building-attack-pattern-library-from-cti-reports

name	building-attack-pattern-library-from-cti-reports
description	从网络威胁情报报告中提取和归类攻击模式，构建基于 STIX 的结构化库，映射到 MITRE ATT&CK，用于检测工程和以威胁为导向的防御。
domain	cybersecurity
subdomain	threat-intelligence
tags	["attack-pattern","cti-reports","mitre-attack","stix","detection-engineering","threat-intelligence","nlp","extraction"]
version	1.0
author	mahipal
license	Apache-2.0

从 CTI 报告构建攻击模式库

概述

来自 Mandiant、CrowdStrike、Talos 和 Microsoft 等厂商的网络威胁情报（CTI）报告包含对手行为的详细描述，这些描述可以被提取、规范化并归入结构化攻击模式库。本技能涵盖解析 CTI 报告以提取对手技术、将行为映射到 MITRE ATT&CK 技术 ID、创建 STIX 2.1 攻击模式对象、构建按战术/技术和威胁行为者索引的可搜索库，以及从已记录模式生成检测规则模板。

前置条件

• Python 3.9+，安装 stix2、mitreattack-python、spacy、requests 库
• CTI 报告集合（PDF、HTML 或文本格式）
• MITRE ATT&CK STIX 数据（本地或通过 TAXII）
• 了解 ATT&CK 技术结构和命名规范
• 熟悉检测工程概念（Sigma、YARA）

核心概念

攻击模式提取

CTI 报告以自然语言描述对手行为。提取过程包括：识别映射到 ATT&CK 技术的动词和技术术语、识别工具名称和恶意软件家族、识别基础设施指标，以及将行为序列映射到攻击链（Kill Chain 阶段）。

STIX 2.1 攻击模式对象

STIX 将攻击模式定义为结构化域对象（SDO），描述威胁行为者尝试攻陷目标的方式。每个模式通过外部引用链接到 ATT&CK，包含 Kill Chain 阶段（战术），并可关联到入侵集合、恶意软件和工具对象。

检测规则生成

提取的攻击模式为检测工程提供依据：为 Sigma 规则创建提供具体过程示例、为关联规则提供行为序列、为 YARA 和 Snort 规则提供 IOC 模式，以及识别遥测数据缺口所需的数据源要求。

实践步骤

步骤 1：解析 CTI 报告并提取行为

import re
import json
from collections import defaultdict

class CTIReportParser:
    """解析 CTI 报告以提取对手行为。"""

    BEHAVIOR_INDICATORS = [
        "used", "executed", "deployed", "leveraged", "exploited",
        "established", "created", "modified", "downloaded", "uploaded",
        "exfiltrated", "injected", "enumerated", "spawned", "dropped",
        "persisted", "escalated", "moved laterally", "collected",
        "encrypted", "compressed", "encoded", "obfuscated",
    ]

    TOOL_PATTERNS = [
        r'\b(Cobalt Strike|Mimikatz|PsExec|BloodHound|Rubeus|Impacket)\b',
        r'\b(PowerShell|cmd\.exe|WMI|WMIC|certutil|bitsadmin)\b',
        r'\b(Metasploit|Empire|Covenant|Sliver|Brute Ratel)\b',
        r'\b(Lazagne|SharpHound|ADFind|Sharphound|Invoke-Obfuscation)\b',
    ]

    TECHNIQUE_KEYWORDS = {
        "spearphishing": "T1566",
        "phishing attachment": "T1566.001",
        "phishing link": "T1566.002",
        "powershell": "T1059.001",
        "command line": "T1059.003",
        "scheduled task": ,
        : ,
        : ,
        : ,
        : ,
        : ,
        : ,
        : ,
        : ,
        : ,
        : ,
        : ,
        : ,
        : ,
        : ,
    }

     ():
        
        sentences = re.split(, text)
        behaviors = []

         sentence  sentences:
            sentence_lower = sentence.lower()
            
             indicator  .BEHAVIOR_INDICATORS:
                 indicator  sentence_lower:
                    behavior = {
                        : sentence.strip(),
                        : indicator,
                        : ._extract_tools(sentence),
                        : ._match_techniques(sentence_lower),
                    }
                     behavior[]:
                        behaviors.append(behavior)
                    

        ()
         behaviors

     ():
        
        tools = ()
         pattern  .TOOL_PATTERNS:
            matches = re.findall(pattern, text, re.IGNORECASE)
            tools.update(matches)
         (tools)

     ():
        
        matches = []
         keyword, tech_id  .TECHNIQUE_KEYWORDS.items():
             keyword  text:
                matches.append({: keyword, : tech_id})
         matches

parser = CTIReportParser()
sample_report = 
behaviors = parser.parse_report(sample_report)

步骤 2：将行为映射到 ATT&CK 技术

from attackcti import attack_client

class ATTACKMapper:
    def __init__(self):
        self.lift = attack_client()
        self.techniques = {}
        self._load_techniques()

    def _load_techniques(self):
        """加载所有 ATT&CK 技术用于映射。"""
        all_techs = self.lift.get_enterprise_techniques()
        for tech in all_techs:
            tech_id = ""
            for ref in tech.get("external_references", []):
                if ref.get("source_name") == "mitre-attack":
                    tech_id = ref.get("external_id", "")
                    break
            if tech_id:
                self.techniques[tech_id] = {
                    "name": tech.get("name", ""),
                    "description": tech.get("description", "")[:500],
                    "tactics": [p.get("phase_name") for p in tech.get("kill_chain_phases", [])],
                    "platforms": tech.get("x_mitre_platforms", []),
                    "data_sources": tech.get("x_mitre_data_sources", []),
                }
        ()

     ():
        
        mapped = []
         behavior  behaviors:
             hint  behavior.get(, []):
                tech_id = hint[]
                 tech_id  .techniques:
                    tech_info = .techniques[tech_id]
                    mapped.append({
                        : tech_id,
                        : tech_info[],
                        : tech_info[],
                        : behavior[],
                        : behavior[],
                        : hint[],
                        : tech_info[],
                    })
        ()
         mapped

mapper = ATTACKMapper()
mapped_behaviors = mapper.map_behaviors(behaviors)

步骤 3：创建 STIX 2.1 攻击模式库

from stix2 import AttackPattern, Relationship, Bundle, TLP_GREEN
from datetime import datetime

class AttackPatternLibrary:
    def __init__(self):
        self.patterns = []
        self.relationships = []

    def add_pattern_from_mapping(self, mapping, report_source="CTI Report"):
        """从映射的行为创建 STIX 攻击模式。"""
        pattern = AttackPattern(
            name=mapping["technique_name"],
            description=f"观察到的行为: {mapping['source_sentence']}\n\n"
                        f"工具: {', '.join(mapping['tools_observed']) or '未识别'}\n"
                        f"来源: {report_source}",
            external_references=[{
                "source_name": "mitre-attack",
                "external_id": mapping["technique_id"],
                "url": f"https://attack.mitre.org/techniques/{mapping['technique_id'].replace('.', '/')}/",
            }],
            kill_chain_phases=[{
                "kill_chain_name": "mitre-attack",
                "phase_name": tactic,
            } for tactic in mapping["tactics"]],
            object_marking_refs=[TLP_GREEN],
        )
        .patterns.append(pattern)
         pattern

     ():
        
        seen_techniques = ()
         mapping  mapped_behaviors:
            tech_id = mapping[]
             tech_id   seen_techniques:
                .add_pattern_from_mapping(mapping, report_source)
                seen_techniques.add(tech_id)

        bundle = Bundle(objects=.patterns + .relationships)
        ()
         bundle

     ():
        bundle = Bundle(objects=.patterns + .relationships)
         (output_file, )  f:
            f.write(bundle.serialize(pretty=))
        ()

     ():
        
        templates = []
         mapping  mapped_behaviors:
            template = {
                : ,
                : ,
                : ,
                : [
                    ,
                ],
                : [
                      mapping[]  ,
                    ,
                ],
                : mapping.get(, []),
                : mapping.get(, []),
                : mapping[],
            }
            templates.append(template)

         (, )  f:
            json.dump(templates, f, indent=)
        ()
         templates

library = AttackPatternLibrary()
bundle = library.build_library(mapped_behaviors, )
library.export_library()
templates = library.generate_detection_templates(mapped_behaviors)

验收标准

• CTI 报告已解析并提取行为指标
• 行为已映射到对应置信度的 ATT&CK 技术
• STIX 2.1 攻击模式对象已创建并包含正确引用
• 库支持按战术、技术和威胁行为者进行搜索
• 已从已记录模式生成检测模板
• 库可作为 STIX bundle 导出并共享

参考资料

• MITRE ATT&CK
• STIX 2.1 Attack Pattern SDO
• CISA: Best Practices for ATT&CK Mapping
• attackcti Python Library
• Sigma Rules Project
• MITRE ATT&CK STIX Data