Mapping Exploit Code on Paste Sites to the MITRE ATT&CK Framework: A Multi-label Transformer Approach

This study automatically analyzes malicious code posted on public paste sites like Pastebin and maps it to MITRE ATT&CK, a standard catalog of attacker techniques, to produce early cyber threat intelligence. It introduces a hybrid deep-learning model (combining convolutional, Transformer, and BiLSTM components) that can assign multiple technique labels to each code snippet. The model set new best-in-class performance, and a case study revealed the tactics and tools attackers share on these sites.