Looking Beyond IoCs: Automatically Extracting Attack Patterns from External CTI