There is no human making a decision on what attacks to run. They check for literally everything. 20 years ago, I ran a web server and would run 'tail -f' on the access logs. I watched the bots sending requests for files that only exist on linux, then send requests for files that only exist on windows. They don't know what kind of system they are hacking. They just know that there is a computer at that IP address.

There are databases that list every known flaw in existence, and the bots just go down the list checking each and every one. And if it doesn't work, in 5 minutes, they'll run those same tests again as if something changed in those 5 minutes.

Yep, this kind of stuff is easily automated these days and bots don't get bored.