Summary of TOP Attack Techniques under the ATT&CK Framework in 2023

As the most authoritative threat behavior analysis model, the ATT&CK framework is utilized by Pytheas to classify and filter attack techniques, providing our users with security validation from an attacker's perspective.

In recent years, many organizations have also leveraged the ATT&CK framework to generate annual reports to map Tactics, Techniques, and Procedures (TTPs) observed in the wild.

By analyzing the frequency of ATT&CK techniques and sub-techniques in real-world cyber incidents across the four-year period from 2020 to 2023, we can first derive the following summary data:

01

—

2023 Annual Summary Since the beginning of 2023, the following four techniques have been the most commonly used by attackers, and security teams should prioritize the defense of these four techniques.

Data shows that over the past four years, PowerShell topped the list of preferred Command and Scripting Interpreters, closely followed by Windows Command Shell, while Python-based activities lagged far behind in third place. Command and Scripting Interpreters are very useful tools for attackers, providing a variety of capabilities such as modifying the host operating system, launching scripts, executing payloads, or downloading tools and files from the network.

Popularity of Command and Scripting Interpreters (2020-2023)

Command-line activity logs are a key source for detecting malicious activity in the network and are a rich source for threat hunting.

02

—

Web Exploitation on the Rise?

T1190 Exploit Public-Facing Application was the most reported initial access technique in 2023. Additionally, 2023 featured some high-profile, persistent, critical vulnerabilities (such as CVE-2023-35708, CVE-2023-35078), as well as some high-profile intrusions that began with exploiting web-facing applications for initial access, such as Volt Typhoon.

Average Frequency of Initial Access Methods (2020-2023)

According to statistics, we can see an upward trend in the number of CVEs (Common Vulnerabilities and Exposures), growing steadily year-on-year over the past decade, especially in cross-site scripting and memory corruption vulnerabilities.

Total Number of CVEs (2013-2023)

Total Number of CVEs by Type (2013-2023)

03

—

The Big Picture: 2020-2023

Looking at the past four years of reported attack campaigns and the highest average frequencies of ATT&CK techniques from a broader perspective. Overall, the most commonly used techniques align closely with the newly added data in 2023:

04

—

Conclusion

Pytheas recommends that all organizations pay close attention to these highly-frequented attack techniques. Our users can filter attack methods associated with these techniques within the Pytheas Security Metrics Validation Platform to verify whether their security defenses can effectively withstand real-world attacks.

Another year has passed, and attackers are also aging; perhaps they are adapting in their own ways. Are the top-tier techniques stable, or will new trends emerge to replace them? Will the exploitation of public-facing applications permanently replace spearphishing as the primary means for attackers to gain initial access? Will Python-based malware experience an exploitation renaissance in 2024? We shall see next year.