-: Attack frameworks.
In this lesson,
we're going to talk about
the three different attack frameworks,
the Lockheed Martin Kill Chain,
the MITRE ATT&CK Framework
and the Diamond Model of Intrusion Analysis.
First, let's talk about the kill chain.
This kill chain model was first developed
by Hutchins, Cloppert, and Amin,
under contract from Lockheed Martin's Corporation.
It was then released into the public domain
for everyone to use.
Now, the kill chain has a seven-step method
that starts with reconnaissance
and then moves into weaponization, delivery, exploitation,
installation, command and control,
and action on objectives.
And as you can see,
it is very linear going from the top
all the way down to the bottom,
starting with step one and going to step seven.
This is an older model,
and newer variations of frameworks
are doing more of an iterative approach.
But let's go through this step by step
so we can see what happens in each of these stages
because it is still a good way to think about things.
First, we have reconnaissance.
And in this stage,
the attacker is going to determine
what methods they need to use
to complete the other phases of their attack.
Now, one of the big issues here
is that the attacker doesn't want to get caught
while they're doing reconnaissance,
so they try to be sneaky.
They try to use things like open source
and passive information gathering and things like that
so that they cannot be detected.
This phase, you can use both passive
or active scanning techniques on the target network,
but generally, we're going to start out
with passive information gathering
and then move into active scanning.
By the time you're done with reconnaissance,
you should have a good idea of what that network looks like,
what type of software they're using,
and what type of vulnerabilities may exist.
At that point, we can start figuring out
how we want to move into phase two,
which is weaponization.
During weaponization, the attacker is going to couple
payload code that will enable access with exploit code
and this will allow them to go after a vulnerability
to execute onto that target system.
Now, by doing this,
you basically are coding or creating the malware
or the exploit you want to run.
but you are not running it yet.
You've only created it inside your own lab
and haven't sent it to the victimized system.
This brings us to step three, delivery.
This is where the attacker is going to identify a vector
by which they can transmit the weaponized code
to the target environment.
This may be by email.
This may be by dropping the USB drive
loaded with that malware in their parking lot.
Whatever the mechanism is doesn't really matter right now.
We just have to think about the fact
that we have to get it there,
and that's what delivery is all about.
Step four takes us to exploitation.
This is where the weaponized code is actually executed
on the target system by whatever mechanism you've done.
If you sent them an email with a phishing link
and they click that link,
the sending of the email was delivery.
Clicking the link is when exploitation happens
and they actually start running that code.
Or, if you dropped it on a USB drive
and they plugged that into their system
and the autorun started up that code,
that would be exploitation.
At this point, the code has been run.
And this brings us to step five,
which is installation.
During installation, we're going to have a mechanism
that enables the weaponized code to run a remote access tool
and achieve persistence on that target system.
So if we had a stage one dropper
that was run as part of exploitation,
we now have downloaded and installed our phase two.
This would be our installation.
And this gives us control of that system moving forward
and that persistence that we're looking for.
At that point, we move into step six.
Step six is command and control, or C2.
This is where the weaponized code
establishes an outbound channel to a remote server
that can then be used to control that remote access tool
and possibly download additional tools
to help you progress in your attack.
At this point, you now pretty much own the system.
You have access to it,
you can remote into that system,
and you can now run commands on that system.
That's what C2 is all about.
Now, the final step is actions on objectives.
This is where the attacker is typically going to use
the access that they've achieved
through steps one through six
to now start doing what they wanted to do.
That may be transferring data from a remote system,
such as data exfiltration,
or some other goal or motive.
Whatever their goal was originally with reconnaissance,
they've now achieved that by being on the system,
they have two-way communication using command and control,
and now we can perform action on objectives.
Now, when we look at this kill chain,
going from step one all the way down to step seven,
we use this to do an analysis,
and a kill chain analysis can be used to identify
defensive courses of actions
by being able to counter the progress of an attack
at each stage.
So if I can start mapping out
what are all the ways somebody can break into my system,
run malicious code, gain persistence,
do C2 on my servers,
and do some kind of action,
I can then put in things to block that.
I can try to detect that.
I could try to deny that.
I could try to disrupt it or degrade it.
I might want to try to deceive them
or destroy their capabilities.
All of these things are the six Ds
that we're going to try to do to an attacker
who's trying to break into our systems.
So this is the idea of using the kill chain
and why we do this.
Now, as I said, this is a very linear method,
but there are newer methods out there
that work in more of an iterative manner
or allow you to think holistically
across multiple lines of attack.
For example, the MITRE ATT&CK Framework
is one of those models.
Because the kill chain was criticized
for focusing too much on perimeter security
with that linear method going from outside in,
the MITRE ATT&CK Framework was developed.
Now, the MITRE ATT&CK Framework is a knowledge base
that's maintained by the MITRE Corporation
for the listing and explaining specific adversary tactics,
techniques, and common knowledge
which is where the A-T-T-at-C-K comes from.
And these are also known as procedures.
You can find all of these at attack.mitre.org,
and this is a free open source website that you can go
and look at all this information.
Now, where the kill chain was a very linear process,
the MITRE ATT&CK framework is not.
It uses more of a matrices model,
and you can see that here on the screen.
Notice there are different columns here,
and each one is a certain type
or category of attack that might occur.
For instance, there's defense evasion,
there's credential access,
there's discovery and lateral movement and execution.
And underneath each of these is a tactic
or technique that could be used by an attacker
to be able to accomplish that particular goal.
Now again, this is a free resource,
and you can go play with it at attack.mitre.org.
Now, when you go there,
you're going to see something that looks like this,
and this is what we call the attack navigator.
From here, you can select different things
and highlight them with different colors.
What you're seeing here on the screen is an example
of one actor's TTPs that we've mapped out.
Based on that,
we know that if we're talking about APT28, for example,
these are the things that they might be used to doing.
And if you click on each one of these,
you'll get more details about the particular TTP
that they use.
Now again, this is a great model
for being able to map out an overall adversary
and all their different capabilities
and capacities that they use in their different attacks.
And so we can compare one to another.
And then if we're on the incident response,
we can start looking, okay,
I have this and this and this that I've noticed,
and they fall into these columns,
and when I compare that against the MITRE matrix,
I know that that is common
against this particular adversary,
and so that might help me figure out
what defenses I want to use.
As you look at this chart,
you may notice that it is very focused
on the exploitation phase
and it's not really focused on the reconnaissance phase.
And so if we go back and look at the reconnaissance phase,
there's actually another matrix
called the pre-ATT&CK matrix.
The pre-ATT&CK tactics matrix is going to align
to the reconnaissance
and weaponization phases of the cyber kill chain.
And that way,
we can also see what those things look like
and try to detect things before it becomes a real attack
and it's while it's still in the pre-ATT&CK phase,
'cause if we can get it earlier,
we're further left of boom.
We can then prevent that
from becoming a full-blown incident.
The third model I want to talk about
is the diamond model of intrusion analysis.
Now, this model is used to represent an intrusion event.
Anytime you have intrusion event.
It has some relation to these four categories,
the victim, the capability, the adversary,
and the infrastructure,
as you see here on the screen.
Now, you can also put some meta features in there,
things like a timestamp,
what phase you're in, the result, the direction,
the methodology, or the resources.
But these four categories are really where the focus is.
Now, for each incident,
we would want to map them out and look at this model.
For instance, this model's going to allow an analyst
to exploit the fundamental relationship
between the different features.
If we start out here,
the victim starts this process.
They discover there's malware.
Now that points to capability because we have the ability
to see that we've been had.
Then if we see that capability,
we can then see that the malware might contain a C2 domain
as we go through our incident response.
If we do that,
that now points to infrastructure,
because C2 is an infrastructure problem.
Once we look at that,
we start seeing the C2 domain resolves
to a C2 IP address.
Again, that's infrastructure,
so we're still in the same place.
As we start digging into that further,
we might look at our firewall logs,
and that reveals that the victims have been contacting
that C2 IP address.
So that points down to our victim.
But also that IP address is owned
and it provides details about the adversary,
so that now points to the adversary.
And so you can see with these arrows,
how these different things tie together,
and very quickly,
you can see where you should focus your efforts.
For instance, if I focus on infrastructure and C2,
that is going to help me point towards the adversary
and the victim in this case,
and it really does help me point those things out
much quicker using this type of a model.
Now, for each event,
we're also going to define a tuple,
and this is in the format of E equals something.
And this is basically an array of information
that contains information on the adversary,
the capability, the infrastructure,
and the victim.
And we also have things like our timestamp
and other metadata that we have.
By putting all this information into this format,
we can then use it inside of some sort of automated system,
for instance, our SIEM
that can then help correlate all this information
together for us.
Now, each of these three models have their benefits
and their drawbacks,
and the good thing about them is
you can use them individually
or you can actually combine them together,
and that way you can get the best of both worlds.
For instance, if I wanted to combine the diamond model
with the kill chain,
I might get something that looks like this.
You can see going from top to bottom,
I have the different steps of the cyber kill chain,
and then I have three different threads going across.
And as I'm tracking these threads,
I'm starting to look at where they are
inside the diamond model.
And you can see how I went from one to two
all the way down to 14,
and in there,
I have three different threads
or three different attacks that are going on
that could be three different adversaries,
and how these things connect to each other
based on those four areas of the diamond.
So starting with one,
we got up to capability
and that tied into infrastructure of attack number two,
and then as we went down to number three,
that took us from the victim of number two
into the adversary of number three,
and so on and so on as we connect all these things together.
Again, the real benefit here
is starting to use these things together
to start figuring out how we can model
the behavior of our adversaries so we can better define
how we're going to stop them by using our analysis
to be able to better define our defensive techniques.