Tactics, Techniques and Procedures of Cybercrime: A Methodology and Tool for Cybercrime Investigation Process
G. Sarkar, Hardeep Singh, Subodh Kumar, Sandeep K. Shukla
Abstract
Individuals, organizations and nation-states are increasingly falling victim to cyberattacks. A lot of research on how to understand the modus operandi of a cyber attacker through the MITRE ATT&CK framework, CAPEC enumeration and various cyber kill chain frameworks has been available for cyber incident responders for both pre-attack defensive posture preparation as well as post-attack mapping of the indicators. Cybercrime, on the other hand, has a very different set of motives, majorly financial, but also impersonation, harassment and hate crimes, which are targeted mostly towards individuals who are vulnerable. Investigative officers in cyber cells around the world use various investigative processes in their attempt to solve a cybercrime incident, detect the criminal(s), recover the lost money, shut down the accounts of perpetrators, or bring down the cyber-criminal gangs involved in reported cybercrime incidents. However, to the best of our knowledge, there is no framework to map the cybercrime incident narratives to the tactics, techniques and procedures (TTPs) used by cybercriminals, nor are the processes used by cybercrime investigating officers mapped to such TTPs to create a systematic modus operandi for the investigators to solve a cybercrime, cluster multiple crime incidents as attributable to a specific cybercrime operator, or systematically map a set of evidence collected to a pattern of TTPs. In this paper, we present a TTP-based framework for classified cybercrimes to formulate a comprehensive strategy for cybercrime interpretation and action recommendations for law enforcement officers, which can be used as a reference point to establish targeted threat models and incident response methodologies for cybercrime investigations.