|
Following K-means clustering, data is labeled based on the payload content using MITRE ATT&CK's Tactic, Technique, and Subtechnique. As you can see on the left-hand side, the first payload content means Get Certain Device Information, so its Tactic is Discovery, and its Technique is Peripheral Device Discovery. The second payload is brute force attack visibility, its Tactic is Credential Access, and its Technique is Brute Force. The last one is Download Malicious File, which belongs to the Execution and it¡¯s Technique is Command and Scripting Interpreter. |