Kill Chains
“a military concept related to the structure of an attack” - Wikipedia
Lockheed’s Cyber Kill Chain:
The steps a cyberattack always ends up taking
-
Reconnaissance
Email Addresses, info
-
Weaponization
Exploit creation
-
Delivery
Phishing, USB stick, etc.
-
Exploitation
Exploit vulnerability
-
Installation
Install malware
-
Command and Control
-
Actions on Objectives
Defensive courses of action can be taken against these phases:[14]
Detect: determine whether an attacker is poking around Deny: prevent information disclosure and unauthorized access Disrupt: stop or change outbound traffic (to attacker) Degrade: counter-attack command and control Deceive: interfere with command and control Contain: network segmentation changes
Biggest limitation to this approach is that it does not consider insider threats and lends itself to approaching things as only coming from outside the firewall vs zero trust or other approaches.
——
MITRE ATT&CK
The ATT&CK framework is more complex than the linear one from Lockheed and has more steps:
- Initial Access - Used to gain an initial foothold within a network
- Execution - Technique that results on the execution of code on a local or remote system
- Persistence - Method used to maintain a presence on the system
- Privilege Escalation - Result of actions used to gain higher level of permission
- Defense Evasion - Method used to evade detection or security defenses
- Credentialed Access - Use of legitimate credential to access system
- Discovery - Post-compromise technique used to gain internal knowledge of system
- Lateral Movement - Movement from one system over the network to another
- Collection - Process of gathering information, such as files, prior to exfiltration
- Command and Control - Maintaining communication within targeted network
- Exfiltration - Discovery and removal of sensitive information from a system
- Impact - Techniques used to disrupt business and operational processes[17]
Unified Kill Chain
Combines both of the above into 18 steps https://en.wikipedia.org/wiki/Kill_chain#/media/File:The_Unified_Kill_Chain.png
