Enhancing the STIX Representation of MITRE ATT&CK for Group Filtering and Technique Prioritization

TL;DR

This paper improves the STIX 2.1 representation of MITRE ATT&CK groups by adding contextual data like motivations and origins, enabling more effective filtering and prioritization of threat groups and techniques.

Contribution

It introduces an enhanced STIX model that incorporates additional contextual information for better group filtering and technique prioritization.

Findings

Enhanced STIX model supports complex queries

Improved filtering of threat groups based on new context

Facilitates targeted threat intelligence retrieval

Abstract

In this paper, we enhance the machine-readable representation of the ATT&CK Groups knowledge base provided by MITRE in STIX 2.1 format to make available and queryable additional types of contextual information. Such information includes the motivations of activity groups, the countries they have originated from, and the sectors and countries they have targeted. We demonstrate how to utilize the enhanced model to construct intelligible queries to filter activity groups of interest and retrieve relevant tactical intelligence.