# Analysis of Cyber-Intelligence Frameworks for AI Data Processing
## 4 Materials and Methods
### Application of the Mitre Att&ck Model  
The data associated with the incident are structured according to the v10.1 matrix version in the web browser (see Table 2) and include the indicated techniques with their corresponding numerical identifiers.  
\begin{table}
\begin{tabular}{l l l} \hline \hline
**ATTACK PHASE** & **INDICATORS** \\ \hline  & \multicolumn{2}{c}{Access with administrator credentials admdp08} \\  & \multicolumn{2}{c}{PsExec lateral movements (since 01/07/2021 12:05)} \\
3. DEPLOYMENT & \multicolumn{2}{c}{Deployment of Cobalt Strike Beacons (since 06/07/2021 17:21)} \\  & \multicolumn{2}{c}{Access to Domain Controller (DC) listings (06/07/2021 18:14)} \\  & \multicolumn{2}{c}{[...]} \\ \hline
4. EXPLOITATION & \multicolumn{2}{c}{Displays BazarLoader “desktop.dll” in DC and executes} \\  & \multicolumn{2}{c}{SystemBC and Cobalt Strike malware (08/07/2021 21:27 21:31)} \\ \hline
5. INSTALLATION & \multicolumn{2}{c}{Malware Ryuk “82.exe” (09/07/2021 19:24) and “6 hr.exe”} \\  & \multicolumn{2}{c}{(09/07/2021 4:17) in C: Windows.} \\ \hline  & \multicolumn{2}{c}{Cobalt Strike and SystemBC connections to the following C2:} \\  & \multicolumn{2}{c}{IP Address-Domain —.26.29.242-culunk[.].com} \\
6. C2 & \multicolumn{2}{c}{IP Address-Domain —.26.29[.]245-eochea[.].com} \\  & \multicolumn{2}{c}{IP Address-Domain —.141.84[.]190-smadst[.]com} \\  & \multicolumn{2}{c}{IP address-Domain —.141.210[.]78-choopa[.]com} \\  & \multicolumn{2}{c}{IP address-Domain —.141.87[.]60-vultr[.]com} \\  & \multicolumn{2}{c}{IP address-Domain —.141.87[.]76-dorkeditt[.]com [...]} \\ \hline  & \multicolumn{2}{c}{Massive encryption of information on computers with} \\
7. ACTIONS TO OBJECTIVES & \multicolumn{2}{c}{AES256 symmetric algorithm, and subsequent encryption of} \\  & \multicolumn{2}{c}{AES key with RSA asymmetric algorithm.} \\ \hline \hline \end{tabular}
\end{table}
Table 1: \(Cont.\)  
\begin{table}
\begin{tabular}{l l l} \hline \hline
**TACTICS** & **TECHNIQUES** \\ \hline
1 & RECONNAISSANCE & T1589: Gather Victim Identity Information; \\  & (TA0043) & T1591: Gather Victim Org Information. \\ \hline
2 & RESOURCE DEVELOPMENT & T1584: Compromise Infrastructure; \\  & (TA0042) & T1588: Obtain Capabilities. \\ \hline
3 & INITIAL ACCESS & T1078: Valid Accounts \\  & (TA0001) & \\ \hline
4 & EXECUTION & - \\  & (TA0002) & - \\ \hline
5 & PERSISTENCE & T1078: Valid Accounts \\  & (TA0003) & \\ \hline
6 & PRIVILEGE ESCALATION & T1078: Valid Accounts \\  & (TA0004) & \\ \hline
7 & DEFENCE EVASION & T1078: Valid Accounts \\  & (TA0005) & \\ \hline
8 & ACCESS CREEDENTIALS & - \\  & (TA0006) & \\ \hline
9 & DISCOVERY & T1069: Permission Groups Discovery \\  & (TA0007) & \\ \hline \hline \end{tabular}
\end{table}
Table 2: Application of the Mitre Att&ck model to the case under analysis.  
As reflected in the previous table, it can be seen that the possession of administrator credentials (admdp08) reduced the need to deploy techniques in various tactics, paving the way for attackers, especially in privilege escalation and persistence acquisition. Although the indicators of compromise are not explicitly shown, a structured matrix is obtained with the sequence used in the attack that represents the TTPs, which are much more reliable indicators for the analysis of an attack given the volatility of the IOCs. The representation of the sequence through a matrix allows comparisons to be made with other attacks, which, in turn, can be captured in a Mitre matrix. In this sense, this model allows the comparison of the RASK attack with other attacks and a mathematical treatment to help in this task.