Tactics, Techniques, and Procedures (TTPs) in Interpreted Malware: A Zero-Shot Generation with Large Language Models

Understand

Nowadays, the open-source software (OSS) ecosystem suffers from security threats of software supply chain (SSC) attacks.

• Interpreted OSS malware plays a vital role in SSC attacks, as criminals have an arsenal of attack vectors to deceive users into installing malware and executing malicious activities.
• In this paper, we introduce tactics, techniques, and procedures (TTPs) proposed by MITRE ATT\&CK into the interpreted malware analysis to characterize different phases of an attack lifecycle.
• Specifically, we propose GENTTP, a zero-shot approach to extracting a TTP of an interpreted malware package.