Section 1.2: Threat Intelligence

Question 1

What is TTP?

Answer 1

Techniques, tactics, and procedures.

Question 2

What is the Attack cycle like?

Answer 2

External recon -> Compromised machine -> Internal Recon -> Local Privilege Escalation -> Compromise Creds -> Admin Recon -> Remote Code Execution -> Domain Admin Creds -> Domain Dominance -> Remote Code Execution -> Asset Recon -> Local Privilege Escalation -> Asset Access -> Exfiltration

Question 3

What steps are inside the Cyber Kill Chain?

Answer 3

Recon, Weaponization, Delivery, Exploitation, Installation, Command & Control, and Actions on Objective

Question 4

How do responders develop profiles on their adversaries?

Answer 4

They record, track and group information on the attack to create a profile. All adversaries have preferences on how to commit intrusions and what tools they use.

Question 5

Name the types of indicators responder’s document.

Answer 5

Atomic Indicators, Computed Indicators, and Behavioral Indicators.

Question 6

What are Atomic Indicators?

Answer 6

pieces of data that are indicators of adversary activity on their own (IP addresses, email, static string C2 channels, and domain names).

Question 7

What are Computed Indicators?

Answer 7

Pretty much computed. The most common are hashes of malicious files or specific data that is decoded in custom C2 channels. IDS signatures can apply as well.

Question 8

What are Behavioral Indicators?

Answer 8

They are a combination of indicators, including other behaviors, to form a profile.

Question 9

Which indicator is which in this example:
-Using IP address to target sales
-Trojaned MS Word docs
-C2 is created to communicate to A.B.C.D.

Answer 9

1st: Behavioral
2nd: Computed
3rd: Atomic

Question 10

What is an open mail relay and why is it important?

Answer 10

An open mail relay is a Simple Mail Transfer Protocol (SMTP) server configured in such a way that it allows anyone on the Internet to send e-mail through it, not just mail destined to or originating from known users. This is a way adversaries can keep sending spoof emails.

Question 11

What are some ways adversaries can recon an organization.

Answer 11

They can do it through portscans, system enumeration, browsing company sites, pulling down PDF’s, and learning the structure of the organization.

Question 12

What is weaponization?

Answer 12

The technique adversaries use to obfuscate shellcode.

Question 13

What is a single-phase exploit and a multi-phase exploit?

Answer 13

A single-phase exploit is the result of a compromised host behaving according to the attacker’s wishes. A multi-phase exploit involves delivery of a shellcode with the function of downloading more capable code.

Question 14

Name two methods an adversary can exploit an enterprise.

Answer 14

Through hardware vulnerability and through human vulnerability “social engineering”.

Question 15

What is a trouble and adversary may run into after installing their malware into the victim’s PC?

Answer 15

The tool they to exploit may not be compatible for usage therefore they may not get a response back from it.

Question 16

Name a few goals adversaries have in mind with Actions on Objectives.

Answer 16

Exfiltrating data, data destructing, and causing denial of service.

Question 17

Define adversary persistence.

Answer 17

The act of maintaining a presence in the network, as well as repeatedly attempting to gain access to areas where presence isn’t established.

Question 18

Why is it important to document the cyber kill chain?

Answer 18

So that responders can reconstruct the path and tools adversaries used to exploit the enterprise. Tools that they used that were proven ineffective must be synthesized “reversed engineered” as well. Failure to do so makes responders ineffective.

Question 19

Why was the Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) constructed?

Answer 19

To describe the actions and adversary may take when operating inside an enterprise. Its designed to help describe post-compromise behavior. It also expands network defender’s knowledge on adversary TTP’s.

Question 20

What are the twelve categories in ATT&CK?

Answer 20

Initial Access, Execution, Persistence, Priviledge Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command & Control, Exfiltration, and Impact.

Question 21

The goal of FOR508 is…

Answer 21

Educate analysts adversary techniques and demonstrate how to find them with the tools given.

Question 22

What is an Indicator of Compromise (IOC)?

Answer 22

An IOC describes attacker tools and tradecraft using a precise language where humans and security tools can understand it.

Question 23

Two broad types of IOC’s are…

Answer 23

Host-based indicators and network-based indicators.

Question 24

Name four IOC languages and two tools for managing them.

Answer 24

Yara, Stix, OpenIOC, and Taxii. To manage, the tools are CRITS and MISP.