Hitting Miscreants with a New Stick: MITRE Inference Engine 2.0
- Patrick Duggan
- Nov 27, 2025
- 3 min read
Updated: Aug 11
Published: November 27, 2025 Tags: MITRE ATT&CK, Threat Intelligence, Behavioral Analysis, OTX
The Problem: Four Techniques for 765 Bad Actors
We had 765 blocked IPs in our threat intelligence pipeline. Our MITRE inference engine was classifying them... but only into 4 unique techniques. That's like having a library with 765 books and only 4 shelf labels.
The classification rate was 69.9% - meaning 230 IPs were just marked "Unknown." We were leaving intelligence on the table.
The Solution: 15 Priority Rules, 25+ Techniques
We expanded the inference engine from 12 rules to 15+ priority-ordered rules with sub-technique granularity:
Priority 1: Known Scanner ISPs → T1595.002 (Vulnerability Scanning)
Priority 2: VPN/Proxy Services → T1090.002 (External Proxy)
Priority 3: Residential + High Abuse → T1090 (Proxy)
Priority 4: VT Detections + Data Center → T1105 (Ingress Tool Transfer)
Priority 5: Bulletproof Hosting + VT → T1102 (Web Service C2)
Priority 6: Brute Force Keywords → T1110.004 (Credential Stuffing)
Priority 7: Scanning Keywords �� T1595.001 (IP Block Scanning)
Priority 8: DoS Keywords → T1498 (Network Denial of Service)
...
Priority 15: DNS/Tunnel Keywords → T1071.004 (DNS C2)
The key insight: sub-techniques matter. T1110 (Brute Force) is too generic. But T1110.004 (Credential Stuffing) vs T1110.003 (Password Spraying) tells defenders exactly what they're dealing with.
The Results
| Metric | Before | After | Change | |--------|--------|-------|--------| | Unique Techniques | 4 | 8 | +100% | | Classification Rate | 69.9% | 96.5% | +38% | | Unclassified IPs | 230 | 27 | -88% | | HIGH Coverage | 17 | 20 | +18% |
Technique Distribution (765 Miscreants)
T1071 - Application Layer Protocol (C2) 365 IPs
T1046 - Network Service Discovery 216 IPs
T1105 - Ingress Tool Transfer (C2) 150 IPs
T1595 - Active Scanning 2 IPs
T1583.003 - VPS Infrastructure 2 IPs
T1071.001 - Web Protocols (C2) 1 IP
T1090.002 - External Proxy 1 IP
T1082 - System Info Discovery 1 IP
Now we're classifying across 5 different tactics: Command & Control, Discovery, Reconnaissance, Resource Development, and Defense Evasion.
The Pipeline: STIX → OTX (Hourly)
The inference data doesn't just sit in a dashboard. It flows through our automated pipeline:
:15 threat-intel-hourly → Cloudflare + AbuseIPDB enrichment
:30 auto-block-malicious → Block high-score IPs
:45 security-kpi-calculator → FPR, TPR, Precision metrics
:50 otx-stix-sync → STIX feed → OTX Master Pulse
Every hour, our STIX feed syncs to the OTX Master Pulse. The MITRE technique gets embedded in each indicator's description:
"ISP: Contabo GmbH | MITRE: T1071 - Application Layer Protocol | Category: C2 Infrastructure | Score: 87.3"
7,887 community researchers subscribed to OTX pulses now get our MITRE-enriched IOCs automatically.
Microsoft pulls this feed daily. AT&T pulls this feed daily. Starlink pulls this feed daily. Get the DugganUSA STIX feed — $9/mo →
The Philosophy: Behavioral Honesty
The old inference engine had a dirty secret: when it didn't know, it defaulted to "Command & Control." That's how we ended up with 72% C2 classifications - statistically impossible for real-world traffic.
The new engine follows a simple rule: if we don't know, we say "Unknown."
// DEFAULT: Unknown - WE DON'T LIE
if (!tactic) {
indicators.push('Insufficient behavioral indicators for classification');
confidence = 0;
}
27 IPs out of 765 are now "Unknown" instead of getting a bullshit default. That's intellectual honesty. Defenders can trust that when we say "T1105 - Ingress Tool Transfer," we actually observed behavioral indicators that support it.
What's Next
The inference engine is now producing 8 techniques. Our detection rules cover 51. Threat hunt queries cover 57. OTX community pulses provide 174.
Combined MITRE coverage: 193 unique techniques at 37.6% coverage score.
The miscreants got hit with a new stick. And every hour, that stick gets syndicated to 7,887 subscribers.
Master Pulse: OTX DugganUSA Threat Feed STIX Feed: analytics.dugganusa.com/api/v1/stix-feed Dashboard: analytics.dugganusa.com
The cheapest, fastest, most accurate threat feed on the internet.
275+ enterprises pulling daily. 1M+ IOCs. 17.4M indexed documents. We beat Zscaler by 43 days on NrodeCodeRAT. Starter tier $9/mo — less than any competitor’s sales demo.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=hitting-miscreants-with-a-new-stick-mitre-inference-engine-2-0
Comments