# Tactics, Techniques, and Procedures (TTPs) in Interpreted Malware: A Zero-Shot Generation with Large Language Models

arXiv: https://arxiv.org/abs/2407.08532 · HTML: https://mlsanity.com/paper/2407.08532/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 11 Jul 2024.

## Built on by (most cited first, 6 of 6)

- [LAMD: Context-driven Android Malware Detection and Classification with LLMs](https://mlsanity.com/paper/2502.13055/) (2025)
- [Large Language Model (LLM) for Software Security: Code Analysis, Malware Analysis, Reverse Engineering](https://mlsanity.com/paper/2504.07137/) (2025)
- [Identifying Adversary Tactics and Techniques in Malware Binaries with an LLM Agent](https://mlsanity.com/paper/2602.06325/) (2026)
- [Living Off the LLM: How LLMs Will Change Adversary Tactics](https://mlsanity.com/paper/2510.11398/) (2025)
- [MGC: A Compiler Framework Exploiting Compositional Blindness in Aligned LLMs for Malware Generation](https://mlsanity.com/paper/2507.02057/) (2025)
- [Anticipating Adversary Behavior in DevSecOps Scenarios through Large Language Models](https://mlsanity.com/paper/2602.14106/) (2026)

## Abstract (arXiv)

Nowadays, the open-source software (OSS) ecosystem suffers from security threats of software supply chain (SSC) attacks. Interpreted OSS malware plays a vital role in SSC attacks, as criminals have an arsenal of attack vectors to deceive users into installing malware and executing malicious activities. In this paper, we introduce tactics, techniques, and procedures (TTPs) proposed by MITRE ATT&CK into the interpreted malware analysis to characterize different phases of an attack lifecycle. Specifically, we propose GENTTP, a zero-shot approach to extracting a TTP of an interpreted malware package. GENTTP leverages large language models (LLMs) to automatically generate a TTP, where the input is a malicious package, and the output is a deceptive tactic and an execution tactic of attack vectors. To validate the effectiveness of GENTTP, we collect two datasets for evaluation: a dataset with ground truth labels and a large dataset in the wild. Experimental results show that GENTTP can generate TTPs with high accuracy and efficiency. To demonstrate GENTTP's benefits, we build an LLM-based Chatbot from 3,700+ PyPI malware's TTPs. We further conduct a quantitative analysis of malware's TTPs at a large scale. Our main findings include: (1) many OSS malicious packages share a relatively stable TTP, even with the increasing emergence of malware and attack campaigns, (2) a TTP reflects characteristics of a malware-based attack, and (3) an attacker's intent behind the malware is linked to a TTP.