Análise da Recorrência de Técnicas e Táticas do MITRE ATT&CK em Relatórios Públicos de Threat Intelligence
Resumo
A crescente necessidade de compreender comportamentos adversários tem impulsionado a análise automatizada de relatórios de Threat Intelligence. Este trabalho propõe uma abordagem para identificar e analisar a recorrência de técnicas e táticas do MITRE ATT&CK em relatórios públicos de CTI. A metodologia combina extração textual, identificação de técnicas e associação aos catálogos oficiais do framework, permitindo estruturar informações não padronizadas para análise de frequência e de distribuição temporal. A abordagem foi aplicada a um corpus de relatórios públicos, com o objetivo de caracterizar padrões recorrentes de comportamento adversário.
Referências
Al-Sada, B., Sadighian, A., and Oligeri, G. (2023). Mitre att&ck: State of the art and way forward.
Caxias, C. and Santana, B. (2026). Mapeamento e detecção de indicadores de comprometimento em relatórios de threat intelligence. In Anais Estendidos do XXVI Simpósio Brasileiro de Cibersegurança, pages 532–542, Porto Alegre, RS, Brasil. SBC.
Huang, Y.-T., Vaitheeshwari, R., Chen, M.-C., Lin, Y.-D., Hwang, R.-H., Lin, P.-C., Lai, Y.-C., Wu, E. H.-K., Chen, C.-H., Liao, Z.-J., and Chen, C.-K. (2024). Mitretrieval: Retrieving mitre techniques from unstructured threat reports by fusion of deep learning and ontology. IEEE Transactions on Network and Service Management, 21(4):4871–4887.
Johnson, C., Badger, M., Waltermire, D., Snyder, J., and Skorupka, C. (2016). Guide to cyber threat information sharing. Technical Report NIST Special Publication 800-150, National Institute of Standards and Technology, Gaithersburg, MD.
Legoy, V., Caselli, M., Seifert, C., and Peter, A. (2020). Automated retrieval of att&ck tactics and techniques for cyber threat reports.
Liu, C., Wang, J., and Chen, X. (2022). Threat intelligence att&ck extraction based on the attention transformer hierarchical recurrent neural network. Applied Soft Computing, 122:108826.
Rahman, F. I., Halim, S. M., Singhal, A., and Khan, L. (2024). Alert: A framework for efficient extraction of attack techniques from cyber threat intelligence reports using active learning. In Ferrara, A. L. and Krishnan, R., editors, Data and Applications Security and Privacy XXXVIII, pages 203–220, Cham. Springer Nature Switzerland.
Rahman, M. R., Wroblewski, B., Matthews, Q., Morgan, B., Menzies, T., and Williams, L. (2025). Mining temporal attack patterns from cyberthreat intelligence reports. Knowledge and Information Systems, 67(10):8941–8981.
Rani, N., Saha, B., Maurya, V., and Shukla, S. K. (2023). Ttphunter: Automated extraction of actionable intelligence as ttps from narrative threat reports. In Proceedings of the 2023 Australasian Computer Science Week, ACSW ’23, page 126–134, New York, NY, USA. Association for Computing Machinery.
Strom, B. E., Applebaum, A., Miller, D. P., Nickels, K. C., Pennington, A. G., and Thomas, C. B. (2020). Mitre att&ck®: Design and philosophy. Technical Report MP180360R1, The MITRE Corporation, McLean, VA.
Tamanna, M., Mitra, S., Erfan, M., Ryan, A., Mittal, S., Williams, L., and Rahman, M. R. (2026). What are adversaries doing? automating tactics, techniques, and procedures extraction: A systematic review.
Caxias, C. and Santana, B. (2026). Mapeamento e detecção de indicadores de comprometimento em relatórios de threat intelligence. In Anais Estendidos do XXVI Simpósio Brasileiro de Cibersegurança, pages 532–542, Porto Alegre, RS, Brasil. SBC.
Huang, Y.-T., Vaitheeshwari, R., Chen, M.-C., Lin, Y.-D., Hwang, R.-H., Lin, P.-C., Lai, Y.-C., Wu, E. H.-K., Chen, C.-H., Liao, Z.-J., and Chen, C.-K. (2024). Mitretrieval: Retrieving mitre techniques from unstructured threat reports by fusion of deep learning and ontology. IEEE Transactions on Network and Service Management, 21(4):4871–4887.
Johnson, C., Badger, M., Waltermire, D., Snyder, J., and Skorupka, C. (2016). Guide to cyber threat information sharing. Technical Report NIST Special Publication 800-150, National Institute of Standards and Technology, Gaithersburg, MD.
Legoy, V., Caselli, M., Seifert, C., and Peter, A. (2020). Automated retrieval of att&ck tactics and techniques for cyber threat reports.
Liu, C., Wang, J., and Chen, X. (2022). Threat intelligence att&ck extraction based on the attention transformer hierarchical recurrent neural network. Applied Soft Computing, 122:108826.
Rahman, F. I., Halim, S. M., Singhal, A., and Khan, L. (2024). Alert: A framework for efficient extraction of attack techniques from cyber threat intelligence reports using active learning. In Ferrara, A. L. and Krishnan, R., editors, Data and Applications Security and Privacy XXXVIII, pages 203–220, Cham. Springer Nature Switzerland.
Rahman, M. R., Wroblewski, B., Matthews, Q., Morgan, B., Menzies, T., and Williams, L. (2025). Mining temporal attack patterns from cyberthreat intelligence reports. Knowledge and Information Systems, 67(10):8941–8981.
Rani, N., Saha, B., Maurya, V., and Shukla, S. K. (2023). Ttphunter: Automated extraction of actionable intelligence as ttps from narrative threat reports. In Proceedings of the 2023 Australasian Computer Science Week, ACSW ’23, page 126–134, New York, NY, USA. Association for Computing Machinery.
Strom, B. E., Applebaum, A., Miller, D. P., Nickels, K. C., Pennington, A. G., and Thomas, C. B. (2020). Mitre att&ck®: Design and philosophy. Technical Report MP180360R1, The MITRE Corporation, McLean, VA.
Tamanna, M., Mitra, S., Erfan, M., Ryan, A., Mittal, S., Williams, L., and Rahman, M. R. (2026). What are adversaries doing? automating tactics, techniques, and procedures extraction: A systematic review.
Publicado
21/10/2026
Como Citar
CAXIAS, Charllynson Carvalho; SANTANA, Brenda Salenave.
Análise da Recorrência de Técnicas e Táticas do MITRE ATT&CK em Relatórios Públicos de Threat Intelligence. In: ESCOLA REGIONAL DE REDES DE COMPUTADORES (ERRC), 23. , 2026, Santa Maria/RS.
Anais [...].
Porto Alegre: Sociedade Brasileira de Computação,
2026
.
p. 7-12.
DOI: https://doi.org/10.5753/errc.2026.36451.
