A data-driven approach to prioritize MITRE ATT&CK techniques for active directory adversary emulation.

ABSTRACT: Advanced Persistent Threats (APTs) continue to evolve, employing sophisticated and evasive techniques that pose significant challenges to modern defense mechanisms, particularly in Active Directory (AD) environments. Adversary emulation serves as a proactive security strategy, enabling organizations to replicate real-world adversary behaviors to assess and enhance detection, response, and mitigation capabilities. However, existing frameworks often lack a structured approach to prioritizing techniques based on impact, feasibility, and security control gaps, leading to suboptimal resource allocation. This study proposes a Multi-Criteria Decision-Making (MCDM) approach that integrates Operational Threat Intelligence (OTI) and structured datasets from MITRE ATT&CK to systematically prioritize

SUBMITTER: Abo-Alian A 

PROVIDER: S-EPMC12311202 | biostudies-literature | 2025 Jul

REPOSITORIES: biostudies-literature