# Cyber-Attack Scoring Model Based on the Offensive Cybersecurity Framework
## 4 Cyber-Attacks Evaluation
### Scoring
#### 4.4.2 Cyber-Attack Scoring Result with ATT&CK
\begin{table}
\begin{tabular}{c c c c c c c c c c c c c c} \hline \hline \multirow{2}{*}{**No.**} & \multirow{2}{*}{**Cyber-Attack**} & \multicolumn{8}{c}{**Number of used techniques of MITRE ATT& \&CK**} & \multirow{2}{*}{**Total**} \\ \cline{3-13}  & & & & & & & & & & & & & & & \\ \hline
1 & Poweliks & 1 & 4 & 1 & 1 & 5 & - & - & - & 1 & 1 & 2 & - & 0.2581 \\
2 & Rozena & 1 & 3 & - & 1 & 3 & - & - & - & - & 1 & - & - & 0.1452 \\
3 & Duqu 2.0 & 1 & 2 & 1 & 2 & 1 & 1 & 4 & 2 & 1 & 1 & 1 & 1 & 0.2742 \\
4 & Kovter & 1 & 4 & 1 & - & 5 & - & - & - & 1 & 1 & 1 & - & 0.2258 \\
5 & Petya & 2 & 6 & - & - & 2 & 1 & 1 & 2 & - & - & - & 2 & 0.2581 \\
6 & Sorebrect & 3 & 1 & - & 1 & 2 & 1 & 1 & - & - & 2 & - & 2 & 0.2097 \\
7 & WannaCry & - & 1 & 2 & 1 & 2 & - & 2 & 2 & - & 2 & - & 3 & 0.2419 \\
8 & Magniber & 1 & 4 & - & 1 & 1 & - & 1 & - & - & 1 & - & 2 & 0.1774 \\
9 & Emprotet & 1 & 4 & 1 & - & 2 & 3 & 1 & 1 & 2 & 5 & 1 & - & 0.3387 \\
10 & GandCrab & 1 & 3 & - & 1 & 4 & - & 1 & - & - & 1 & 2 & 2 & 0.2419 \\ \hline
11 & APT1 & - & 1 & - & - & 1 & 1 & 6 & 2 & 5 & - & - & - & 0.2581 \\
12 & Emissary & 1 & 4 & 3 & 5 & 6 & 3 & 6 & 2 & 9 & 2 & 1 & - & 0.6774 \\
13 & PAT29 & 2 & 6 & 2 & 3 & 3 & - & 1 & - & 3 & - & - & 0.3226 \\
14 & Sector04 & 2 & 8 & - & - & 2 & 2 & - & - & 1 & - & 1 & 0.2581 \\
15 & Lazarus Group & 2 & 4 & 3 & 3 & 11 & 2 & 8 & 2 & 6 & 7 & - & 7 & 0.8871 \\
16 & APT38 & 1 & 1 & - & - & 4 & 1 & 2 & - & 2 & 1 & - & 7 & 0.3065 \\
17 & Chafer & 2 & 4 & 3 & - & 1 & 2 & 3 & 2 & 1 & 1 & - & - & 0.3065 \\
18 & MuddyWater & 2 & 8 & 1 & 1 & 4 & 6 & 6 & - & 2 & 6 & - & - & 0.5806 \\ \hline \hline \end{tabular}
\end{table} 
Table 10: Scoring result of cyber-attacks using ATT&CK phases. Privilege escalation stage, bypass user access control, exploitation for privilege escalation, hijack execution flow, dll side-loading, and process hollowing techniques were used. In the Defense evasion phase, Windows event logging is disabled, file deletion, network share connection removal and obfuscated files or information were used. In the Credential access phase, OS credential dumping technique for LSA secrets, LSAS memory, and security account manager was used. In the Discovery phase, local account, network service scanning, and query registry methods were used. In the Lateral movement phase, the exploitation of remote services technique is used. In the Collection phase, automated collection is performed. In the Command and Control phase, web protocols, ingress tool transfer are used. In the Exfiltration step, archive via library is used. Next, we analyzed APT38, which obtained a fairly low score; however, many techniques are used in the Impact step. APT38 used a drive-by compromise technique in the initial access step. In the Execution step, the Windows command shell was used. In the Defense evasion step, indicator removal on host, modify registry, and software-packing techniques were used. In the Credential access step, input capture technique was used. In the Collection step, clipboard data were executed. In the Command and Control step, web protocols and ingress tool transfer were used. In particular, in the Impact step, many techniques were used: data destruction, data encrypted for impact, data manipulation, disk structure wipe, and system shutdown techniques.