CK to design the
Hemberg et al. [37] evaluated their graph model through attack sequence. They confirmed that this model generated
different statistical analyses. The number of edges (links) the actual attack sequence of Triton, which was discovered
is calculated as they connect different ATT&CK techniques, in the Saudi Arabia petrochemical plant. Ampel et al. [30]
patterns, weaknesses, and associated CVEs. By calculating the compared their CVET model against benchmark classical
query times for threats connected to the Top 10 CVEs, threats, machine learning, deep learning, and pre-trained language
and vulnerabilities for the top 25 CWEs and riskiest software, models for text classification tasks to understand how these
the authors measured the relational linkage statistics for tactics, models perform while linking CVEs to ATT&CK. The authors
techniques, and attack patterns over the number of edges in showed that CVET achieves the highest accuracy (76.93%)
the graph. Similarly, the authors measured the counts and and F1-score (76.18%) among the compared models.
distributions of vulnerability connections and affected product
configurations. V. C ONCLUSIONS AND F UTURE D IRECTIONS
Kim et al. [38] provided a severity scoring methodology This paper provides a comprehensive review of research and
for APT-based and fileless cyber attacks and later evaluated industry applications of the MITRE ATT&CK framework
the scores with the cyber kill chain and ATT&CK. The and proposes a taxonomy for categorizing literature that uses
authors evaluated APTs and fileless cyberattacks that occurred ATT&CK. In this section, we will recapitulate the essential
between 2010 and 2020. They calculated scores for the APT points discussed in the preceding sections and delve into con-
groups: powerliks, Rozena, Duqu 2.0, Kovter, Petya, Sore- temporary challenges, constraints and potential future research
brect, WannaCry, Magniber, Emotet and Gandcrab. works associated with ATT&CK.
2) RA-E-HE: Human Evaluation: Hacks et al. [61] inte- Holistic Approach. ATT&CK takes a holistic approach to
grated human behavior analysis to the attack simulations and cybersecurity, covering defensive and offensive techniques.
attempted to calculate probabilities of an attack being success- It provides a comprehensive list of adversary tactics and
ful. Authors conducted surveys where employees would an- techniques used in cyber attacks, making it an essential re-
swer the questionnaire of Security Behavior Analysis and their source for threat intelligence, threat modeling, risk assessment
answers were given as inputs to a vulnerability assessment and offensive security. This approach makes it possible to
tool for conducting attack simulation on an IT infrastructure. understand better the adversary and their tactics, which is
Further, evaluating a model or association by domain experts essential for developing effective defense strategies.
is often helpful. Al et al. [5] recruited six domain experts Open and Community-Driven. ATT&CK is continually up-
with at least five years of experience and knowledge in the dated based on community feedback and contributions. This
area of cyber threat intelligence and ATT&CK. According to collaborative approach ensures that the framework remains up-
the experts, 93% of the fine-grain associations of ATT&CK to-date and relevant, providing organizations with the latest
techniques (within the same cluster) and 90% of the coarse- information on adversary tactics and techniques.
grain associations (inter-cluster) present strong correlations, Common Medium for Knowledge Sharing. ATT&CK pro-
which validates their way of utilizing hierarchical clustering vides a common language for the cybersecurity industry in
techniques. terms of threat intelligence, making it easier for organizations
Oconnor [67] developed a lab (e.g. post-exploit lab) for to communicate and collaborate on cybersecurity. This com-
practicing and improving experiential learning, payloads writ- mon language ensures that everyone is on the same page,
ing, detection evasion, attack functionality, post-exploitation which is essential for effective communication and collabo-
tools development and network traffic manipulation based on ration in the emerging threat landscape.
ATT&CK. The author discussed ethical issues and introduced Wide Coverage. ATT&CK covers a wide range of attack
to the students the Computer and Fraud Abuse Act (CFAA), techniques across different platforms and technologies, includ-
Electronic Communications Privacy Act (ECPA), the Digital ing Windows, Linux and macOS. It also covers ICS, Cloud
Millennium Copyright Act (DCMA) and the corresponding and Mobile platforms. This broad coverage makes it a valuable
university’s acceptable use policy. Last, Luh et al. [84] in- resource for organizations with different IT environments.
volved students to evaluate their proposed game theoretic Mapping to Other Frameworks. As we have seen in the ex-
model for technical education. isting literature, ATT&CK can be mapped to other cybersecu-
3) RA-E-ME: Model Evaluation: Most of the works that rity frameworks, such as the NIST Cybersecurity Framework,
use ATT&CK to develop a threat model, later evaluate it ISO/IEC 27001, COBIT, etc. This mapping provides a way to
based on the reliability in providing security assessments and merge different frameworks to achieve particular needs.
suggesting security settings. For example, Xiong et al. [36] Flexibility. ATT&CK is customizable. It enables organiza-
evaluated enterpriseLang by modeling two attack scenarios: tions to utilize it to their specific needs such as create custom
the Ukraine cyber attack of 2015 and the Cayman National intelligence, threat models, risk assessments and offensive
Bank cyber heist of 2016. The authors used the Enterprise security strategies. This customization makes the framework
ATT&CK matrix as a knowledge base for the proposed more relevant and valuable to specific organizations and in-
language. dustries.
Choi et al. [39] evaluated their Hidden Markov Model-based Even though ATT&CK is a reputed knowledge base of
attack sequence generator by validating whether the attack TTPs, there are a few limitations of it.

12
 Evolving Threat Landscape. The threat landscape constantly With the evolution and improvement of language models
evolves and attackers are constantly developing new TTPs. and chatbots like chatGPT, cyber threat intelligence and mod-
ATT&CK may only sometimes reflect the latest threats and eling have new areas to explore. Overall, emerging technolo-
must be updated regularly to stay current. gies lead to continuously new cyber threats and ATT&CK
Limited Geographical Coverage. ATT&CK is based on is required to be updated on a regular basis. Each of these
observations of attacks that have taken place in the United updates can initiate new research directions for academic
States, Europe and other developed regions. The tactics and researchers and industrial experts.
techniques used by attackers in other parts of the world may We believe that future research and development will benefit
need to be better represented in the framework. from close collaborations between academic and industrial
Focus on Specific Threat Actors. ATT&CK focuses on a researchers. For example, academia can utilize theoretical
limited set of well-known threat actors and may need to fully attack and defense models that involve ATT&CK and then
capture the tactics and techniques used by other, less well- the industry can test their products against these models.
known groups. Likewise, the industry can share data, from the evaluation
Tactical Level. ATT&CK provides a tactical-level view of their products, with academic scholars for fostering novel
of adversary tactics and techniques and does not provide a scientific ideas in the field, which can then feed back to their
comprehensive view of the overall attack lifecycle. products and services.
R EFERENCES
Despite the widespread adoption of ATT&CK for improved
threat mitigation and prevention, there remain a few untapped [1] A. Georgiadou, S. Mouzakitis, and D. Askounis, “Assessing MITRE
ATT&CK risk using a cyber-security culture framework,” Sensors,
scenarios for researchers and developers to contribute to. The vol. 21, no. 9, p. 3267, 2021.
following require answers in future studies. [2] D. J. Bodeau, C. D. McCollum, and D. B. Fox, “Cyber threat modeling:
Survey, assessment, and representative framework,” MITRE CORP
Real-time Threat Intelligence and Incident Response. Real- MCLEAN VA MCLEAN, Tech. Rep., 2018.
time threat intelligence is critical for quickly detecting and [3] M. Bromiley, “SANS 2022 ATT&CK and D3FEND report: Incorpo-
responding to attacks. We find a lack of research that utilizes rating frameworks into your analysis and intelligence,” SANS Institute,
January 2022.
ATT&CK to address these issues. Researchers and experts can [4] S. Choi, J. Choi, J.-H. Yun, B.-G. Min, and H. Kim, “Expansion of ICS
work on developing real-time threat intelligence capabilities testbed for security validation based on MITRE ATT&CK techniques,”
that can leverage ATT&CK to identify and respond to attacks in 13th USENIX Workshop on Cyber Security Experimentation and Test
(CSET), 2020.
more quickly. [5] R. Al-Shaer, J. M. Spring, and E. Christou, “Learning the associations
Risk Quantification. Cyber risk quantification (CRQ) is a of MITRE ATT&CK adversarial techniques,” in 2020 IEEE Conference
major challenge in both fields of cyber research and in the on Communications and Network Security (CNS). IEEE, 2020, pp.
1–9.
progress of industry. Accurate risk assessments are crucial for [6] A. Pennington, A. Applebaum, K. Nickels, T. Schulz, B. Strom, and
ensuring effective spending, as demonstrated by the demands J. Wunder, “Getting started with ATT&CK,” MITRE Corp, McLean,
of Chief Information Security Officers (CISOs). Extended VA, Tech. Rep., 2019.
[7] O. Alexander, M. Belisle, and J. Steele, “MITRE ATT&CK for indus-
research on ATT&CK can address this challenge by incor- trial control systems: Design and philosophy,” MITRE Corporation,
porating CRQ methods that are derived from ATT&CK and Bedford, MA, USA, 2020.
seamlessly integrate threat behaviors and quantitative data [8] CLAROTY, “Supporting the MITRE ATT&CK for ICS framework,”
https://security.claroty.com/white-paper/supporting-mitre-ics, 2021.
from threat intelligence sources, such as threat event frequency [9] Cylance, “How to use the MITRE ATT&CK enterprise framework,”
[158]. Research Desk, https://www.demandtalk.com/whitepaper/it-infra/
how-to-use-the-mitre-attck-enterprise-framework/, October 2019.
Collaboration between Academic and Industrial Research. [10] C. Secure, “Why endpoint security is critical to today’s ciso,” Cisco
ATT&CK provides a platform for academic and industry Public, https://www.cisco.com/c/en/us/products/collateral/security/
stakeholders to showcase the performance of their methods white-paper-c11-744950.pdf, May 2021.
[11] FORTINET, “Assess your endpoint security,” https:
or implement their software and serve their clients. However, //www.fortinet.com/content/dam/fortinet/assets/white-papers/
ongoing revision and expansion of the framework concepts and wp-assess-your-endoint-security.pdf, March 2022.
data are essential to keep up with evolving threat behaviors. [12] ATTACKIQ, “Leveraging MITRE ATT&CK to secure the cloud,” https:
//attackiq.com/lp/leveraging-mitre-attack-to-secure-the-cloud/, 2021.
Integrating industry and academic perspectives through collab- [13] M. Parmar and A. Domingo, “On the use of cyber threat intelligence
oration is crucial in determining the need for new techniques (cti) in support of developing the commander’s understanding of the
or tactics and developing effective mitigation methods against adversary,” in MILCOM 2019-2019 IEEE Military Communications
Conference (MILCOM). IEEE, 2019, pp. 1–6.
newly discovered threat mechanisms or sub-techniques. One [14] D. B. Fox, E. I. Arnoth, C. W. Skorupka, C. D. McCollum, and
way, researchers can reduce the gap is to develop new ideas D. Bodeau, “Enhanced cyber threat model for financial services sector
in academia and evaluate these new frameworks, techniques, (FSS) institutions,” The Homeland Security Systems Engineering and
Development Institute, McLean, VA, USA, 2018.
or workflows in the industry. [15] T. D. Wagner, K. Mahbub, E. Palomar, and A. E. Abdallah, “Cyber
Developing Industry-specific Threat Models. While threat intelligence sharing: Survey and research directions,” Computers
ATT&CK covers a wide range of platforms and technologies, & Security, vol. 87, p. 101589, 2019.
[16] D. Schlette, M. Caselli, and G. Pernul, “A comparative study on cyber
industry-specific threat models can provide a more tailored threat intelligence: The security incident response perspective,” IEEE
approach to identifying and responding to attacks in particular Communications Surveys & Tutorials, vol. 23, no. 4, pp. 2525–2556,
attack scenarios. Researchers and experts can further work 2021.
[17] G. Cascavilla, D. A. Tamburri, and W.-J. Van Den Heuvel, “Cyber-
on developing industry-specific threat models that leverage crime threat intelligence: A systematic multi-vocal literature review,”
ATT&CK. Computers & Security, vol. 105, p. 102258, 2021.

13
[18] A. Ibrahim, D. Thiruvady, J. G. Schneider, and M. Abdelrazek, “The [41] A. P. Golushko and V. G. Zhukov, “Application of advanced persistent
challenges of leveraging threat intelligence to stop data breaches,” threat actorstechniques aor evaluating defensive countermeasures,” in
Frontiers in Computer Science, vol. 2, p. 36, 2020. 2020 IEEE Conference of Russian Young Researchers in Electrical and
[19] A. Dutta and S. Kant, “An overview of cyber threat intelligence Electronic Engineering (EIConRus). IEEE, 2020, pp. 312–317.
platform and role of artificial intelligence and machine learning,” in [42] S. Kriaa and Y. Chaabane, “SecKG: Leveraging attack detection and
International Conference on Information Systems Security. Springer, prediction using knowledge graphs,” in 2021 12th International Con-
2020, pp. 81–86. ference on Information and Communication Systems (ICICS). IEEE,
[20] A. Zibak, C. Sauerwein, and A. C. Simpson, “Threat intelligence qual- 2021, pp. 112–119.
ity dimensions for research and practice,” Digital Threats: Research [43] R. Kwon, T. Ashley, J. Castleberry, P. Mckenzie, and S. N. G.
and Practice, 2022. Gourisetti, “Cyber threat dictionary using MITRE ATT&CK matrix
[21] M. S. Abu, S. R. Selamat, A. Ariffin, and R. Yusof, “Cyber threat and NIST cybersecurity framework mapping,” in 2020 Resilience Week
intelligence–issue and challenges,” Indonesian Journal of Electrical (RWS). IEEE, 2020, pp. 106–112.
Engineering and Computer Science, vol. 10, no. 1, pp. 371–379, 2018. [44] S. Bromander, M. Swimmer, M. Eian, G. Skjotskift, and F. Borg,
[22] W. Tounsi and H. Rais, “A survey on technical threat intelligence in “Modeling cyber threat intelligence.” in ICISSP, 2020, pp. 273–280.
the age of sophisticated cyber attacks,” Computers & security, vol. 72, [45] V. Legoy, M. Caselli, C. Seifert, and A. Peter, “Automated retrieval
pp. 212–233, 2018. of ATT&CK tactics and techniques for cyber threat reports,” arXiv
[23] V. Mavroeidis and S. Bromander, “Cyber threat intelligence model: preprint arXiv:2004.14322, 2020.
an evaluation of taxonomies, sharing standards, and ontologies within [46] J. Fairbanks, A. Orbe, C. Patterson, E. Serra, and M. Scheepers,
cyber threat intelligence,” in 2017 European Intelligence and Security “Att&ck tactics in android malware control flow graph through graph
Informatics Conference (EISIC). IEEE, 2017, pp. 91–98. representation learning and interpretability.” in Proceedings of the 2021
[24] R. Brown and R. M. Lee, “2021 SANS cyber threat intelligence IEEE International Conference on Big Data (REU 2021 Symposium),
survey,” in Tech. Rep. SANS Institute, 2021. 2021.
[25] ——, “The evolution of cyber threat intelligence (CTI): 2019 SANS [47] Y.-T. Huang, C. Y. Lin, Y.-R. Guo, K.-C. Lo, Y. S. Sun, and M. C.
CTI survey,” SANS Institute. Available online: https:// www.sans.org/ Chen, “Open source intelligence for malicious behavior discovery
white-papers/ 38790/ , Accessed on July 12, 2021., 2019. and interpretation,” IEEE Transactions on Dependable and Secure
[26] D. Shackleford, “Cyber threat intelligence uses, successes and failures: Computing, 2021.
The SANS 2017 CTI survey,” SANS Institute, 2017. [48] K. Kurniawan, A. Ekelhart, and E. Kiesling, “An att&ck-kg for linking
[27] D. Tayouri, N. Baum, A. Shabtai, and R. Puzis, “A survey of mulval cybersecurity attacks to adversary tactics and techniques,” 2021.
extensions and their attack scenarios coverage,” IEEE Access, 2023. [49] Y. Lakhdhar and S. Rekhis, “Machine learning based approach for the
[28] L. Sadlek, P. Čeleda, and D. Tovarňák, “Current challenges of cyber automated mapping of discovered vulnerabilities to adversial tactics,”
threat and vulnerability identification using public enumerations,” in in 2021 IEEE Security and Privacy Workshops (SPW). IEEE, 2021,
Proceedings of the 17th International Conference on Availability, pp. 309–317.
Reliability and Security, 2022, pp. 1–8.
[50] G. Lee, S. Shim, B. Cho, T. Kim, and K. Kim, “Fileless cyberattacks:
[29] M. K. Ahn and J. R. Lee, “Research on system architecture and
Analysis and classification,” ETRI Journal, vol. 43, no. 2, pp. 332–343,
methodology based on MITRE ATT&CK for experiment analysis on
2021.
cyber warfare simulation,” Journal of the Korea Society of Computer
[51] O. Mendsaikhan, H. Hasegawa, Y. Yamaguchi, and H. Shimada, “Au-
and Information, vol. 25, no. 8, pp. 31–37, 2020.
tomatic mapping of vulnerability information to adversary techniques,”
[30] B. Ampel, S. Samtani, S. Ullman, and H. Chen, “Linking common
in The Fourteenth International Conference on Emerging Security
vulnerabilities and exposures to the MITRE ATT&CK framework: A
Information, Systems and Technologies SECUREWARE2020, 2020.
self-distillation approach,” arXiv preprint arXiv:2108.01696, 2021.
[52] M. D. Purba, B. Chu, and E. Al-Shaer, “From word embedding
[31] S. Hong, K. Kim, and T. Kim, “The design and implementation
to cyber-phrase embedding: Comparison of processing cybersecurity
of simulated threat generator based on MITRE ATT&CK for cyber
texts,” in 2020 IEEE International Conference on Intelligence and
warfare training,” Journal of the Korea Institute of Military Science
Security Informatics (ISI). IEEE, 2020, pp. 1–6.
and Technology, vol. 22, no. 6, pp. 797–805, 2019.
[32] A. Kuppa, L. Aouad, and N.-A. Le-Khac, “Linking CVE’s to MITRE [53] E. Aghaei and E. Al-Shaer, “Threatzoom: neural network for automated
ATT&CK techniques,” in The 16th International Conference on Avail- vulnerability mitigation,” in Proceedings of the 6th Annual Symposium
ability, Reliability and Security, 2021, pp. 1–12. on Hot Topics in the Science of Security, 2019, pp. 1–3.
[33] N. Munaiah, A. Rahman, J. Pelletier, L. Williams, and A. Meneely, [54] A. B. Ajmal, M. A. Shah, C. Maple, M. N. Asghar, and S. U. Islam,
“Characterizing attacker behavior in a cybersecurity penetration testing “Offensive security: Towards proactive threat hunting via adversary
competition,” in 2019 ACM/IEEE International Symposium on Empir- emulation,” IEEE Access, vol. 9, pp. 126 023–126 033, 2021.
ical Software Engineering and Measurement (ESEM). IEEE, 2019, [55] A. Brazhuk, “Towards automation of threat modeling based on a
pp. 1–6. semantic model of attack patterns and weaknesses,” arXiv preprint
[34] A. V. Outkin, P. V. Schulz, T. Schulz, T. D. Tarman, and A. Pinar, arXiv:2112.04231, 2021.
“Defender policy evaluation and resource allocation using MITRE [56] A. Elitzur, R. Puzis, and P. Zilberman, “Attack hypothesis generation,”
ATT&CK evaluations data,” arXiv preprint arXiv:2107.04075, 2021. in 2019 European Intelligence and Security Informatics Conference
[35] R. Pell, S. Moschoyiannis, E. Panaousis, and R. Heartfield, “Towards (EISIC). IEEE, 2019, pp. 40–47.
dynamic threat modelling in 5g core networks based on MITRE [57] J. Fairbanks, A. Orbe, C. Patterson, J. Layne, E. Serra, and M. Scheep-
att&ck,” arXiv preprint arXiv:2108.11206, 2021. ers, “Identifying ATT&CK tactics in android malware control flow
[36] W. Xiong, E. Legrand, O. Åberg, and R. Lagerström, “Cyber security graph through graph representation learning and interpretability,” in
threat modeling based on the MITRE enterprise ATT&CK matrix,” 2021 IEEE International Conference on Big Data (Big Data). IEEE,
Software and Systems Modeling, pp. 1–21, 2021. 2021, pp. 5602–5608.
[37] E. Hemberg, J. Kelly, M. Shlapentokh-Rothman, B. Reinstadler, [58] L. Franklin, M. Pirrung, L. Blaha, M. Dowling, and M. Feng, “Toward
K. Xu, N. Rutar, and U.-M. O’Reilly, “Linking threat tactics, tech- a visualization-supported workflow for cyber alert management using
niques, and patterns with defensive weaknesses, vulnerabilities and threat models and human-centered design,” in 2017 IEEE Symposium
affected platform configurations for cyber hunting,” arXiv preprint on Visualization for Cyber Security (VizSec). IEEE, 2017, pp. 1–8.
arXiv:2010.00533, 2020. [59] S. N. G. Gourisetti, M. Mylrea, T. Ashley, R. Kwon, J. Castleberry,
[38] K. Kim, F. A. Alfouzan, and H. Kim, “Cyber-attack scoring model Q. Wright-Mockler, P. McKenzie, and G. Brege, “Demonstration of
based on the offensive cybersecurity framework,” Applied Sciences, the cybersecurity framework through real-world cyber attack,” in 2019
vol. 11, no. 16, p. 7738, 2021. Resilience Week (RWS), vol. 1. IEEE, 2019, pp. 19–25.
[39] S. Choi, J.-H. Yun, and B.-G. Min, “Probabilistic attack sequence [60] A. Gylling, M. Ekstedt, Z. Afzal, and P. Eliasson, “Mapping cyber
generation and execution based on MITRE ATT&CK for ics datasets,” threat intelligence to probabilistic attack graphs,” in 2021 IEEE Inter-
in Cyber Security Experimentation and Test Workshop, 2021, pp. 41– national Conference on Cyber Security and Resilience (CSR). IEEE,
48. 2021, pp. 304–311.
[40] S. Arshad, M. Alam, S. Al-Kuwari, and M. H. A. Khan, “Attack spec- [61] S. Hacks, I. Butun, R. Lagerström, A. Buhaiu, A. Georgiadou, and
ification language: Domain specific language for dynamic training in A. Michalitsi Psarrou, “Integrating security behavior into attack simula-
cyber range,” in 2021 IEEE Global Engineering Education Conference tions,” in The 16th International Conference on Availability, Reliability
(EDUCON). IEEE, 2021, pp. 873–879. and Security, 2021, pp. 1–13.

14
[62] S. Hacks, L. Persson, and N. Hersén, “Measuring and achieving test [84] R. Luh, S. Eresheim, S. Größbacher, T. Petelin, F. Mayr, P. Tavolato,
coverage of attack simulations extended version,” Software and Systems and S. Schrittwieser, “PenQuest reloaded: A digital cyber defense game
Modeling, pp. 1–16, 2022. for technical education,” in 2022 IEEE Global Engineering Education
[63] A. Hassanzadeh and R. Burkett, “SAMIIT: Spiral attack model in IIoT Conference (EDUCON). IEEE, 2022, pp. 906–914.
mapping security alerts to attack life cycle phases,” in 5th International [85] G. Husari, E. Al-Shaer, B. Chu, and R. F. Rahman, “Learning APT
Symposium for ICS & SCADA Cyber Security Research 2018 5, 2018, chains from cyber threat intelligence,” in Proceedings of the 6th Annual
pp. 11–20. Symposium on Hot Topics in the Science of Security, 2019, pp. 1–2.
[64] M. Ahmed, S. Panda, C. Xenakis, and E. Panaousis, “MITRE [86] A. Nisioti, G. Loukas, S. Rass, and E. Panaousis, “Game-theoretic
ATT&CK-driven cyber risk assessment,” in Proceedings of the 17th decision support for cyber forensic investigations,” Sensors, vol. 21,
International Conference on Availability, Reliability and Security, no. 16, p. 5300, 2021.
2022, pp. 1–10. [87] J. Halvorsen, J. Waite, and A. Hahn, “Evaluating the observability of
[65] V. Bolbot, S. Basnet, H. Zhao, O. V. Banda, and B. Silverajan, network security monitoring strategies with TOMATO,” IEEE Access,
“Investigating a novel approach for cybersecurity risk analysis with vol. 7, pp. 108 304–108 315, 2019.
application to remote pilotage operations,” in European Workshop on [88] A. Y. Wong, E. G. Chekole, M. Ochoa, and J. Zhou, “Threat mod-
Maritime Systems Resilience and Security, 2022. eling and security analysis of containers: A survey,” arXiv preprint
[66] A. Oruc, A. Amro, and V. Gkioulos, “Assessing cyber risks of an INS arXiv:2111.11475, 2021.
using the MITRE ATT&CK framework,” Sensors, vol. 22, no. 22, p. [89] N. Dhir, H. Hoeltgebaum, N. Adams, M. Briers, A. Burke, and P. Jones,
8745, 2022. “Prospective artificial intelligence approaches for active cyber defence,”
[67] T. OConnor, “Helo darkside: Breaking free from katas and embracing arXiv preprint arXiv:2104.09981, 2021.
the adversarial mindset in cybersecurity education,” in Proceedings of [90] E. Holder and N. Wang, “Explainable artificial intelligence (XAI)
the 53rd ACM Technical Symposium on Computer Science Education interactively working with humans as a junior cyber analyst,” Human-
V. 1, 2022, pp. 710–716. Intelligent Systems Integration, vol. 3, no. 2, pp. 139–153, 2021.
[68] D. Kim, Y. Kim, M.-K. Ahn, and H. Lee, “Automated cyber threat [91] G. Ahn, K. Kim, W. Park, and D. Shin, “Malicious file detec-
emulation based on ATT&CK for cyber security training,” Journal of tion method using machine learning and interworking with MITRE
the Korea Society of Computer and Information, vol. 25, no. 9, pp. ATT&CK framework,” Applied Sciences, vol. 12, no. 21, p. 10761,
71–80, 2020. 2022.
[69] S. P. Rao, H.-Y. Chen, and T. Aura, “Threat modeling framework for [92] R. Stoleriu, A. Puncioiu, and I. Bica, “Cyber attacks detection using
mobile communication systems,” Computers & Security, vol. 125, p. open source ELK stack,” in 2021 13th International Conference on
103047, 2023. Electronics, Computers and Artificial Intelligence (ECAI). IEEE, 2021,
[70] C. K. Chen, S. C. Lin, S. C. Huang, Y. T. Chu, C. L. Lei, and C. Y. pp. 1–6.
Huang, “Building machine learning-based threat hunting system from [93] S. Bagui, D. Mink, S. Bagui, T. Ghosh, T. McElroy, E. Paredes,
scratch,” Digital Threats: Research and Practice, 2022. N. Khasnavis, and R. Plenkers, “Detecting reconnaissance and discov-
[71] C. Adam, M. F. Bulut, D. Sow, S. Ocepek, C. Bedell, and L. Ngweta, ery tactics from the MITRE ATT&CK framework in Zeek Conn Logs
“Attack techniques and threat identification for vulnerabilities,” arXiv using Spark’s machine learning in the big data framework,” Sensors,
preprint arXiv:2206.11171, 2022. vol. 22, no. 20, p. 7999, 2022.
[72] L. Sadlek, P. Čeleda, and D. Tovarňák, “Identification of attack paths [94] S. Zurowski, G. Lord, and I. Baggili, “A quantitative analysis of
using kill chain and attack graphs,” in 2022-2022 IEEE/IFIP Network offensive cyber operation (OCO) automation tools,” in Proceedings
Operations and Management Symposium (NOMS). IEEE, 2022, pp. of the 17th International Conference on Availability, Reliability and
1–6. Security, 2022, pp. 1–11.
[73] Z. Jadidi and Y. Lu, “A threat hunting framework for industrial control [95] R. Alnafrani and D. Wijesekera, “AIFIS: Artificial intelligence (AI)-
systems,” IEEE Access, vol. 9, pp. 164 118–164 130, 2021. based forensic investigative system,” in 2022 10th International Sym-
[74] M. Mundt and H. Baier, “Towards mitigation of data exfiltration posium on Digital Forensics and Security (ISDFS). IEEE, 2022, pp.
techniques using the MITRE ATT&CK framework,” in International 1–6.
Conference on Digital Forensics and Cyber Crime. Springer, 2022, [96] S. Samtani, H. Chen, M. Kantarcioglu, and B. Thuraisingham, “Ex-
pp. 139–158. plainable artificial intelligence for cyber threat intelligence (XAI-CTI),”
[75] A. Niakanlahiji, J. Wei, and B.-T. Chu, “A natural language processing IEEE Transactions on Dependable and Secure Computing, vol. 19,
based trend analysis of advanced persistent threat techniques,” in 2018 no. 04, pp. 2149–2150, 2022.
IEEE International Conference on Big Data (Big Data). IEEE, 2018, [97] O. Grigorescu, A. Nica, M. Dascalu, and R. Rughinis,
pp. 2995–3000. “CVE2ATT&CK: BERT-based mapping of CVEs to MITRE
[76] G. Ayoade, S. Chandra, L. Khan, K. Hamlen, and B. Thuraisingham, ATT&CK techniques,” Algorithms, vol. 15, no. 9, p. 314, 2022.
“Automated threat report classification over multi-source data,” in 2018 [98] K. Hasan, S. Shetty, and S. Ullah, “Artificial intelligence empowered
IEEE 4th International Conference on Collaboration and Internet cyber threat detection and protection for power utilities,” in 2019 IEEE
Computing (CIC). IEEE, 2018, pp. 236–245. 5th International Conference on Collaboration and Internet Computing
[77] P. Karuna, E. Hemberg, U. M. O’Reilly, and N. Rutar, “Automating (CIC). IEEE, 2019, pp. 354–359.
cyber threat hunting using NLP, automated query generation, and [99] F. Maymı́, R. Bixler, R. Jones, and S. Lathrop, “Towards a definition
genetic perturbation,” arXiv preprint arXiv:2104.11576, 2021. of cyberspace tactics, techniques and procedures,” in 2017 IEEE
[78] Y. Shin, K. Kim, J. J. Lee, and K. Lee, “Art: Automated reclassification International Conference on Big Data (Big Data). IEEE, 2017, pp.
for threat actors based on ATT&CK matrix similarity,” in 2021 World 4674–4679.
Automation Congress (WAC). IEEE, 2021, pp. 15–20. [100] M. Drašar, S. Moskal, S. Yang, and P. Zat’ko, “Session-level adver-
[79] T. He and Z. Li, “A model and method of information system security sary intent-driven cyberattack simulator,” in 2020 IEEE/ACM 24th
risk assessment based on MITRE ATT&CK,” in 2021 2nd International International Symposium on Distributed Simulation and Real Time
Conference on Electronics, Communications and Information Technol- Applications (DS-RT). IEEE, 2020, pp. 1–9.
ogy (CECIT). IEEE, 2021, pp. 81–86. [101] H. Kim, H. Kim et al., “Comparative experiment on TTP classification
[80] P. Johnson, R. Lagerström, and M. Ekstedt, “A meta language for threat with class imbalance using oversampling from CTI dataset,” Security
modeling and attack simulations,” in Proceedings of the 13th Interna- and Communication Networks, vol. 2022, 2022.
tional Conference on Availability, Reliability and Security, 2018, pp. [102] K. Kim, Y. Shin, J. Lee, and K. Lee, “Automatically attributing mobile
1–8. threat actors by vectorized ATT&CK matrix and paired indicator,”
[81] H. Manocha, A. Srivastava, C. Verma, R. Gupta, and B. Bansal, Sensors, vol. 21, no. 19, p. 6522, 2021.
“Security assessment rating framework for enterprises using MITRE [103] I. K. Sahu and M. J. Nene, “Model for IaaS security model: MISP
ATT&CK matrix,” arXiv preprint arXiv:2108.06559, 2021. framework,” in 2021 International Conference on Intelligent Technolo-
[82] D. Mashima, “MITRE ATT&CK based evaluation on in-network gies (CONIT). IEEE, 2021, pp. 1–6.
deception technology for modernized electrical substation systems,” [104] T. Zhao, T. E. Gasiba, U. Lechner, and M. Pinto-Albuquerque, “Explor-
Sustainability, vol. 14, no. 3, p. 1256, 2022. ing a board game to improve cloud security training in industry (short
[83] L. L. Dhirani, E. Armstrong, and T. Newe, “Industrial iot, cyber threats, paper),” in Second International Computer Programming Education
and standards landscape: evaluation and roadmap,” Sensors, vol. 21, Conference (ICPEC 2021). Schloss Dagstuhl-Leibniz-Zentrum für
no. 11, p. 3901, 2021. Informatik, 2021.

15
[105] T. Zhao, U. Lechner, M. Pinto-Albuquerque, and E. Ata, “Cloud of [129] N. Naik, P. Jenkins, P. Grace, and J. Song, “Comparing attack models
assets and threats: A playful method to raise awareness for cloud for it systems: Lockheed martin’s cyber kill chain, mitre att&ck frame-
security in industry,” OpenAccess Series in Informatics, 2022. work and diamond model,” in 2022 IEEE International Symposium on
[106] G. van der Merwe, C. Muller, W. van der Merwe, and D. Blaauw, Systems Engineering (ISSE). IEEE, 2022, pp. 1–7.
“Identifying adversaries’ signatures using knowledge representations [130] J. Straub, “Modeling attack, defense and threat trees and the cyber
of cyberattack techniques on cloud infrastructure,” in International kill chain, att&ck and stride frameworks as blackboard architecture
Conference on Cyber Warfare and Security, vol. 17, no. 1, 2022, pp. networks,” in 2020 IEEE International Conference on Smart Cloud
333–339. (SmartCloud). IEEE, 2020, pp. 148–153.
[107] S. Zhang, P. Chen, G. Bai, S. Wang, M. Zhang, S. Li, and C. Zhao, [131] T. C. for Threat-Informed Defense, “Security stack
“An automatic assessment method of cyber threat intelligence com- mappings,” https://github.com/center-for-threat-informed-defense/
bined with ATT&CK matrix,” Wireless Communications and Mobile security-stack-mappings, 2022, (Accessed on 16/12/2022).
Computing, vol. 2022, 2022. [132] S. Barnum, “Standardizing cyber threat intelligence information with
[108] M. Odemis, C. Yucel, and A. Koltuksuz, “Detecting user behavior in the structured threat information expression (STIX),” MITRE Corpo-
cyber threat intelligence: development of Honeypsy system,” Security ration, vol. 11, pp. 1–22, 2012.
and Communication Networks, vol. 2022, 2022. [133] R. Stillions, “The DML model,” http://ryanstillions.blogspot.com/2014/
[109] Y. Jo, O. Choi, J. You, Y. Cha, and D. H. Lee, “Cyberattack models for 04/the-dml-model 21.html, (Accessed on 10/05/2022).
ship equipment based on the MITRE ATT&CK framework,” Sensors, [134] S. Caltagirone, A. Pendergast, and C. Betz, “The diamond model of
vol. 22, no. 5, p. 1860, 2022. intrusion analysis,” Center For Cyber Intelligence Analysis and Threat
[110] R. C. D. Centre, “DeTTECT,” https://github.com/rabobank-cdc/ Research, Hanover, MD, Tech. Rep., 2013.
DeTTECT, 2022, (Accessed on 16/12/2022). [135] F. Cybersecurity, “Facility cybersecurity framework,”
[111] “DeTT&CT: Mapping detection to MITRE ATT&CK,” https://facilitycyber.labworks.org, 2022, (Accessed on 16/12/2022).
NVISO Labs, https://blog.nviso.eu/2022/03/09/ [136] K. A. Akbar, S. M. Halim, Y. Hu, A. Singhal, L. Khan, and B. Thurais-
dettct-mapping-detection-to-mitre-attck/, March 2022, (Accessed ingham, “Knowledge mining in cybersecurity: From attack to defense,”
on 09/21/2022). in IFIP Annual Conference on Data and Applications Security and
[112] A. Roberts, “Structured intelligence–what does it even mean?” in Cyber Privacy. Springer, 2022, pp. 110–122.
Threat Intelligence. Springer, 2021, pp. 37–64. [137] “D3fend matrix — MITRE d3fend™,” https://d3fend.mitre.org/, (Ac-
[113] H. M. Farooq and N. M. Otaibi, “Optimal machine learning algorithms cessed on 07/21/2022).
for cyber threat detection,” in 2018 UKSim-AMSS 20th International [138] A. Wolf, D. Simopoulos, L. D’Avino, and P. Schwaiger, “The pasta
Conference on Computer Modelling and Simulation (UKSim). IEEE, threat model implementation in the iot development life cycle,” IN-
2018, pp. 32–37. FORMATIK 2020, 2021.
[114] A. R. Sharma, “How MITRE ATT&CK alignment supercharges [139] F. Mottini, “Osquery-ATT&CK,” https://github.com/teoseller/
your SIEM,” Securonix, https://www.securonix.com/blog/ osquery-attck, 2022, (Accessed on 16/12/2022).
how-mitre-attck-alignment-supercharges-your-siem, (Accessed [140] Osquery, “Osquery,” https://github.com/osquery/osquery, 2022, (Ac-
on 10/19/2022). cessed on 16/12/2022).
[115] K. Sadrazamis, “MITRE ATT&CK-based analysis of cyber-attacks in [141] “osquery: Easily ask questions about your Linux, Windows, and macOS
intelligent transportation,” 2022. infrastructure,” https://osquery.io/, (Accessed on 09/21/2022).
[116] A. Amro, V. Gkioulos, and S. Katsikas, “Assessing cyber risk in cyber- [142] MITRE Corporation, “MITRE ATT&CK navigator,”
physical systems using the att&ck framework,” ACM Transactions on https://mitre-attack.github.io/attack-navigator/, 2021, (Accessed
Privacy and Security, vol. 26, no. 2, pp. 1–33, 2023. on 16/12/2022).
[117] H. I. Kure, S. Islam, and H. Mouratidis, “An integrated cyber secu- [143] Red Canary, “Atomic red team,” https://github.com/redcanaryco/
rity risk management framework and risk predication for the critical atomic-red-team, 2019, [Online; accessed 16-December-2022].
infrastructure protection,” Neural Computing and Applications, pp. 1– [144] E. Hemberg and U.-M. O’Reilly, “Using a collated cybersecurity
31, 2022. dataset for machine learning and artificial intelligence,” arXiv preprint
[118] TLP.White, “Risk and vulnerability assessment (RVA) arXiv:2108.02618, 2021.
mapped to the MITRE ATT&CK framework infographic,” [145] C. Liu, J. Wang, and X. Chen, “Threat intelligence ATT&CK extrac-
https://www.cisa.gov/sites/default/files/publications/FY19 RVAs tion based on the attention transformer hierarchical recurrent neural
Mapped to the MITRE ATTCK Framework 508.pdf, (Accessed on network,” Applied Soft Computing, vol. 122, p. 108826, 2022.
11/06/2022). [146] M. Otgonpurev, “Effective application of natural language processing
[119] ——, “RVAs mapped to the MITRE ATT&CK framework,” techniques in automated cyber threat intelligence,” 2021.
https://irp.cdn-website.com/9a5fc83f/files/uploaded/FY20 [147] E. Domschot, “Automated labeling of MITRE ATT&CK tactics and
RVAs Mapped to the MITRE ATTCK Framework 508 techniques in malware threat reports,” Ph.D. dissertation, New Mexico
QVzrjj9OT2e6JWUkrOAu.pdf, (Accessed on 11/06/2022). Institute of Mining and Technology, 2022.
[120] GRANTEK, “RVAs mapped to the MITRE ATT&CK [148] L. Evensjö, “Probability analysis and financial model development of
framework,” https://grantek.com/wp-content/uploads/2020/04/ MITRE ATT&CK enterprise matrix’s attack steps and mitigations,”
2020CybersecurityWP.pdf, April 2020. 2020.
[121] AttackIQ, “The CISO’s guide to better vulnerability management us- [149] MITRE Corporation, “Caldera,” https://github.com/mitre/caldera, 2022,
ing MITRE ATT&CK,” https://www.attackiq.com/wp-content/uploads/ (Accessed on 16/12/2022).
2021/12/90398r72vt8w.pdf, December 2021. [150] Endgame, “Red team automation,” https://github.com/endgameinc/
[122] W. Xiong, E. Legrand, O. Åberg, and R. Lagerström, “Cyber security RTA, 2022, (Accessed on 16/12/2022).
threat modeling based on the MITRE Enterprise ATT&CK matrix,” [151] U. Common, “Metta,” https://github.com/uber-common/metta, 2018,
Software and Systems Modeling, vol. 21, no. 1, pp. 157–177, 2022. [Online; accessed 16-December-2022].
[123] A. V. Outkin, P. V. Schulz, T. Schulz, T. D. Tarman, and A. Pinar, [152] Praetorian, “Purple team ATT&CK™ automation,” https://github.com/
“Defender policy evaluation and resource allocation with MITRE praetorian-inc/purple-team-attack-automation, 2020, (Online; accessed
ATT&CK evaluations data,” IEEE Transactions on Dependable and 16-December-2022).
Secure Computing, 2022. [153] Rapid7, “The Metasploit Framework,” https://github.com/rapid7/
[124] H. Y. Chen and S. P. Rao, “On adoptability and use case exploration of metasploit-framework, 2020, (Accessed on 16/12/2022).
threat modeling for mobile communication systems,” in Proceedings of [154] J. Dreijer, “RE:TERNAL,” https://github.com/d3vzer0/
the 2021 ACM SIGSAC Conference on Computer and Communications reternal-quickstart, 2020, (Accessed on 16/12/2022).
Security, 2021, pp. 2417–2419. [155] 3CORESec, “S2AN,” https://github.com/3CORESec/S2AN, 2021, [On-
[125] MITRE Corporation, “FiGHT (5G hierarchy of threats),” https://fight. line; accessed 16-December-2022].
mitre.org, 2022, (Online; accessed 16-December-2022). [156] SigmaHQ, “Sigma,” https://github.com/SigmaHQ/sigma, 2022, (Ac-
[126] ——, “MITRE ATT&CK,” https://attack.mitre.org, 2015-2022, (On- cessed on 16/12/2022).
line; accessed 16-December-2022). [157] O. T. R. Forge, “Security Datasets,” https://github.com/OTRF/
[127] M. S. Barnum, “Common attack pattern enumeration and classification Security-Datasets, 2022, (Accessed on 16/12/2022).
(capec) schema,” Department of Homeland Security, 2008. [158] J. Freund and J. Jones, Measuring and managing information risk: a
[128] MITRE Corporation, “Common Weakness Enumeration,” https://cwe. FAIR approach. Butterworth-Heinemann, 2014.
mitre.org, 2022, (Accessed on 16/12/2022).

16