In contrast with common cybercriminals who leverage attacks opportunistically, Advanced Persistent Threats (APTs) select a specific target and devote substantial effort into planning a data breach.
Lockheed Martin’s Cyber Kill Chain framework breaks down cybercriminal activity into five distinct stages. Understanding the tools, tactics, and procedures that characterize each of these stages will better equip your organization to identify and combat advanced persistent threats.
[Related Reading: What Is an Advanced Persistent Threat?]
Stage One | Identify & Recon
Information gathering
Public sources can provide adversaries with valuable baseline knowledge. Employee names, office locations, and contact information can be instrumental in planning a social engineering attack. Details listed on an IT employee’s LinkedIn profile or a press release highlighting a recent merger could allude to potential security gaps. Advanced ‘Google dork’ search operators can locate web pages not intended for public viewings, such as sensitive directories or insecure login portals.
Determining the network range
An open-source DNS query such as NSLOOKUP is used to identify the IP address associated with the targeted organization’s website. Entering this IP address into a WHOIS lookup will return the full range of IP addresses on the network.
Identify active machines
The initial range of targeted IP addresses can be narrowed down to active machines by running a ping sweep, which sends an echo request to each IP address within the targeted range. Active machines will respond with an echo reply, while inactive machines return a request time out.
Identify open ports
A wide range of port scanning tools are available to identify open ports. Since these scans establish a connection with TCP and UDP ports, they can potentially be detected by the targeted network’s intrusion detection system (IDS). Stealthier port scanners are available but come with the trade-off: reduced reliability. Other methods for identifying open ports include port knocking, wardialing, and wardriving.
OS fingerprinting
There are two approaches to identifying the operating system (OS) that a target is using. Active fingerprinting identifies the OS based on a targeted machine’s responses to specially crafted ICMP or TCP packets, whereas passive fingerprinting captures and analyzes outbound web traffic sent by the targeted system to identify the OS. The trade-off here is that active techniques are more powerful, but passive techniques are more difficult to detect.
Service fingerprinting
Identifying which services run on an open port enables adversaries to plan an application-specific attack. Effective service fingerprinting tools include Telnet, FTP, and Netcat.
Network mapping
Adversaries can now compile the information they’ve gathered to create a blueprint of the targeted network. Automated tools such as traceroute programs or Cheops may be used to map out server placement and network connections.
Stage Two | Initial Attack
Weaponization
The creation of a malicious payload can be carried out using an automated malware-generating tool. In a targeted attack, this malware is customized based on the information gathered during the Identify & Reckon stage.
Delivery
There are two basic methods of malware delivery: Adversary-controlled delivery, which involves direct hacking into an open port, and adversary-released delivery, which conveys the malware to the target through phishing. Alternatively, adversaries can compromise a trusted web application used by the target to enable iframe malware injection.
Exploitation
It’s not enough to simply deliver the malware bundle to the target. To execute the malicious code onto the targeted system, a vulnerability must be present. Adversary-triggered exploits rely on system vulnerabilities, whereas victim-triggered exploits rely on human vulnerabilities.
Stage Three | Command & Control
Installation of either a web shell on a compromised web server or a backdoor implant on a compromised computer system enables adversaries to bypass security controls and maintain access in the victim’s environment.
Remote connectivity is established with the victim’s command and control (C2) infrastructure to enable remote connectivity-typically using the web, DNS, or email protocols. Multiple channels may be established to maintain connectivity if one of the channels is removed or interrupted.
Stage Four | Discover & Spread
Internal recon
Adversaries can create a more detailed map of the victim’s network by scoping out internal factors such as network structure, services, and operating systems. This information can be used to develop a lateral movement strategy for avoiding detection and gaining access to targeted assets.
Privilege escalation
It’s unlikely that an adversary’s initial access point provides them with access to all the resources that they’ve targeted. The horizontal approach to privilege escalation uses techniques brute force, keylogging, or ARP spoofing to steal credentials and gain access additional user accounts, whereas the vertical approach exploits vulnerabilities or misconfigurations to escalate permissions on an existing account.
Lateral movement
Adversaries are now free to move about the network, searching for targeted assets and discovering additional resources worthy of exfiltration. Targeted assets can include sensitive customer data, confidential documents, private emails, and valuable intellectual property.
Stage Five | Extract & Exfiltrate
Transmission
The backdoor installed during the Command & Control stage typically has built-in file transmission capabilities. A Remote Access Trojan (RAT) could also be used to siphon data out of the targeted environment.
Cleanup
After extracting their targeted assets, adversaries may take measures to cover up their tracks, such as timestamp manipulation and efforts to obscure the adversary’s identity.
