###### Abstract
If the quantitative or qualitative evaluation of the attack scenario is omitted, the effectiveness of the training cannot be measured, and it cannot be judged whether the participants acquired the knowledge and skills to counter cyber threats through the training. Our insights to overcome the above challenges are as follows. First, we introduce the adversarial tactics, techniques, and common knowledge (ATT&CK) framework [8] developed by MITRE to identify possible attacks or inherent vulnerabilities on assets. MITRE ATT&CK is a knowledge base on cybersecurity attacks, defining the tactics, techniques, and procedures attackers use to infiltrate systems, move within networks, extract valuable information, or destroy systems. Next, attack trees [9; 10] are used to generate cyberattack scenarios systematically. An attack tree is a graphical tool used to analyze vulnerabilities in security systems. An attack tree is a visual representation of the different ways to achieve an attack goal, which helps evaluate and improve a system's security state. Finally, we utilize the common vulnerability scoring system (CVSS) [11] and DREAD [12] to evaluate the quality of generated cyberattack scenarios. CVSS is a scoring system widely used to evaluate the severity of security vulnerabilities. DREAD stands for damage, reproducibility, exploitability, affected users, and discoverability and evaluates the risk of vulnerabilities by scoring each factor. However, since CVSS and DREAD were designed to evaluate only the severity of a single vulnerability, it is difficult to use them to evaluate attack scenarios directly. Therefore, we extend CVSS and DREAD to evaluate attack scenarios. In this paper, we propose an attack scenario generation framework for cybersecurity exercises in ICS. This framework consists of a preparation phase and four phases for attack scenario generation and evaluation: preparation, threat analysis (step 1), attack information identification (step 2), modeling cyberattack (step 3), quantitative evaluation (step 4), and attack scenario generation (step 5). The preparation phase collects the schematic diagram for the ICS environment and identifies the assets included in it. These assets may include personal computers (PCs), engineering workstations (EWS), programmable logic controllers (PLCs), and field devices. Since each attack procedure that constitutes a cyberattack scenario mostly targets these assets, the assets should be identified prior to writing the attack scenario. The threat analysis step establishes an outline of cyberattack scenarios for training. This step defines the objective of the attacker's attack, the ultimate target within the facility, and the attack's impact. The attack information identification stage collects information such as attack tactics, techniques, and vulnerabilities that can be applied to the assets in the facility identified in the preparation stage. In the attack scenario generation step, attack scenarios for exercises are generated based on the previously collected information. We propose a method to configure a modified attack tree to achieve the previously defined attack goal and generate an attack scenario. Lastly, we evaluate the attack scenario generated in the previous step in the quantitative evaluation step. We use CVSS and DREAD to score each attack procedure that constitutes an attack scenario and evaluate the level of the attack scenario by integrating the scores of all attack procedures. Recognizing the challenges inherent in assessing security controls within the ICS environment, GENICS provides a structured approach to validate the current security posture of facilities through practical exercises. GENICS stands out by integrating established knowledge bases, including MITRE ATT&CK and CVE databases, to construct detailed attack scenarios tailored to ICS facilities.