Cyber kill chain
The cyber kill chain (CKC) is a traditional security model that describes an old-school scenario, an external attacker taking steps to penetrate a network and steal its data-breaking down the attack steps to help organizations prepare. CKC is developed by a team known as the computer security response team. The cyber kill chain describes an attack by an external attacker trying to get access to data within the perimeter of the security
Each stage of the cyber kill chain shows a specific goal along with that of the attacker Way. Design your Cyber Model killing chain surveillance and response plan is an effective method, as it focuses on how the attacks happen. Stages include:
- Reconnaissance
- Weaponization
- Delivery
- Exploitation
- Installation
- Command and control
- Actions on Objectives
Steps of the cyber kill chain will now be described:
Step 1: Reconnaissance
It includes the Harvesting of email addresses, information about the conference, etc. Reconnaissance attack means that it is an effort of threats to pick up data about network systems as much as possible before starting other more genuine hostile kinds of attacks. Reconnaissance attackers are of two types passive reconnaissance and active reconnaissance. Recognition Attacker focuses on “who,” or network: Who will probably focus on the privileged people either for System access, or access to “Network” confidential data focuses on architecture and layout; tool, equipment, and the protocols; and the critical infrastructure. Understand the victim’s behavior, and break into a house for the victim.
Step 2: Weaponization
Supply payload by coupling exploits with a backdoor.
Next, attackers will use sophisticated techniques to re-engineer some core malware that suits their purposes. The Malware may exploit previously unknown vulnerabilities, aka “zero-day” exploits, or some combination of vulnerabilities to quietly defeat the defenses of a network, depending on the attacker’s needs and abilities. By re-engineering the Malware, attackers reduce the chances that traditional security solutions will detect it. “The hackers used thousands of internet devices that are infected previously with a Malicious code – known as a “botnet” or, jokingly, a “zombie army” – forcing a particularly powerful distributed denial of Service Angriff (DDoS).
Step 3: Delivery
The attacker sends the victim malicious payload using email, which is just one of a great many the attacker may employ intrusion methods. There are over 100 Possible delivery methods.
Target:
Attackers start intrusion (weapons developed in the previous step 2). The basic two methods are:
- Controlled delivery, which represents direct delivery, hacking an Open Port.
- Delivery is released to the opponent, which transmits the Malware to the target by phishing.
This stage shows the first and most significant opportunity for defenders to obstruct an operation; however, some key capabilities and other highly valued information of data are defeated by doing this. At this stage, we measure the viability of the attempts at the fractional intrusion, which are hindered at the conveyance point.
Step 4: Exploitation
Once attackers identify a change in your system, they exploit the weakness and execute their attack. During the exploitation stage of the attack, the attacker and the host machine are compromised Delivery mechanism will typically take one of two measures:
- Install the Malware (a dropper), which allows the execution of the attacker command.
- Install and download Malware (a downloader)
In recent years, this has become an area of expertise within the hacking community that is often demonstrated at events like Blackhat, Defcon, and the like.
Step 5: Installation
At this stage, the installation of a remote access trojan or backdoor on the victim’s system allows the contender to maintain perseverance in the environment. Installing Malware on the asset requires end-user involvement by unwittingly enabling the malicious code. Action can be seen as critical at this point. A technique for doing this would be to implement a host-based intrusion prevention (HIPS) system to give caution or put a barrier to common paths, for example. NSA Job, RECYCLER. Understanding whether Malware requires privileges from the administrator or just from the user to execute the target is critical. Defenders must understand the endpoint auditing process to uncover abnormal creations of files. They need to know how to compile malware timing to determine whether it is old or new.
Step 6: Command and control
Ransomware uses Connections to control. Download the keys to encryption before you seize the files. Trojans remote access, for example, opens a command and control the connection so you can approach your system data remotely. This allows for continuous connectivity for the environment and the detective measure activity on the defense.
How does it work?
Command and control plan is usually performed via a beacon out of the grid over the allowed path. Beacons take many forms, but they tend to be in most cases:
HTTP or HTTPS
Seems benign traffic through falsified HTTP headers
In cases where the communication is encrypted, beacons tend to use auto signed certificates or custom encryption.
Step 7: Actions on Objectives
Action refers to the manner in which the attacker attains his final target. The attacker’s ultimate goal could be anything to extract a Ransom from you to decrypt files to Customer Information from the network. In the content, the latter example could stop the exfiltration of data loss prevention solutions before data leaves your network. Otherwise, Attacks can be used to identify activities that deviate from set baselines and notify IT that something is wrong. This is an intricate and dynamic assault process that can take place in months and hundreds of small steps to accomplish. Once this stage is identified within an environment, it is necessary to initiate the implementation of prepared reaction plans. At the very least, an inclusive communication plan should be planned, which involves the detailed evidence of information that should be raised to the highest-ranking official or administering board, the deployment of endpoint security devices to block information loss, and the preparation to brief a CIRT group. Having these resources well established ahead of time is a “MUST” in today’s rapidly evolving cybersecurity threat landscape.
