Cyber Threats and Kill Chain Methodology Flashcards
1) Overview of Cyber Threats
<p>A cyber threat is defined as an act in which the adversary attempts to <span><strong>gain unauthorized access</strong></span> to an organization’s network by exploiting communication paths.</p>
<p>Adversaries use cyber threats to <strong><span>infiltrate and steal data</span> </strong>such as individual’s personal information, financial information, and login credentials.</p>
2) Cyber Security Attack Vectors
<ol><li>Cloud Computing Threats</li><li>Advanced Persistent Threat (APT)</li><li>Viruses and Worms</li><li>Ransomware</li><li>Mobile Threats</li><li>Botnet</li><li>Insider Threat</li><li>Phishing</li><li>Web Application Threats</li><li>IoT Threats</li></ol>
3) Cyber Security Threat Categories
<ul><li><strong>Network Threats</strong><ul><li>Information gathering</li><li>Sniffing and eavesdropping</li><li>Spoofing</li><li>Session hijacking and Man-in-the-Middle attack</li><li>DNS and ARP Poisoning</li><li>Password-based attacks</li><li>Denial-of-Service attacks</li><li>Compromised-key attacks</li><li>Firewall and IDS attacks</li></ul></li><li><strong>Malware attacks</strong><ul><li>Footprinting</li><li>Profiling</li><li>Password attacks</li><li>Denial-of-Service attacks</li><li>Arbitrary code execution</li><li>Unauthorized access</li><li>Privilege escalation</li><li>Backdoor attacks</li><li>Physical security threats</li></ul></li><li><strong>Application Threats</strong><ul><li>Improper data/Input validation</li><li>Authentication and authorization attacks</li><li>Security misconfiguration</li><li>Information disclosure</li><li>Hidden-field tampering</li><li>Broken session management</li><li>Buffer overflow issues</li><li>Cryptography attacks</li><li>SQL injection</li><li>Phishing</li><li>Improper error handling and exception management</li></ul></li></ul>
4) Threat Actors/Profiling the Attacker
<p><strong>Hacktivist</strong> Individuals who promote a political agenda by hacking, especially by defacing or disabling websites</p>
<p><strong>Cyber Terrorists</strong>Individuals with a wide range of skills, motivated by religious or political beliefs to create fear of large-scale disruption of computer networks</p>
<p><strong>Suicide Hackers </strong>Individuals who aim to bring down the critical infrastructure for a “cause” and are not worried about facing jail terms or any other kind of punishment</p>
<p><strong>State-Sponsored Hackers </strong>Individuals employed by the government to penetrate and gain top-secret information and to damage information systems of other governments</p>
<p><strong>Organized Hackers </strong>Professional hackers having an aim of attacking a system for profits</p>
<p><strong>Script Kiddies </strong>An unskilled hacker who compromises system by running scripts, tools, and software developed by real hackers</p>
<p><strong>Industrial Spies </strong>Individuals who try to attack the companies for commercial purposes</p>
<p><strong>Insider Threat </strong>Threat that originates from people within the organization such as disgruntled employee, terminated employee, and undertrained staff</p>
5) Threat intent capability opportunity triad
<ul><li>There is always an intent, capability, and opportunity behind a threat to exist.
<ul><li><span><strong>Intent</strong></span>: Goal of an adversary behind targeting the organization</li><li><strong><span>Capability</span></strong>: Tactics, Techniques, and Procedures (TTPs) that an adversary can use to target the organization</li><li><span><strong>Opportunity</strong></span>: Security vulnerability or weakness exists in organization that can allow an adversary to target the organization</li></ul></li><li>In Cyber Threat Intelligence (CTI), analysis is performed based on the intent, capability, and opportunity triad.</li><li>With the study of this triad, experts can <span><strong>evaluate and make informed</strong></span>, forward-leaning strategic, operational, and tactical <span><strong>decisions on existing or emerging threats</strong></span> to the organization.</li></ul>
6) Motives goals and objectives of cyber-security attacks
<ul><li><h3><span><strong>Attacks</strong></span> = <strong>Motive (Goal) + Method + Vulnerability</strong></h3></li><li><h3>A motive originates out of the notion that the <span><strong>target system stores or processes</strong></span> something valuable and this leads to threat of an attack on the system.</h3></li><li><h3>Attackers try various tools and attack techniques to <strong><span>exploit vulnerabilities</span></strong> in a computer system or security policy and controls to achieve their motives</h3></li></ul>
<p></p>
<p><strong>Motives Behind Cyber Security Attacks</strong></p>
<ul><li>Disrupting business continuity</li><li>Information theft</li><li>Manipulating data</li><li>Creating fear and chaos by disrupting critical infrastructures</li><li>Financial loss to the target</li><li>Propagating religious or political beliefs</li><li>Achieving state's military objectives</li><li>Damaging reputation of the target</li><li>Taking revenge</li><li>Demanding ransom</li></ul>
7) Hacking forums
<h3><strong>Hacking forums provide information related to hackers such as </strong></h3>
<ul><li><h3><span>Methods</span> used to launch an attack</h3></li><li><h3><span>Techniques and tools</span> used to perform an attack</h3></li><li><h3><span>Procedures</span> followed for covering the tracks after an attack</h3></li></ul>
<p></p>
<h3><strong>Hacking Forums links</strong></h3>
<ul><li><h4>Hack Forums (https://hackforums.net)</h4></li><li><h4>Hackaday (https://hackaday.com)</h4></li><li><h4>The Ethical Hacker Network (https://www.ethicalhacker.net)</h4></li><li><h4>Hack This Site (https://www.hackthissite.org)</h4></li><li><h4>Hak5 Forums (https://forums.hak5.org)</h4></li><li><h4>Evil Zone (https://evilzone.org)</h4></li><li><h4>Hack In The Box (http://www.hitb.org)</h4></li><li><h4>The Hacker News (https://thehackernews.com)</h4></li><li><h4>0x00sec (https://0x00sec.org</h4></li><li><h4>Exploit Database (https://www.exploit-db.com)</h4></li><li><h4>Packet Storm (https://packetstormsecurity.com)</h4></li></ul>
8) Definition of Advanced persistent threats
<ul><li>Advanced Persistent Threats (APTs) are defined as a <strong><span>type of network attack</span></strong>, where an attacker gains unauthorized access to a target network and remains there undetected for a long period of time.</li><li>The main objective behind these attacks is to <strong><span>obtain sensitive information</span></strong> rather than sabotaging the organization and organization’s network.</li></ul>
<p><strong>Information Obtained during APT attacks</strong></p>
<ul><li><strong>Classified documents</strong></li><li><h4>User credentials</h4></li><li><h4>Employee or customer’s personal information</h4></li><li><h4>Network information</h4></li><li><h4>Transaction information</h4></li><li><h4>Credit card information</h4></li><li><h4>Organization’s business strategy information</h4></li><li><h4>Control system access information</h4></li></ul>
9) Characteristics of APTs
<ol><li><strong>Objectives:</strong>Obtaining sensitive information or fulfilling political or strategic goals</li><li><strong>Timeliness: </strong>Time taken by the attacker from assessing the target’s system for vulnerabilities to gaining and maintaining access</li><li><strong>Resources: </strong>Amount of knowledge, tools, and techniques required to carry out an attack</li><li><strong>Risk Tolerance: </strong>Level up to which the attack remains undetected in the target’s network</li><li><strong>Skills and Methods: </strong>Methods and tools used by the attackers to perform certain attack</li><li><strong>Actions: </strong>APT consists of a certain number of technical “actions” that makes them different from other cyberattacks</li><li><strong>Attack Origination Points: </strong>Numerous attempts to gain entry to the target’s network</li><li><strong>Numbers Involved in the Attack: </strong>Number of host systems that are involved in the attack</li><li><strong>Knowledge Source: </strong>Gathering information through online sources about specific threats</li><li><strong>Multi-phased: </strong>APT attacks are multiphased which include reconnaissance, gaining access, discovery, capture, and data exfiltration</li><li><strong>Tailored to the Vulnerabilities: </strong>APTs target-specific vulnerabilities present in the victim’s network</li><li><strong>Multiple Points of Entries: </strong>Adversary creates multiple points of entries through the server to maintain access to the target network</li><li><strong>Evading Signature-Based Detection Systems: </strong>APT attacks can easily bypass the security mechanisms such as firewall, antivirus software, IDS/IPS, and email spam filter</li><li><strong>Specific Warning Signs: </strong>Specific indications of an APT attack include inexplicable user account activities, presence of a backdoors, unusual file transfers and file uploads, unusual database activities, etc.</li></ol>
10) APT life-cycle
<ol><li><strong>Preparation</strong><ol><li>Define target</li><li>research target</li><li>Organize team</li><li>Build or attain tools</li><li>test for detection</li></ol></li><li><strong>Initial Intrusion</strong><ol><li>Deployment of malware</li><li>Establishment of outbound connection</li></ol></li><li><strong>Expansion</strong><ol><li>Expand access</li><li>Obtain credeantials</li></ol></li><li><strong>Persistent</strong><ol><li>Maintian access</li></ol></li><li><strong>Search and Exfiltration</strong><ol><li>Exfiltration data</li></ol></li><li><strong>Cleanup</strong><ol><li>Cover tracks</li><li>Remain undetected</li></ol></li></ol>
11) Cyber Kill Chain Methodology
<ul><li>The cyber kill chain methodology is a component of intelligence-driven defense for identification and <span><strong>prevention of malicious intrusion activities. </strong></span></li><li>It provides greater insight into attack phases, which helps analysts to understand the <strong><span>adversary’s TTPs beforehand.</span></strong></li></ul>
<p><strong>Reconnaissance </strong>Gather data on the target to probe for weak points</p>
<ol><li>Gathering information about the target organization by searching the Internet or through social engineering</li><li>Performing analysis of various online activities and publicly available information</li><li>Gathering information from social networking sites and web services</li><li>Obtaining information about websites visited</li><li>Monitoring and analyzing the target organization’s website</li><li>Performing Whois, DNS, and network footprinting</li><li>Performing scanning to identify open ports and services</li></ol>
<p><strong>Weaponization </strong>Create a deliverable malicious payload using an exploit and a backdoor</p>
<ol><li>Identifying appropriate malware payload based on the analysis</li><li>Creating a new malware payload or selecting/reusing/modifying the available malware payloads based on the identified vulnerability</li><li>Creating the phishing email campaign o Leveraging exploit kits and botnets</li></ol>
<p><strong>Delivery </strong>Send weaponized bundle to the victim using email, USB, etc.</p>
<ol><li>Sending phishing emails to the employees of the target organization</li><li>Distributing USB drives containing malicious payload to the employees of the target organization</li><li>Performing attacks such as watering hole on the compromised website</li><li>Implementing various hacking tools against operating systems, applications, and servers of the target organization</li></ol>
<p><strong>Exploitation </strong>Exploit a vulnerability by executing code on the victim’s system</p>
<ol><li>Exploiting software or hardware vulnerability to gain remote access to the target system</li></ol>
<p><strong>Installation </strong>Install malware on the target system</p>
<ol><li>Downloading and installing malicious software such as backdoors</li><li>Gaining remote access to the target system</li><li>Leveraging various methods to keep backdoor hidden and running</li><li>Maintaining access to the target system</li></ol>
<p><strong>Command and Control </strong>Create a command and control channel to communicate and pass data back and forth</p>
<ol><li>Establishing a two-way communication channel between victim’s system and adversary-controlled server</li><li>Leveraging channels such as web traffic, email communication, and DNS messages.</li><li>Applying privilege escalation techniques</li><li>Hiding the evidence of compromise using techniques such as encryption</li></ol>
<p><strong>Actions on Objectives </strong>Perform actions to achieve intended objectives/goals</p>
<p></p>
12) Tactics, Techniques and Procedures
<p>The term Tactics, Techniques, and Procedures (TTPs) refers to the <strong><span>patterns of activities and methods</span></strong> associated with specific threat actors or groups of threat actors.</p>
<p><strong>Tactics</strong></p>
<ul><li>“Tactics” is defined as a guideline that describes the <span><strong>way an attacker performs the attack</strong></span> from beginning to the end.</li><li>It consists of various <strong><span>tactics of information gathering</span></strong> to perform initial exploitation, perform privilege escalation, perform the lateral movement, deploy measures for persistence access to the system, etc.</li><li>An organization can <strong><span>profile threat actor based on tactics they use</span></strong>, this consists of the way they gather information about a target, methods they follow for initial compromise, and the number of entry points used while attempting to enter into the target network.</li></ul>
<p><strong>Techniques</strong></p>
<ul><li>“Techniques” is defined as <strong><span>technical methods used by an attacker</span></strong> to achieve intermediate results during the attack.</li><li>These techniques include <strong><span>initial exploitation</span></strong>, setting up and maintaining <strong><span>command and control channels</span></strong>, accessing the target infrastructure and cover tracks of data exfiltration, etc.</li><li>After aggregation of techniques used in all the stages of an attack, the organization can use the information to <span><strong>profile the threat actors</strong></span>.</li></ul>
<p><strong>Procedures</strong></p>
<ul><li>“Procedures” is defined as <strong><span>organizational approach followed by the threat actors</span></strong> to launch an attack.</li><li>The number of <strong><span>actions usually differ</span></strong> depending upon the objective of the procedure and threat actor group.</li><li>For example, in a basic procedure of information gathering, an actor collects information about the target organization, identify key targets, employees, collect contact details, identify vulnerable systems, potential entry points to the target network, and document all the collected information.</li><li>By understanding and proper analysis of the procedures followed by certain threat actors during an attack <span><strong>helps the organization to profile the threat actor</strong></span>.</li></ul>
13) Adversary Behavioural Identification
<p>Adversary behavioral identification involves the <strong><span>identification of common methods</span></strong> or techniques followed by an adversary to launch attacks to penetrate an organization’s network.</p>
<p>It gives an insight to the security analysts on <strong><span>upcoming threats and exploits</span></strong>.</p>
<ol><li><h4><strong>Internal Reconnaissance</strong></h4></li><li><h4><strong>Use of PowerShell</strong></h4></li><li><h4><strong>Unspecified Proxy Activities</strong></h4></li><li><h4><strong>Use of Command-Line Interface</strong></h4></li><li><h4><strong>HTTP User Agent</strong></h4></li><li><h4><strong>Command and Control Server</strong></h4></li><li><h4><strong>Use of DNS Tunneling</strong></h4></li><li><h4><strong>Use of Web Shell</strong></h4></li><li><h4><strong>Data Staging</strong></h4></li></ol>
14) Kill Chain Deep dive scenario- Spear Phishing
<p></p>
<strong>Kill Chain Phase</strong><strong>Scenario</strong><strong>Use Cases</strong>
Reconnaissance
<p> The target organization’s employee posts information about his project, position in the organization, and interest on the social networking website such as Facebook and LinkedIn</p>
<p> Adversary gathers contact details of the target employee from the social networking site</p>
Weaponization
<p> Adversary creates a deliverable malware payload using an exploit and a backdoor</p>
<p> Adversary prepares a command and control server to manage his activities on the target’s network and drop-zone servers on the Internet</p>
<p> Adversary drafts plausible phishing email with attached malicious payload</p>
<p> Adversary ensures that the antivirus does not detect the attachment</p>
Delivery
<p> Adversary sends a phishing email to the target employee</p>
<p> Email passes through target organization’s antivirus protection</p>
<p> Suspicious attachment including the password in an email message</p>
<p> Suspicious file type download</p>
Exploitation
<p> The target employee opens the legitimate-looking email and downloads the attachment and double-clicks the malicious file Exploitation</p>
<p> The EXE file is executed, which installs several files in the root folder and modifies registry keys</p>
<p> The adversary takes advantage of the unpatched vulnerability in the target system to escalate privileges</p>
<p> Malware infects the system</p>
<p> Execution of malicious program, which is not whitelisted</p>
Installation
<p> Malware is launched after installation, which leads to persistence access to the target system</p>
<p> Malware sends a signal and establishes a back channel with the command and control server using organization’s HTTP proxy server</p>
<p> Adversary spreads the infection to other end systems in the network</p>
<p> Suspicious activities of the proxy server</p>
<p> Execution of new program, which is not whitelisted, generating network traffic</p>
Command and Control
<p> Adversary obtains locally stored password hashes and a hash of user account in domain admin group on another workstation computer from the target’s system</p>
<p> Adversary establishes a two-way communication channel between compromised systems and C&C server using HTTP</p>
<p> Adversary performs remote exploitation on the target system or network</p>
<p> Command and control blacklist</p>
<p> Domain accessed not in the whitelist</p>
<p> Protocol vulnerabilities</p>
Actions on Objectives
<p> Adversary searches for files of interest in all the systems by establishing a connection with them using domain</p>
<p> Adversary finds and collects the files using file sharing on the main computer and encrypts the files in RAR archive</p>
<p> Adversary transfers the RAR from the target system to his drop-zone servers through organization’s proxy server</p>
<p> Usage of admin privileges</p>
<p> RAR file detected</p>
<p> Usage of same credentials on multiple systems</p>
<p></p>
15) Indicators of compromise
<p>Indicators of Compromise (IoCs) are the <span><strong>clues/artifact/pieces of forensic data</strong></span> that are found on a network or operating system of an organization that indicates a potential intrusion or malicious activity in organization’s infrastructure.</p>
<p>IoCs are itself not intelligence, in fact, IoCs <strong><span>act as a good source of information</span></strong> about threats that serve as data points in the intelligence process.</p>
<p>The security analysts need to <span><strong>perform continuous monitoring</strong></span> of Indicators of Compromise (IoCs) to effectively and efficiently detect and <strong><span>respond to the evolving cyber threats.</span></strong></p>
