Near real-time analysis of tactics techniques and procedures of attacker groups on their relevancy to an Organisation

Cyber threat intelligence provides insight into threats and threat actor behaviors that would be valuable in preventing potential cyber-attacks. With rapidly developing malicious technologies, APT groups are becoming stronger than ever. Therefore it is an absolute necessity for organizations to prepare their security strategy tailored to these attacker groups. Even though there are some solutions and frameworks provided by existing literature on fighting these threat actors, an organization-specific solution is not available. Therefore this paper provides a deep dive into the development of a novel framework that identifies specific attacker groups that can focus on a particular organization. It also provides capabilities to prioritize existing techniques presented by the MITRE framework, according to the specifications of an organization. This innovative solution facilitates security professionals with the opportunity to find the gaps in the organizational security strategy from the perspective of an attacker. The framework is semi-automated and implemented on test cases and observed the different groups that are relevant to different organizations. Furthermore, the findings showed that most groups focus on the same techniques to infiltrate an organization. Therefore organizations can use this framework when dealing with APT groups and utilize their resources and time more efficiently.