IEEE/ICACT20230053 Slide.07        [Big Slide]       Oral Presentation
Now we can observe an attack session that followed Cyber Kill Chain in the cowire log, it first tries to stop the iptables service, and then downloads a malicious file, sets file permissions as executable, next will start the process running in the background, to achieve Persistence, and finally close the SSH connection.

[Go to Next Slide]
Select Voice: