  Context: Cybersecurity vendors often publish cyber threat intelligence (CTI)
reports, referring to the written artifacts on technical and forensic analysis
of the techniques used by the malware in APT attacks. Objective: The goal of
this research is to inform cybersecurity practitioners about how adversaries
form cyberattacks through an analysis of adversarial techniques documented in
cyberthreat intelligence reports. Dataset: We use 594 adversarial techniques
cataloged in MITRE ATT\&CK. We systematically construct a set of 667 CTI
reports that MITRE ATT\&CK used as citations in the descriptions of the
cataloged adversarial techniques. Methodology: We analyze the frequency and
trend of adversarial techniques, followed by a qualitative analysis of the
implementation of techniques. Next, we perform association rule mining to
identify pairs of techniques recurring in APT attacks. We then perform
qualitative analysis to identify the underlying relations among the techniques
in the recurring pairs. Findings: The set of 667 CTI reports documents 10,370
techniques in total, and we identify 19 prevalent techniques accounting for
37.3\% of documented techniques. We also identify 425 statistically significant
recurring pairs and seven types of relations among the techniques in these
pairs. The top three among the seven relationships suggest that techniques used
by the malware inter-relate with one another in terms of (a) abusing or
affecting the same system assets, (b) executing in sequences, and (c)
overlapping in their implementations. Overall, the study quantifies how
adversaries leverage techniques through malware in APT attacks based on
publicly reported documents. We advocate organizations prioritize their defense
against the identified prevalent techniques and actively hunt for potential
malicious intrusion based on the identified pairs of techniques.
