Tackling ATT&CK: Can VirusTotal Data Help?

Mapping malware behavior to MITRE ATT&CK Framework is a genuinely challenging task. From researching and documenting every behavior reported to then mapping that behavior using the hundreds of techniques and sub-techniques available, it is difficult to capture everything. Add to that the challenge of ensuring those techniques are still relevant and used in recent campaigns, and it seems like an impossible endeavor. Despite this challenge, some of the behavior-based data found in VirusTotal has been shown to help compile a more exhaustive list of ATT&CK techniques based on a specific campaign or timeframe to help ensure the ATT&CK data gathered continues to be relevant and valuable within the current threat landscape. This paper describes a practical method for extracting, processing, and assessing data extracted from VirusTotal for more reliable and applicable ATT&CK mapping results.