# MITRE ATT&CK Applications in Cybersecurity and The Way Forward

arXiv: https://arxiv.org/abs/2502.10825 · HTML: https://mlsanity.com/paper/2502.10825/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 15 of its 263 references that are in the map.
- First posted on arXiv 15 Feb 2025.

## Builds on (most cited first, 15 of 15)

- [AttacKG: Constructing Technique Knowledge Graph from Cyber Threat Intelligence Reports](https://mlsanity.com/paper/2111.07093/) (2021)
- [Automated Retrieval of ATT&CK Tactics and Techniques for Cyber Threat Reports](https://mlsanity.com/paper/2004.14322/) (2020)
- [STIXnet: A Novel and Modular Solution for Extracting All STIX Objects in CTI Reports](https://mlsanity.com/paper/2303.09999/) (2023)
- [Investigating co-occurrences of MITRE ATT&CK Techniques](https://mlsanity.com/paper/2211.06495/) (2022)
- [Noise Contrastive Estimation-based Matching Framework for Low-Resource Security Attack Pattern Recognition](https://mlsanity.com/paper/2401.10337/) (2024)
- [Threat Actor Type Inference and Characterization within Cyber Threat Intelligence](https://mlsanity.com/paper/2103.02301/) (2021)
- [Laccolith: Hypervisor-Based Adversary Emulation with Anti-Detection](https://mlsanity.com/paper/2311.08274/) (2023)
- [The Pulse of Fileless Cryptojacking Attacks: Malicious PowerShell Scripts](https://mlsanity.com/paper/2401.07995/) (2024)
- [Big Fish, Little Fish, Critical Infrastructure: An Analysis of Phineas Fisher and the 'Hacktivist' Threat to Critical Infrastructure](https://mlsanity.com/paper/2004.14360/) (2020)
- [RANK: AI-assisted End-to-End Architecture for Detecting Persistent Attacks in Enterprise Networks](https://mlsanity.com/paper/2101.02573/) (2021)
- [Security Assessment Rating Framework for Enterprises using MITRE ATT&CK Matrix](https://mlsanity.com/paper/2108.06559/) (2021)
- [Towards Dynamic Threat Modelling in 5G Core Networks Based on MITRE ATT&CK](https://mlsanity.com/paper/2108.11206/) (2021)
- [Principled Data-Driven Decision Support for Cyber-Forensic Investigations](https://mlsanity.com/paper/2211.13345/) (2022)
- [An Approach to Abstract Multi-stage Cyberattack Data Generation for ML-Based IDS in Smart Grids](https://mlsanity.com/paper/2312.13737/) (2023)
- [Enhancing cybersecurity defenses: a multicriteria decision-making approach to MITRE ATT&CK mitigation strategy](https://mlsanity.com/paper/2407.19222/) (2024)

## Built on by (most cited first, 2 of 2)

- [ClawGuard: A Runtime Security Framework for Tool-Augmented LLM Agents Against Indirect Prompt Injection](https://mlsanity.com/paper/2604.11790/) (2026)
- [CyberClear: A Benchmark for LLM Agent Systems on APT Attack Chain Provenance](https://mlsanity.com/paper/2609.32424/) (2026)

## Abstract (arXiv)

The MITRE ATT&CK framework is a widely adopted tool for enhancing cybersecurity, supporting threat intelligence, incident response, attack modeling, and vulnerability prioritization. This paper synthesizes research on its application across these domains by analyzing 417 peer-reviewed publications. We identify commonly used adversarial tactics, techniques, and procedures (TTPs) and examine the integration of natural language processing (NLP) and machine learning (ML) with ATT&CK to improve threat detection and response. Additionally, we explore the interoperability of ATT&CK with other frameworks, such as the Cyber Kill Chain, NIST guidelines, and STRIDE, highlighting its versatility. The paper further evaluates the framework from multiple perspectives, including its effectiveness, validation methods, and sector-specific challenges, particularly in industrial control systems (ICS) and healthcare. We conclude by discussing current limitations and proposing future research directions to enhance the applicability of ATT&CK in dynamic cybersecurity environments.