⚔️ Cyber Kill Chain Guide - Anatomy of Attack

MITRE ATT&CK Enterprise - 14 tactics in matrix order, each with three examples of techniques

1. TA0043IntelligenceReconnaissanceKill Chain Phase: 1
   • Active Scanning
   • Gather Victim Identity Information
   • Search Open Websites/Domains
2. TA0042Resource PreparationResource DevelopmentKill Chain Phase: 2
   • Acquire Infrastructure
   • Compromise Accounts
   • Develop Capabilities
3. TA0001Initial accessInitial AccessKill Chain Phase: 3
   • Phishing
   • Drive-by Compromise
   • Valid Accounts
4. TA0002EnforcementExecutionKill Chain Phase: 4
   • Command and Scripting Interpreter
   • User Execution
   • Scheduled Task/Job
5. TA0003StabilityPersistenceKill Chain Phase: 5
   • Boot or Logon Autostart Execution
   • Create Account
   • Scheduled Task/Job
6. TA0004EnforcementPrivilege EscalationKill Chain phase: 4-7
   • Abuse Elevation Control Mechanism
   • Access Token Manipulation
   • Exploitation for Privilege Escalation
7. TA0005Circulation of protectionDefense EvasionKill Chain phase: 4-7
   • Obfuscated Files or Information
   • Indicator Removal
   • Impair Defenses
8. TA0006Obtaining access dataCredential AccessKill Chain Phase: 7
   • Brute Force
   • OS Credential Dumping
   • Steal Web Session Cookie
9. TA0007Environmental researchDiscoveryKill Chain Phase: 7
   • Account Discovery
   • Network Service Discovery
   • Process Discovery
10. TA0008NetworkingLateral MovementKill Chain Phase: 7
    • Remote Services
    • Internal Spearphishing
    • Lateral Tool Transfer
11. TA0009Data collectionCollectionKill Chain Phase: 7
    • Email Collection
    • Data from Local System
    • Screen Capture
12. TA0011Management (C2)Command and ControlKill Chain Phase: 6
    • Application Layer Protocol
    • Encrypted Channel
    • Ingress Tool Transfer
13. TA0010Data removalExfiltrationKill Chain Phase: 7
    • Exfiltration Over C2 Channel
    • Exfiltration Over Web Service
    • Scheduled Transfer
14. TA0040ImpactImpactKill Chain Phase: 7
    • Data Encrypted for Impact
    • Data Destruction
    • Service Stop

Kill Chain phase is approximate conformity. ATT&CK's tactics are not consecutive: they are repeated by the attacker and are bypassing protection throughout the attack, so the increase of rights and the circumvention of protection are consistent with several phases.

From abstract to specific

1. 1. Tactics - WhyTacticattacker's goal in this step, 14 tactics
2. 2. Technical - asTechniquegeneral type, around 200 techniques
3. 3. Sub-equipmentSub-techniquemore specific option, more than 400
4. 4. ProcedureProcedurewhat a particular group did

Example: TA0002 Execution → T1059 Command and Scripting Interpreter → T1059.001 PowerShell → team specific.

Unified Kill Chain - Paul Paul (2017, updated 2022)

A. Initial access In - Initial Foothold

The attacker gets the first stop.

1. 1. IntelligenceReconnaissanceOSINT, scanning
2. 2. Resource PreparationResource Developmentinfrastructure, tools
3. 3. DeliveryDeliveryphishing, USB
4. 4. Social engineeringSocial Engineeringmanipulation
5. 5. OperationExploitationvulnerability, macro
6. 6. StabilityPersistenceautomatic startup
7. 7. Circulation of protectionDefense Evasionskiing
8. 8. Management (C2)Command & Controlcontact with the attacker

B. Networking Through - Network Propagation

The attacker extends access and moves towards the target.

1. 9. ConversionPivotingproxy, tunnel
2. 10. Environmental researchDiscoveryAD, Network Card
3. 11. EnforcementPrivilege EscalationUAC, sudo, token
4. 12. EnforcementExecutionPowerShell, WMI
5. 13. Obtaining access dataCredential AccessLASS, password mixing values
6. 14. NetworkingLateral MovementRDP, SMB

C. Achievement of objectives Out - Action on Objectives

The attacker reaches why came: data, extortion or sabotage.

1. 15. Data collectionCollectionpreparation, compression
2. 16. Data removalExfiltrationcloud, DNA, e-mail
3. 17. ImpactImpactencryption, destruction, DoS
4. 18. Achievement of objectivesObjectivesstrategic result

The stages are repeated: after each movement in the network, the attacker often starts again with research and empowerment.

Courses of Action (CoA) - six actions in each of the seven phases (Hutchins, Cloppert, Amin 2011)

Diamond Model of Intrusion Analysis - Caltagirone, Pendergast, Betz (2013)

Each incident is described by four corners. Finding one can find the others.

An attack from the supply phase leaves traces in the host: entries in the magazine, new service, planned task. These are places where the chain can be seen and interrupted. The hardness (to be ruled out above) is surface guide.

The bottom row is where to watch - commands below. Figures are Windows event IDs, codes - MITRE ATT&CK techniques.

1. Logs - see and follow in real time

Get-WinEvent -LogName Security -MaxEvents 20 |
  Format-Table TimeCreated, Id -AutoSize

$since = Get-Date
while ($true) {
  Start-Sleep 5; $now = Get-Date
  Get-WinEvent -FilterHashtable @{
    LogName='Security'; StartTime=$since
  } -ErrorAction SilentlyContinue |
    Format-Table TimeCreated, Id -AutoSize
  $since = $now
}

log show --last 1h --style compact \
  --predicate 'eventMessage CONTAINS[c] "fail"'

log stream --style compact \
  --predicate 'process == "sshd"'

journalctl --since "1 hour ago" -p warning

journalctl -f
sudo tail -F /var/log/auth.log   # Debian/Ubuntu
sudo tail -F /var/log/secure     # RHEL/Fedora

2. Services - Find new and stop

Get-Service | Where-Object Status -eq Running
Get-WinEvent -FilterHashtable @{
  LogName='System'; Id=7045 } -MaxEvents 10

Stop-Service <serviss>
Set-Service <serviss> -StartupType Disabled

Set-Service <serviss> -StartupType Manual
Start-Service <serviss>

launchctl list | grep -v com.apple
ls /Library/LaunchDaemons /Library/LaunchAgents \
   ~/Library/LaunchAgents

sudo launchctl bootout system \
  /Library/LaunchDaemons/<label>.plist
sudo launchctl disable system/<label>

sudo launchctl enable system/<label>
sudo launchctl bootstrap system \
  /Library/LaunchDaemons/<label>.plist

systemctl list-units --type=service --state=running
systemctl list-unit-files --state=enabled

sudo systemctl disable --now <serviss>

sudo systemctl enable --now <serviss>

3. Planned tasks - review and set your own

Get-ScheduledTask | Where-Object State -ne Disabled |
  Select-Object TaskPath, TaskName, State

$a = New-ScheduledTaskAction -Execute powershell.exe `
  -Argument '-NoProfile -File C:\Scripts\check.ps1'
$t = New-ScheduledTaskTrigger -Daily -At 06:00
Register-ScheduledTask -TaskName DailyCheck `
  -Action $a -Trigger $t -User 'NT AUTHORITY\SYSTEM'

Unregister-ScheduledTask -TaskName DailyCheck -Confirm:$false

crontab -l
launchctl list | grep -v com.apple

(crontab -l 2>/dev/null
 echo '0 6 * * * /usr/local/bin/check.sh') | crontab -

crontab -l | grep -v /usr/local/bin/check.sh | crontab -

systemctl list-timers --all
crontab -l; ls /etc/cron.d /etc/cron.daily

sudo systemd-run --unit=daily-check \
  --on-calendar='*-*-* 06:00:00' /usr/local/bin/check.sh

sudo systemctl stop daily-check.timer

Article 23 of Directive (EU) 2022/2555, transposed by each Member State into national law. Time limits shall count from the moment the entity becomes aware of a significant incident.

1. 24 h Early warningEarly Warning, 23(4)(a)suspected abuse and cross-border effects
2. 72 hours Incident notificationIncident Notification, 23(4)(b)initial assessment: severity, effect, IoC, if any
3. on request Intermediate reportIntermediate Report, 23(4)(c)if the CSIRTs or the supervisory authority so requests
4. 1 month Final reportFinal Report, 23(4)(d)within one month of notification: cause, measures, impact

If the incident is still ongoing within the deadline of the final report, a progress report and a final report shall be submitted within one month of the end of the incident.