Topic 1: Attack Structure

Understanding the Cyber Kill Chain

A model developed by Lockheed Martin shows the cyber kill chain is a concept used to understand and prevent cyber attacks. It is a framework that outlines the stages of a cyber attack, including reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives.

By understanding these stages, organizations can implement measures to detect and disrupt the attack at various points along the chain, ultimately enhancing their overall cybersecurity posture. Kill Chain analysis can identify a defensive course of action to counter the progress of an attack at each stage.

The Cyber Kill Chain is based on the MITRE ATT&CK framework. The MITER Corporation maintains a knowledge base that lists and explains specific adversary tactics, techniques, and common knowledge or procedures. 

Reconnaissance

An attacker determines what methods can be used to complete the attack phase.  

Resource Development: Get infrastructure information (via compromise or otherwise) → Build malware → Compromise accounts.

Initial Access:  Phishing, Hardware placements, Supply chain compromise, Exploit public-facing apps, OSINT, Google Dorking, Shodan.

Weaponization

The attacker couples payload codes that enable access with exploit code that will use a vulnerability to execute on the target system. 

Credential Access:

• Brute force, access password managers, keylogging.

• etc/passwd & etc/shadow.

• Windows DCSync, Kerberos Gold & Silver tickets.

• Clear-text creds in files/pastebin, etc.

Delivery

The attacker identifies a vector to transmit the weaponized code to the target environment. 

Discovery: Network scanning, Finding accounts by listing policies, Finding remote systems, software, and system information, VM/sandbox.

Exploitation

The weaponized code is executed on the target system by this mechanism. 

Execution: Shells and interpreters (PowerShell, Python, Javascript, etc.), Scheduled tasks, and Windows Management Instrumentation (WMI).

Privilege Escalation: Sudo, token/key theft, IAM/group policy modification. Many persistence exploits are PrivEsc methods, too.