Make use of cyber attack kill chain for your cyber attack and cyber defense operations

8 Phases of Cyber Kill Chain

Applied for the concept is dependent on whether you are in the cyber attack side or cyber defence side.

Let’s start from Cyber offensive end to conduct cyber attack, you can see from below what typical activity needs to be carried out in each stage.

Cyber attack kill chain for cyber offensive such as red-teaming operations

Reconnaissance is the preliminary step of an attack, the information gathering mission. During reconnaissance, an attacker is seeking information that might reveal vulnerabilities and weak points in the system. Firewalls, intrusion prevention systems, perimeter security – these days, even social media accounts – get ID’d and investigated. Reconnaissance tools scan corporate networks to search for points of entry and vulnerabilities to be exploited. For example, typical use tools include generic vulnerability scanner to domain specific scanner that for perform web application, mobile application, database system, windows, Linux/UNIX systems, network and security device, docker and container, enterprise application scanner such as for ERP, Oracle systems to scan and attempt to probe for vulnerability exist that can be carry out subsequent attack.

Intrusion is when the attack becomes active: attackers can send malware – including ransomware, spyware, and adware, cyptolocker – to the system to gain entry. This is the delivery phase: it could be delivered by phishing email, it might be a compromised website or that really great coffee shop down the street with free, hacker-prone wifi. Intrusion is the point of entry for an attack, getting the attackers inside. For example, make use of wifi exploitation testing tool to setup evil twin (to pretend as legitimate wifi hotspot and access point) in coffee shop public wifi, and sniffing from those unaware wifi user connect via your machine, so you steal all their website credentials and data passing over while you act as man-in-the middle.

Exploitation You’re inside the door, and the perimeter is breached (refer for said you got the login credential) . The exploitation stage is all exploit the system. Attackers can now get into the system and install additional tools, modify security certificates and create new script files for nefarious purposes.

Privilege Escalation (PE) Attackers use privilege escalation to get elevated access to resources. Privilege escalation techniques often include brute force attacks, preying on password vulnerabilities, and exploiting zero day vulnerabilities. They’ll modify GPO security settings, configuration files, change permissions, and try to extract credentials for higher access privilege credentials (or escalate to get one).

Lateral Movement Attackers will move from system to system, in a lateral movement, to gain more access and find more assets. It’s also an advanced data discovery mission, where attackers seek out critical data and sensitive information, admin access and email servers – often using the same resources as IT and leveraging built-in tools like PowerShell – and position themselves to do the most damage.

Obfuscation / Anti-forensics. To prevent detected from usual login and execute range of activity, attack will attempt to conceal their presence and mask activity to avoid detection and thwart the inevitable investigation. This might mean wiping files and metadata, overwriting data with false timestamps (timestomping) and misleading information, or modifying critical information so that it looks like the data was never touched.

Denial of Service attack. Jam the phone lines and shut down the power grid. Here’s where the attackers target the network and data infrastructure, so that the legitimate users can’t get what they need. The denial of service (DoS) attack disrupts and suspends access, and could crash systems and flood services.

Exfiltration. The attackers get the data: they’ll copy, transfer, or move sensitive data to a controlled location, where they do with the data what they will. Ransom it, sell it on ebay, send it to wikileaks. It can take days to get all of the data out, but once it’s out, it’s in their control. One way for being detected for this happen is actually doing proactive dark web monitoring, to see any unusual cyber crime trading on the company or company’s customer credentials and data.

But when you are used for cyber defence, you will note that each phase of the cyber attack kill chain is an opportunity to stop a cyberattack in progress: with the right tools to detect and recognise the behaviour of each stage, you are able to better defend against a systems or data breach. In future if we have opportunity, we write for cyber attack kill chain for cyber defense such as blue team operations.

It is a very useful work and functional model you can use for both cyber offensive or attack, as well as cyber defence learning, teaching, use as a research framework or grouping your tools for serving your end.

E-SPIN since 2005, being active in cyber security business, from supply to red team operations for cyber offensive attack to blue team operations for cyber defense, from intrusion monitoring, prevention to protection, across the region E-SPIN did business, as being part E-SPIN cyber crime and cyber warfare solution portfolio. Feel free to contact E-SPIN for your operation or project requirements.