SECOPS 3: Incident Analysis in a Threat Centric SOC Flashcards
Kill Chain steps
Recon Weaponization Delivery Exploitation Installation C2 Actions on Objectives
What is a kill chain?
Process of an attacker building a plan to effect a specific goal against a target
Weaponization
Development of a cyber weapon based on recon of a target
Delivery
Transmission of payload via communication vector
Exploitation
Executing the malicious code.
Results in access to the target system.
3 Typical system weaknesses
Apps, OS, Users
Installation phase
Establish persistence/back door
C2 Phase
Exploited hosts beacon to the C2 server.
Actions on objectives
Objective dependent actions taken by attacker.
The point of the whole thing
Recon mitigation
NGFW, NGIPS
Weaponization mitigation
Threat Intelligence
Delivery Mitigation
DNS, Email, Web Security, NGIPS
Exploit mitigation
Network Anti-Malware, NGFW, NGIPS
Installation mitigation
Host Anti-Malware
C2 Mitigation
DNS Security, Web Security, NGIPS
