CLOAK
An open knowledge base cataloging cybercriminal concealment tactics, techniques, and procedures, built from over 200 clear- and dark-web OpSec guides using a MITRE ATT&CK-style structure.
CLOAK (Concealment Layers for Online Anonymity and Knowledge) is a knowledge base documenting the operational security measures cybercriminals use to stay anonymous and avoid attribution. It was built by analyzing more than 200 OpSec guides from the clear web and dark web, and is structured like the MITRE ATT&CK framework into tactics, techniques, sub-techniques, and procedures, with an initial release identifying 13 tactics, 109 techniques, 679 sub-techniques, and 586 procedures.
The project distinguishes technical, behavioral, and physical concealment measures, and covers cyber-dependent, cyber-enabled, and machine-based crime types, including the phases before and after an attack. Its stated purpose is to help the security community identify gaps in countermeasures and detection, and to support fingerprinting threat actors by the concealment methods they use rather than only their attack TTPs.
An interactive version of the knowledge base is available online, and a recording of a talk on the project was given at a digital-forensics and incident-response conference.