# Cyber-Attack Scoring Model Based on the Offensive Cybersecurity Framework
## 4 Cyber-Attacks Evaluation
### Investigation  
We calculated the cyber-attack score based on the Open Source Intelligence (OSINT) method. Many cybersecurity companies publish an analysis of cyber-attack cases, and certain countries, such as the United States and South Korea, publish reports with analyses of cyber-attack cases. We analyzed these reports to identify the techniques that were being used by the cyber-attack groups.  
To identify detailed techniques that were used for each cyber-attack, we selected representative examples of a cyber-attack for each country as well as fileless cyber-attacks. In the first step of our analysis, we used MITRE ATT&CK cyber-attack group artifacts to identify the cyber-attack techniques that were used. Next, we analyzed the cyber-attack techniques in detail based on our proposed offensive cybersecurity framework for each representative cyber-attack as listed in Tables 7 and 8.  
\begin{table}
\begin{tabular}{l l} \hline \hline
**Fileless Cyber-Attack** & **Techniques** \\ \hline \hline \multirow{7}{*}{Poweliks} & MS Office Macro vulnerability \\  & Inject malicious script into the registry \\  & Execution of registry value using Rundll32.exe \\  & Execution of registry value encoded using Jscript.Encode \\  & Use of Powershell script encoded with Base64 \\  & Verification of registry key and path of executed files \\  & DLL execution through Powershell script (injection using dllhost.exe) \\  & Deleting files after every operation \\  & Dllhost.exe resides \\  & Send a user’s system information to C\&C server through TCP \\  & communication \\ \hline \hline \multirow{7}{*}{Kovter} & Social engineering techniques using email attachments \\  & Inject malicious script into the registry \\  & Execution of registry value using Mshta.exe \\  & Execution of registry value encoded using Jscript.Encode \\  & Use of Powershell script encoded with Base64 \\  & Injecting codes through Powershell script \\  & Deleting files after every operation \\  & Regsv32.exe resides \\  & Send a user’s system information to C\&C server through TCP \\  & communication \\ \hline \hline \end{tabular}
\end{table}
Table 7: Techniques used in the fileless cyber-attacks samples.  
\begin{table}
\begin{tabular}{l l} \hline \hline
**Cyber-Attack** & **Techniques Used** \\ \hline \hline \multirow{7}{*}{APT29} & Network: Multi-hop Proxy, Commonly Used Port, Domain Fronting, \\  & Spearphishing Attachment, Spearphishing Link, Standard \\  & Non-Application Layer Protocol, User Execution \\  & Encryption: Obfuscated Files or Information, Software Packing \\  & System: Accessibility Features, Bypass User Account Control, Exploitation \\  & for Client Execution, Pass the Ticket \\  & Malware: File Deletion, Indicator Removal on Host, PowerShell, Registry \\  & Run Keys/Startup Folder, Rundll32, Scheduled Task, Scripting, Shortcut \\  & Modification, Windows Management Instrument Instrumentation, Windows \\  & Management Instrumentation Event Subscription \\  & Used tools: CloudDuke, CosmicDuke, CozyCar, GeminiDuke, \\  & HAMMETOSS, meek, Mimikatz, MiniDuke, OnionDuke, PinchDuke, \\  & POSHSPY, PowerDuke, PsExec, S  
\end{table}
Table 8: Techniques used in the APT Group cyber-attacks.