  Understanding the modus operandi of adversaries aids organizations in
employing efficient defensive strategies and sharing intelligence in the
community. This knowledge is often present in unstructured natural language
text within threat analysis reports. A translation tool is needed to interpret
the modus operandi explained in the sentences of the threat report and
translate it into a structured format. This research introduces a methodology
named TTPXHunter for the automated extraction of threat intelligence in terms
of Tactics, Techniques, and Procedures (TTPs) from finished cyber threat
reports. It leverages cyber domain-specific state-of-the-art natural language
processing (NLP) to augment sentences for minority class TTPs and refine
pinpointing the TTPs in threat analysis reports significantly. The knowledge of
threat intelligence in terms of TTPs is essential for comprehensively
understanding cyber threats and enhancing detection and mitigation strategies.
We create two datasets: an augmented sentence-TTP dataset of 39,296 samples and
a 149 real-world cyber threat intelligence report-to-TTP dataset. Further, we
evaluate TTPXHunter on the augmented sentence dataset and the cyber threat
reports. The TTPXHunter achieves the highest performance of 92.42% f1-score on
the augmented dataset, and it also outperforms existing state-of-the-art
solutions in TTP extraction by achieving an f1-score of 97.09% when evaluated
over the report dataset. TTPXHunter significantly improves cybersecurity threat
intelligence by offering quick, actionable insights into attacker behaviors.
This advancement automates threat intelligence analysis, providing a crucial
tool for cybersecurity professionals fighting cyber threats.
