How Hard Can It Be? Quantifying MITRE Attack Campaigns with Attack Trees and cATM Logic

In the cyber threats landscape, Advanced Persistent Threats carry out attack campaigns—e.g., operations Dream Job, Wocao and WannaCry—against which cybersecurity practitioners must defend. To prioritise which of these to defend against, experts must be equipped with the ability to evaluate the most threatening ones: they would strongly benefit from (a) an estimation of the likelihood values for each attack recorded in the wild and (b) transparently operationalising these values to compare campaigns quantitatively. Here we construct such a framework: (1) quantifying the likelihood of attack campaigns via data-driven procedures on the MITRE knowledge base, (2) introducing a methodology for automatic modelling of MITRE intelligence data, that captures any attack campaign via template attack tree models and (3) proposing an open source tool to perform these comparisons based on the cATM logic. Finally, we quantify the likelihood of all MITRE Enterprise campaigns, and compare the likelihood of the Wocao and Dream Job MITRE campaigns—generated with our proposed approach—against manually built attack tree models. We demonstrate how our methodology is substantially lighter in modelling effort, and capable of capturing all the quantitative relevant data. To ensure broader applicability, further validation with cybersecurity experts is recommended, especially by sourcing more manually built models.