# Bridging the Gap: A Survey and Classification of Research-Informed Ethical Hacking Tools
## 4 Cybersecurity Frameworks Used for Tools Classification
### Mitre ATT&CK Framework  
Mitre ATT&CK (_Adversarial Tactics, Techniques, and Common Knowledge_) [10] is a framework that categorises the tactics, techniques, and procedures (TTPs) used by real-world threat actors during cyberattacks (Figure 4). It provides a standardised and comprehensive mapping of the various stages of an attack and consists of a matrix that categorises adversary behaviours across different stages of the attack lifecycle. Within each tactic, specific techniques and procedures are listed, which outline the specific actions and methods used by adversaries to accomplish their objectives.  
Figure 3: Penetration testing phases according to the PTES methodology.  
Mitre ATT&CK consists of fourteen phases [39]:  
1. _Reconnaissance_: Collecting information on the target to plan and execute attacks. Methods include: _Active Scanning, Passive Scanning, Social Engineering_ and _OSINT_.
2. _Resource Development_: Acquiring resources required for further exploitation and maintaining access. Methods include: _Developing Tools_ and _Developing and Executing Malware_.
3. _Initial Access_: Techniques performed to gain access to the target environment. Methods to achieve this include: _Sear-Phishing_, _Exploiting Vulnerabilities_ and _Stolen Credentials_.
4. _Execution_: Techniques performed executing Malicious Software (Malware) on a target system. Methods include: _Executing Binaries_, _Scripts_ and _System Tools_.
5. _Persistence_: Techniques performed around maintaining system access over a significant period of time. Methods include: _Backdoor Creation_ and _Scheduled Tasks_.
6. _Privilege Escalation_: Increasing the access control levels in the compromised environment. Methods include: _Vulnerability Exploitation_, _Configuration Manipulation_ and _Credential Theft_.
7. _Defence Evasion_: Techniques to avoid detection or target defensive mechanisms. Methods include: _Anti-Virus Evasion_, _Obfuscation_ and _Living-off-the-land Techniques_.
8. _Credential Access_: Techniques for stealing credentials for unauthorised access. Methods include: _Credential Dumping_, _Keylogging_ and _Brute-Force Attacks_.
9. _Discovery_: Techniques for identifying information about the target system. Methods include: _Network Scanning_, _System Enumeration_ and _Querying Systems_.
10. _Lateral Movement_: Methods for moving through the network for accessing additional systems by using _RDP_, _Trust Relationships_ and _Lateral Tool Transfer_.
11. _Collection_: Acquiring and consolidating target system information. Methods include: _Data Mining_, _Scraping_ and _Information Capture_.
12. _Command and Control_: Creating and Maintaining communication channels between the attacker and compromised systems. Methods include: _Command and Control (C2)_, _Covert Channels_ and _Network Protocols_.
13. _Exfiltration_: Techniques around the unauthorised data transfer external to the target environment. Methods include: _Network Data Exfiltration_, _Encryption Channels_ and _Scheduled Transfer_.
14. _Impact_: Achieving the desired outcome or effect could involve damaging a target. Methods include: _Destroying Data_, _System Operation Disruption_ and _Deploying Malware_.  
The Mitre ATT&CK framework can be applied to broad kinds of targets, including, financial systems [40], healthcare [41] and Industrial Control Systems (ICS) [42].