Focusing on the Weakest Link: A Similarity Analysis on Phishing Campaigns Based on the ATT&CK Matrix

Figure 1

The methodology consists of 6 steps. (a) Collect cyber incidents. (b) Extract features. (c) Define campaign. (d) Extract TTPs of campaigns. (e) Calculate ATT&CK matrix similarity. (f) Derive countermeasures.