SECOPS 3: Incident Analysis in a Threat Centric SOC Flashcards
Kill Chain steps
Recon Weaponization Delivery Exploitation Installation C2 Actions on Objectives
What is a kill chain?
Process of an attacker building a plan to effect a specific goal against a target
Weaponization
Development of a cyber weapon based on recon of a target
Delivery
Transmission of payload via communication vector
Exploitation
Executing the malicious code.
Results in access to the target system.
3 Typical system weaknesses
Apps, OS, Users
Installation phase
Establish persistence/back door
C2 Phase
Exploited hosts beacon to the C2 server.
Actions on objectives
Objective dependent actions taken by attacker.
The point of the whole thing
Recon mitigation
NGFW, NGIPS
Weaponization mitigation
Threat Intelligence
Delivery Mitigation
DNS, Email, Web Security, NGIPS
Exploit mitigation
Network Anti-Malware, NGFW, NGIPS
Installation mitigation
Host Anti-Malware
C2 Mitigation
DNS Security, Web Security, NGIPS
Action on Obj. Mitigation
Flow analytics
Diamond model nodes
Capability, Infrastructure, Adversary, Victim
Diamond model Type 1 infrastructure
Owned by adversary
Diamond model Type 2 infrastructure
Co-opted by adversary
Diamond model meta-features (6)
Timestamp Phase Result Direction Methodology Resources
