Opportunities for Applying Cyber Threat Intelligence Technologies from Open Sources: A Case Study Using the MITRE ATT&CK Framework

Introduction. The relevance of employing OSINT (Open Source Intelligence) and CTI (Cyber Threat Intelligence) in the evolving landscape of cybersecurity is increasingly recognized. This is particularly evident in the growing number of targeted attacks and the limitations of traditional security measures in detecting them. There is a pressing need to address the key challenges associated with integrating OSINT and CTI data into corporate information security systems, as well as the automation of intelligence data collection and analysis processes. Objective. This study aims to explore the applicability of various OSINT tools for identifying vulnerabilities in information systems, using the MITRE ATT&CK framework and focusing on techniques from the "Reconnaissance" tactic. Methodology. The research methodology includes a comparative analysis of modern OSINT and CTI tools, a review of approaches to processing and interpreting threat intelligence data, and practical testing of selected MITRE ATT&CK tactics and sub-techniques. The study evaluates five sub-techniques under the "Reconnaissance" tactic: IP block scanning (T1595.001), wordlist scanning (T1595.003), DNS/passive DNS analysis (T1596.001), use of WHOIS data (T1596.002), and database scanning (T1596.005). Tools such as Nmap, Dirb, dig, WHOIS, and Shodan were utilized to implement these techniques. Results. Active IP block scanning and DNS analysis proved effective in identifying critical IT infrastructure vulnerabilities, including open ports and insecure service configurations. The use of Dirb and Shodan enabled the discovery of hidden vulnerabilities in web applications and internet-connected devices. WHOIS data analysis revealed risks associated with the public availability of domain ownership information, which can be exploited in phishing attacks and social engineering schemes. The findings highlight the importance of integrating OSINT with the MITRE ATT&CK framework for the systematic analysis of threats and vulnerabilities. The proposed approach enables organizations not only to detect potential threats but also to implement preventive measures such as WHOIS data monitoring, regular scanning of internet-exposed assets, and DNS record analysis. This contributes to enhanced cyber resilience and reduced risk of successful cyberattacks. Conclusion. The application of OSINT tools within the MITRE ATT&CK framework provides cybersecurity professionals with an effective means for proactively identifying threats and vulnerabilities. The results of this study can inform cybersecurity practices, including the development of new defense tools and the enhancement of existing threat monitoring systems. Future research will focus on the quantitative assessment of this approach’s effectiveness to better evaluate its impact on organizational cybersecurity.