Cyber Defence Frameworks

Cyber Defence Frameworks

1. Unified Kill Chain

   • Kill Chain
     • is a term used to explain the various stages of an attack
   • Threat modelling

2. Cyber Kill Chain

   • reconnaissance
     • Reconnaissance is discovering and collecting information on the system and the victim. The reconnaissance phase is the planning phase for the adversaries.
     • OSINT
   • Weaponization
     • Malware
       • Malware is a program or software that is designed to damage, disrupt, or gain unauthorized access to a computer.
     • exploit
       • An exploit is a program or a code that takes advantage of the vulnerability or flaw in the application or system.
     • payload
       • A payload is a malicious code that the attacker runs on the system.
     • macro
   • Delivery
     • Phishing email
     • infected USB
     • Watering hole attack
   • Exploitation / CrowdStrike
     • move laterally
       • refers to the techniques that a malicious actor uses after gaining initial access to the victim's machine to move deeper into a network to obtain sensitive data.
     • zero-day exploit
   • Installation
     • persistent backdoor
       • can be achieved through:
         • Installing a web shell on the webserver
         • Installing a backdoor on the victim's machine
         • Creating or modifying Windows services
         • Adding the entry to the "run keys"
           • run keys
         • Timestomp
           • modify file time attributes to hide new files or changes to existing files
   • C2
     • opens up the C2 (Command and Control) channel through the malware to remotely control and manipulate the victim
     • IRC
       • Internet Relay Chat out date today
       • channels
         • HTTP:8080
         • HTTPS:443
         • DNS
         • DNS Tunneling