  The knowledge on attacks contained in Cyber Threat Intelligence (CTI) reports
is very important to effectively identify and quickly respond to cyber threats.
However, this knowledge is often embedded in large amounts of text, and
therefore difficult to use effectively. To address this challenge, we propose a
novel approach and tool called EXTRACTOR that allows precise automatic
extraction of concise attack behaviors from CTI reports. EXTRACTOR makes no
strong assumptions about the text and is capable of extracting attack behaviors
as provenance graphs from unstructured text. We evaluate EXTRACTOR using
real-world incident reports from various sources as well as reports of DARPA
adversarial engagements that involve several attack campaigns on various OS
platforms of Windows, Linux, and FreeBSD. Our evaluation results show that
EXTRACTOR can extract concise provenance graphs from CTI reports and show that
these graphs can successfully be used by cyber-analytics tools in
threat-hunting.
