How MITRE is AI, anyway?

This presentation forms part of the CTA's Threat Intelligence Practitioners' Summit

Thursday 25 September 11:30 - 12:00, Small Talks room

Samir Mody (K7 Computing)

There has been a lot of hype about AI for a few years now, exacerbated post the advent of OpenAI's ChatGPT back in 2022. At the time it was claimed that GenAI would be able to create fully functional malware from scratch. Fortunately, reality has dawned that GenAI actually has plenty of limitations, especially related to logic, and so we don't see an unabated proliferation of AI-generated malware in the wild.

However, GenAI is indeed useful if one already knows what one is doing, a powerful tool if you will, which reduces the effort one needs to expend to achieve the same outcome. In a nutshell, GenAI promotes efficiency; it does not confer wisdom.

In this presentation we intend to explore the true scope of GenAI, but we need suitable use cases. The cybersecurity industry's recent embrace of the MITRE ATT&CK framework as the de facto standard modelling of an attack's anatomy provides an opportunity.

We expect to answer the following questions:

1. Can GenAI consume sample behaviour logs and identify any applicable MITRE ATT&CK IDs?
2. Can GenAI provide working sample code pertaining to common MITRE ATT&CK tactics or techniques, e.g. persistence?
3. If so, which languages (Python or C or xyz) are used to generate such code?

The answers to the above questions promise quite a lot – we would be in a better position to understand the true potential of AI in cybersecurity, its abilities and its flaws. Wouldn't we all like to know that? If AI were a person, we could gauge the extent to which we could co-opt them into our community of defenders.

NB: This abstract was not generated by GenAI!

Samir Mody Samir Mody graduated from the University of Oxford in 2000 with a First-Class Master's degree in chemical engineering, economics and management. He spent over nine years at Sophos UK, the final three as Threat Operations Manager of SophosLabs. Since August 2010 he has been running K7 Labs in Chennai, India. Samir has actively contributed to the IEEE Taggant System project and other industry collaborations such as AMTSO and CTA. He has co-authored and/or presented papers and participated in panel discussions at various international security conferences (VB, CTA TIPS, AVAR, EICAR). Samir's interests include reading (philosophy, politics, history, literature, and economics), sport and classical music.

Back to VB2025 Programme page

Back to VB2025 conference page

Register for VB2025

Other VB2025 papers