Chapter 7 - Protecting Against Advance Attacks Flashcards
Attack Frameworks
Used to identify Tactics, Techniques, and procedures used by attackers
Cyber kill chain
Tactics, techniques, and procedures used to disrupt a system or network.
- Reconnaissance, 2. Weaponization, 3. Delivery, 4. Exploitation, 5. Installation, 6. Command and Control (C2), 7. Actions on Objectives.
Reconnaissance
Researching and identifying a selected target
Weaponization
Delivering malware, via payload, such as putting a remote access Trojan into a MS Word doc.
- Delivery
Payload is delivered to target via email or usb. =
- Exploitation
After payload is delivered, weapon is triggered and activated to exploit a vulnerability within a application or operating system.
- Installation
Payload will install a remote access Trojan within the system to allow an attacker to remain present
- Command and Control (C2)
The infected system talks back to a malicious web based server, allowing the attacker to gain full control over the effected system
- Actions on Objectives
At this point the attacker can do whatever they want. Install ransomware or steal data, or render the system useless.
Diamond Model of Intrusion Analysis
Uses four key components in attempt to understand an attacker; Adversary, capabilities, Infrastructure, and Victim.
“Every intrusion event has an adversary that uses a capability across an infrastructure against a victim.”
Adversary
Identity; user names, email address, names on forums or social media
Capabilities
The malware, exploits and other tools used to hack and compromise the system.
Infrastructure
The internet domain names, emails, ip addresses, used by the attacker(s)
Victims
Can be identified by their names, email addresses, or network identifiers.
MITRE ATT&CK is a matrix of ten tactics and techniques attackers use to achieve each.
A matrix of ten tactics and techniques attackers use to achieve each;
initial access, execution, persistence, privilege escalation, defense evasion, credential access, discovery, lateral movement, collection and exfiltration, and command and control.
