SIGN IN YOUR ACCOUNT TO HAVE ACCESS TO DIFFERENT FEATURES

FORGOT YOUR PASSWORD?

FORGOT YOUR DETAILS?

AAH, WAIT, I REMEMBER NOW!
Need Help? Email [email protected]
  • LOGIN

E-SPIN Group

CONTACT US / GET A QUOTE
  • No products in cart.
  • HOME
  • PROFILE
    • Corporate Profile
    • About us
    • Customer Overview
    • Investor Relations
    • Procurement
  • GLOBAL THEMES
    • Artificial Intelligence (AI)
    • Big Data
    • Blockchain
    • Cloud Computing
    • Cognitive Computing
    • Cyber Security
    • DevSecOps
    • Digital Transformation (DT)
    • Modern Workplace
    • Internet of Things (IoT)
    • Quantum Computing
  • SOLUTIONS
    • Application Security
    • DevSecOps
    • Digital Forensics
    • IT Operations Management (ITOM)
    • Malware Analysis and Reverse Engineering
    • Network Management System (NMS)
    • Network Operation (NetOps)
    • Network Performance Monitoring and Diagnostics (NPMD)
    • Penetration Testing
    • Secure Development
    • Security Information & Event Management (SIEM)
  • INDUSTRIES
    • Aerospace & Defense
    • Automotive
    • Banking & Financial Markets
    • Chemical & Petroleum
    • Commercial and Professional Services
    • Construction & Real Estate
    • Consumer Products
    • Education
    • Electronics
    • Energy & Utilities
    • Food & Beverage
    • Information Technology
    • Insurance
    • Healthcare
    • Goverment
    • Telecommunications
    • Transportation
    • Travel
    • Manufacturing
    • Media & Entertainment
    • Mining & Natural Resources
    • Life Sciences
    • Retail
  • PRODUCTS
    • Brand Overview
      • Acunetix
      • E-Lock
      • Hex-Rays
      • Immunity
      • Progress | Ipswitch
      • Metageek
      • Qualys
      • Parasoft
      • Tenable
      • Titania
      • Veracode
    • Rest of Brands
      • Adobe
      • BeyondTrust
      • Core Security
      • DefenseCode
      • HCL
      • ImmuniWeb
      • LiveAction
      • McAfee
      • Micro Focus
      • Microsoft
        • Microsoft Surface
      • Netsparker
      • Nutanix
      • Paessler
      • PECB
      • Portswigger
      • Red Hat
      • Riverbed
      • RSA
      • Solarwinds
      • TamoSoft
      • Trend Micro
      • TSFactory
      • Trustwave
      • VMware
      • VanDyke
      • Visiwave
    • Services Overview
    • Line Card
  • e-STORE
    • e-STORE
    • eSTORE Guide
    • SUPPORT
  • CAREERS
    • Careers
    • Culture, Values and CSR
    • How We Hire
    • Job Openings
  • BLOG / NEWS
    • Blogs and News
    • Resources Library
    • Calendar of Events
  • CONTACT
  • Home
  • Global Themes and Feature Topics
  • Make use of cyber attack kill chain for your cyber attack and cyber defense operations
0
E-SPIN
Friday, 29 May 2020 / Published in Global Themes and Feature Topics

Make use of cyber attack kill chain for your cyber attack and cyber defense operations

The cyber attack kill chain is a series of steps that trace stages of a cyberattack from the early reconnaissance stages to the exfiltration of data. The kill chain helps us understand and combat ransomware, security breaches, red-teaming attack lifecycle and advanced persistent attacks (APTs).
In brief, Cyber attack kill chain involves several core stages, usually starting from reconnaissance (often the first stage in a malware attack) to lateral movement (movement laterally throughout the network to get access to more data) to data exfiltration (getting the data out). All of the common attack vectors – whether phishing, brute force, malware – trigger activity on the cyber attack kill chain.
It has a lot of variables, some propose a unified cyber attack kill chain, some modify it for red-teaming attack lifecycle and others simplify it for various purposes, but in the very original concept it contains the 8 phases. Once you understand the logic behind it, you can adapt for your own use case as well.

8 Phases of Cyber Kill Chain

Applied for the concept is dependent on whether you are in the cyber attack side or cyber defence side.

Let’s start from Cyber offensive end to conduct cyber attack, you can see from below what typical activity needs to be carried out in each stage.

Cyber attack kill chain for cyber offensive such as red-teaming operations

Reconnaissance is the preliminary step of an attack, the information gathering mission. During reconnaissance, an attacker is seeking information that might reveal vulnerabilities and weak points in the system. Firewalls, intrusion prevention systems, perimeter security – these days, even social media accounts – get ID’d and investigated. Reconnaissance tools scan corporate networks to search for points of entry and vulnerabilities to be exploited. For example, typical use tools include generic vulnerability scanner to domain specific scanner that for perform web application, mobile application, database system, windows, Linux/UNIX systems, network and security device, docker and container, enterprise application scanner such as for ERP, Oracle systems to scan and attempt to probe for vulnerability exist that can be carry out subsequent attack.

Intrusion is when the attack becomes active: attackers can send malware – including ransomware, spyware, and adware, cyptolocker – to the system to gain entry. This is the delivery phase: it could be delivered by phishing email, it might be a compromised website or that really great coffee shop down the street with free, hacker-prone wifi. Intrusion is the point of entry for an attack, getting the attackers inside. For example, make use of wifi exploitation testing tool to setup evil twin (to pretend as legitimate wifi hotspot and access point) in coffee shop public wifi, and sniffing from those unaware wifi user connect via your machine, so you steal all their website credentials and data passing over while you act as man-in-the middle.

Exploitation You’re inside the door, and the perimeter is breached (refer for said you got the login credential) . The exploitation stage is all exploit the system. Attackers can now get into the system and install additional tools, modify security certificates and create new script files for nefarious purposes.

Privilege Escalation (PE) Attackers use privilege escalation to get elevated access to resources. Privilege escalation techniques often include brute force attacks, preying on password vulnerabilities, and exploiting zero day vulnerabilities. They’ll modify GPO security settings, configuration files, change permissions, and try to extract credentials for higher access privilege credentials (or escalate to get one).

Lateral Movement Attackers will move from system to system, in a lateral movement, to gain more access and find more assets. It’s also an advanced data discovery mission, where attackers seek out critical data and sensitive information, admin access and email servers – often using the same resources as IT and leveraging built-in tools like PowerShell – and position themselves to do the most damage.

Obfuscation / Anti-forensics. To prevent detected from usual login and execute range of activity, attack will attempt to conceal their presence and mask activity to avoid detection and thwart the inevitable investigation. This might mean wiping files and metadata, overwriting data with false timestamps (timestomping) and misleading information, or modifying critical information so that it looks like the data was never touched.

Denial of Service attack. Jam the phone lines and shut down the power grid. Here’s where the attackers target the network and data infrastructure, so that the legitimate users can’t get what they need. The denial of service (DoS) attack disrupts and suspends access, and could crash systems and flood services.

Exfiltration. The attackers get the data: they’ll copy, transfer, or move sensitive data to a controlled location, where they do with the data what they will. Ransom it, sell it on ebay, send it to wikileaks. It can take days to get all of the data out, but once it’s out, it’s in their control. One way for being detected for this happen is actually doing proactive dark web monitoring, to see any unusual cyber crime trading on the company or company’s customer credentials and data.

But when you are used for cyber defence, you will note that each phase of the cyber attack kill chain is an opportunity to stop a cyberattack in progress: with the right tools to detect and recognise the behaviour of each stage, you are able to better defend against a systems or data breach. In future if we have opportunity, we write for cyber attack kill chain for cyber defense such as blue team operations.

It is a very useful work and functional model you can use for both cyber offensive or attack, as well as cyber defence learning, teaching, use as a research framework or grouping your tools for serving your end.

E-SPIN since 2005, being active in cyber security business, from supply to red team operations for cyber offensive attack to blue team operations for cyber defense, from intrusion monitoring, prevention to protection, across the region E-SPIN did business, as being part E-SPIN cyber crime and cyber warfare solution portfolio. Feel free to contact E-SPIN for your operation or project requirements.

Tagged under: Blue Team, Cyber Security, Red Team

What you can read next

Benefits of Blended Learning
Great reset after Next-Normal and what next
Application security vs software security
Countering Mobile Device Security Threats

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Recent Posts

  • IT Services Executive

    IT Services Executive

    IT Services Executive Responsibilities: assist ...
  • Driving the next normal 2021 and beyond

    Out of everyone expected, COVID-19 pandemic too...
  • Innovations Shaping the Future of Transportation Industry

    Becoming a future-ready company

    Becoming a future-ready company in most of the ...
  • The value of Internet of Behavior

    The Internet of things (IoT), is the connecting...
  • Anywhere operation, Cyber everywhere

    The COVID-19 pandemic forced business leaders w...

Recent Comments

  • Dorai M on 5 Common ML Challenges Data Scientists Face

Archives

  • January 2021
  • December 2020
  • November 2020
  • October 2020
  • September 2020
  • August 2020
  • July 2020
  • June 2020
  • May 2020
  • April 2020
  • March 2020
  • February 2020
  • January 2020
  • December 2019
  • November 2019
  • October 2019
  • September 2019
  • August 2019
  • July 2019
  • June 2019
  • May 2019
  • April 2019
  • March 2019
  • February 2019
  • January 2019
  • December 2018
  • November 2018
  • October 2018
  • September 2018
  • August 2018
  • July 2018
  • June 2018
  • May 2018
  • April 2018
  • March 2018
  • February 2018
  • January 2018
  • December 2017
  • November 2017
  • October 2017
  • September 2017
  • August 2017
  • July 2017
  • June 2017
  • May 2017
  • March 2017
  • January 2017
  • December 2016
  • November 2016
  • October 2016
  • September 2016
  • August 2016
  • July 2016
  • June 2016
  • May 2016
  • April 2016
  • March 2016
  • February 2016
  • January 2016
  • December 2015
  • November 2015
  • October 2015
  • September 2015
  • August 2015
  • July 2015
  • June 2015
  • January 2015
  • December 2014
  • October 2014
  • September 2014
  • July 2014
  • June 2014
  • May 2014
  • April 2014
  • March 2014
  • February 2014
  • January 2014
  • December 2013
  • November 2013
  • October 2013
  • September 2013
  • July 2013
  • June 2013
  • May 2013
  • April 2013
  • March 2013
  • February 2013
  • January 2013
  • December 2012
  • November 2012
  • October 2012
  • September 2012
  • August 2012
  • July 2012
  • June 2012
  • May 2012
  • February 2012
  • July 2011
  • June 2011
  • February 2009
  • July 2008

Categories

  • Acunetix
  • Adobe
  • Aerospace and Defence
  • AppSec Labs
  • Automotive
  • Banking and Financial Markets
  • BeyondTrust
  • Brand
  • Chemical and petroleum
  • Codified Security
  • Commercial and Professional Services
  • Construction and Real Estate
  • Consumer products
  • Contact Us
  • Core Impact
  • Core Security
  • DefenseCode
  • E-Lock
  • Education
  • Electronics
  • Energy and utilities
  • FAQ
  • Food and Beverage (F&B)
  • GFI
  • Global Themes and Feature Topics
  • Government
  • HCL
  • Healthcare
  • Hex-Rays
  • IBM
  • Immunity
  • ImmuniWeb
  • Industries
  • Information Technology
  • Insurance
  • Ipswitch
  • Job
  • Life Science
  • LiveAction
  • Logpoint
  • Manufacturing
  • McAfee
  • Media and Entertainment
  • Metageek
  • Micro Focus
  • Microsoft
  • Mining and Natural Resources
  • Nessus
  • Netsparker
  • News
  • Nutanix
  • Paessler
  • Parasoft
  • PECB
  • PortSwigger
  • Pradeo
  • Product
  • Qualys
  • Rapid7
  • RedHat
  • Retail
  • Retina
  • Riverbed
  • RSA
  • Security Innovation
  • Security Roots
  • Services
  • SILICA
  • Smart City
  • Soft Activity
  • SolarWinds
  • Solution
  • Symantec
  • TamoSoft
  • Telecommunications
  • Tenable
  • Titania
  • Transportation
  • Travel
  • Trend Micro
  • Trustwave
  • TSFactory
  • Uncategorized
  • Vandyke
  • Veracode
  • Videos
  • VisiWave
  • VMware
  • Webinar Archive

Meta

  • Log in
  • Entries feed
  • Comments feed
  • WordPress.org

CORPORATE

  • Profile
  • About us
  • Careers
  • Investor Relations
  • Procurement

SOLUTIONS & PRODUCTS

  • Industries
  • Solutions
  • Products
  • Brand Overview
  • Services

STORE & SUPPORT

  • Shop
  • Cart
  • Checkout
  • My Account
  • Support

PRODUCTS & SERVICES

  • Industries
  • Solutions
  • Products
  • Brand Overview
  • Services

FOLLOW US

  • Facebook
  • Twitter
  • Pinterest
  • LinkedIn
  • Google+
  • YouTube
  • WordPress Blog
© 2005 - 2020 E-SPIN Group of Companies | All rights reserved.
  • Contact
  • Privacy
  • Terms of use
TOP