A data-driven approach to prioritize MITRE ATT&CK techniques for active directory adversary emulation

Area of Science:

• Cybersecurity
• Information Security
• Computer Science

Background:

• Advanced Persistent Threats (APTs) pose evolving challenges to Active Directory (AD) security.
• Adversary emulation is crucial for assessing security but lacks structured prioritization.
• Existing frameworks struggle with resource allocation for effective emulation.

Purpose of the Study:

• To develop a structured approach for prioritizing adversary emulation techniques.
• To enhance the effectiveness of security controls against APTs in AD environments.
• To align adversary emulation with real-world attack scenarios.

Main Methods:

• A Multi-Criteria Decision-Making (MCDM) approach integrating Operational Threat Intelligence (OTI) and MITRE ATT&CK data.
• Evaluation of techniques based on Active Directory Impact, Threat Score, and Security Control Gap.
• Entropy-based weighting for objective, data-driven prioritization.

Main Results:

• A validated framework for systematically prioritizing adversary techniques.
• Demonstrated effectiveness through a case study using the APT3 threat group.
• Identification of high-impact and difficult-to-detect techniques for focused emulation.

Conclusions:

• The proposed MCDM framework significantly enhances adversary emulation effectiveness.
• It strengthens security postures in Active Directory environments by focusing on critical threats.
• Provides a data-driven method for optimizing cybersecurity resource allocation.