SoK: An empirical investigation of malware techniques in advanced persistent threat attacks

Context:

Adversaries launch advanced persistent threat (APT) attacks, where adversaries design their attack for a specific target and aim to remain undetected for a prolonged time. The attackers deploy a plethora of techniques for delivering and operating multiple malware in manual or automated manners. Cybersecurity vendors publish technical reports, known as cyberthreat intelligence reports, on past APT attacks, a rich information source on malware techniques. To defend organizations, prevalent techniques observed across malware in APT attacks and their association need to be identified.

Objective:

The goal of this research is to aid cybersecurity practitioners in defending against APT attacks by analyzing malware techniques documented in cyberthreat intelligence reports.

Methodology:

We construct a curated set of 798 cyberthreat intelligence reports and then analyze the reported malware techniques using MITRE ATT&CK, a well-known terminology of cyberattack techniques, cybercriminal groups, and campaigns in APT attacks. We analyze the frequency and trend of techniques, followed by a qualitative analysis. Next, we perform association rule mining to identify co-occurring techniques, followed by a qualitative analysis.

Findings:

We identify that obtaining information on the operating and network system of the victim environment is the most prevalent technique and appears in the highest number of co-occurring pairs. We identify that spear-phishing is the most prevalent way of initial infection. We also identify three prevalent misuses of system functionalities: Macros in Office documents, the Registry in Windows, and the Task scheduler. We advocate that organizations prioritize their defense against the identified prevalent techniques and actively hunt for potential malicious intrusions based on the identified association among malware techniques.