Maybe I should prove that I am not against AI and that I do use AI for my daily job.
In this post I will describe how I extracted MITRE ATT&CK techniques from an incident report automatically, by using Gemini (MITRE ATT&CK is a powerful framework for reasoning about attacks and I use this framework intensively in my Cybersecurity course).
First a bit of context. Yesterday I posted this note on the team of the course:
A recent technical report by Google is a concrete example of many of the concepts discussed in some of the recent lectures.
- New attack campaigns are discovered by highly skilled organizations,
- there is an infection chain leading to the final malware,
- the infection chain may be composed of multiple obfuscated scripts downloaded and executed from different locations,
- vulnerabilities that may or may not be publicly known at the time of their exploitation allow escalating privilege,
- IoC and YARA rules are released for the benefit of the rest of the world
- ...
The report does not follow the MITRE ATT&CK framework, but the terminology is clear and familiar to us.
Google Threat Intelligence Group (GTIG) has identified a new iOS full-chain exploit that leveraged multiple zero-day vulnerabilities to fully compromise devices....we believe the exploit chain to be called DarkSword. Since at least November 2025, GTIG has observed multiple commercial surveillance vendors and suspected state-sponsored actors utilizing DarkSword in distinct campaigns....DarkSword utilizes six different vulnerabilities to deploy final-stage payloads. GTIG has identified three distinct malware families deployed following a successful DarkSword compromise: GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER.
...
The landing page on the website included JavaScript code using a mix of obfuscation techniques, and created a new IFrame that pulled in another resource at frame.html...it is a simple HTML file that dynamically injects a new script tag that loads in the main exploit loader, rce_loader.js. The loader performs some initialization used by subsequent stages, and fetches a remote code execution (RCE) exploit from the server
The Proliferation of DarkSord: iOS Exploit Chain Adopted by Multiple Threat Actors
This morning, I tried to automatically extract tactics and techniques from that report using Gemini. I quickly obtained a nicely formatted table. At first glance, the result seems OK in that it matches my understanding from a quick reading of the report.
Of course, one should rigorously assess precision (i.e. whether what has been extracted is indeed correct) and recall (i.e. whether everything has been extracted), but that would require a significant amount of effort. I think this workflow is more than sufficient for grasping the report's essentials and is indeed very useful.
At this link a spreadsheet with the extracted techniques and the prompt that I used.
Comments and criticisms more than welcome.
(UPDATE)
A clear example of the intrinsic limitations of AI. Limitations that make its usage in "autonomous" applications that require high reliability extremely dangerous and to be avoided.
I have added this prompt (bold mine):
construct also a table with one row for each exploited vulnerability. columns CVE-id (linked to the NVD website), cve name, brief summary of the vulnerability, whether it was exploited as a zero day
Gemini returned a table with all the 6 vulnerabilities exploited in this campaign, all marked as "exploited as a zero day" (zero day means unknown to the vendor and to the general public at the time of exploitation).
This is wrong. Only 4 of them were zero day at the time of their exploitation.
Commenti