This is module one, lesson three,
attack mapping process, translating
a behavior into a tactic.
This lesson, we have three
objectives for you to understand
the 14 tactics in enterprise
attack and why they matter
are going to go through some
practice showing you how to identify
behavior in narrative reporting.
We're going to talk about how to
translate those behaviors into
tactics, which is step three
of the attack mapping process, which
showed less than one.
So as we try to translate the
behaviors we found and we've gotten
some understanding of into
a tactic, the big
thing we're looking at is what
Cole is the adversary trying
to accomplish.
What thing is it that
the adversary is trying to do in
their step of behavior and breaking
in and acting on a system?
Now, you have a bit easier time
here than trying to go straight to
techniques or techniques
because there are only 14 tactical
options currently in enterprise
attack.
So I'm going to go into each
of the tactics briefly
that is is currently an enterprise
attack and talk a little bit about
what sorts of things are in each of
them.
The reconnaissance and resource
development tactics were added to
attack in October of twenty twenty.
They take the place of a
previous framework called pre
attack that lived alongside
attack.
And these two tactics describe
activities that happen from an
adversary before an adversary
tries to break into a system.
So for reconnaissance, the adversary
is trying to gather information
they can use to plan future
operations.
This is things like scanning a
victim, looking up in databases,
information about people at the
victim and
gathering various information that
they're going to need in order for
an operation to be successful.
Resource development as as
the adversary starts to take those
reconnaissance intelligence
findings and turn them
into the resources they need
to support their operations.
This is things like writing malware,
registering domains, buying
up VPN.
Initial access, initial access
consists of techniques that
are various entry vectors for an
adversary to gain their initial
foothold in an enterprise,
and these are things like fishing,
like an adversary getting into a
supply chain, various
things where an adversary is taking
that first step towards getting into
an environment
execution.
Execution consists of techniques
that results in adversary controlled
code running on a
victim system.
These could be things like buffer
overflows or just
user clicking on a piece of malware.
Persistence is techniques
that adversaries use to keep
access to systems.
This may be across restarts.
This may be things like credentials
changing or any other interruption
that could potentially cut off their
access and keep them from coming
back in.
And so these will be things like
making sure that the power restarts
upon a reboot,
ensuring that access is
open for future attempts
to come into the environment
and anything else the adversary is
doing to try to make sure that they
can get back in later.
Privilege, escalation, privilege
escalations, techniques that
adversaries use to gain higher level
permissions on a system or network,
oftentimes there are things
that an adversary is going to want
to do, often in other tactics
where they need to be an
administrator. They need to be rude,
they need to be system.
They need to be something beyond a
normal user
in order to be able to accomplish
those goals.
It's a privilege. Escalation
are different techniques that the
adversary is using to get
that higher level permissions.
Defense, Asian seizure
techniques and an adversary uses
to avoid getting caught, so
avoiding defenders,
this could be things like naming
their files after another common
system utility.
These could be things like hiding
the presence of their tools from
various security systems, running on
a computer, anything
where an adversary is trying to hide
from a defender.
Credential access, credential
access techniques for stealing
credentials like account names and
passwords
in order to get into other
systems on a network, often for
lateral movement or in some cases
to be able to do privilege
escalation.
Adversaries want passwords,
and this can be done in a number of
different ways.
It can be anything from actually
dumping it from the local system,
getting them off the domain
controller.
Anything with an adversary is
dumping credentials for use
elsewhere in the system.
Discovery, discoveries, techniques
and an adversary means to gain
knowledge about the system in the
internal network.
This may be techniques they use to
find out about where they've landed.
So adversaries often
look around right after they've
gotten onto a first system to figure
out, hey, where am I?
Am I where I intended to be?
They also want to be able to do
lateral movement.
They want to get into other
computers and then may need to find
those computers first.
So anything adversary's doing
to try to see that information
inside an environment we
consider discovery.
A lot of movement is techniques, the
adversaries using to get to remote
systems on a network.
So once the adversary is in
an enterprise, the system they land
on is often not the one they need
to gain either complete control
or their final goal, which
is whatever information it is
they're coming to steal, whatever
destruction they're trying to do,
they need to get to other systems
once they've actually landed.
And so a lot of movement is the
techniques that an adversary might
do to do that.
It could be remote desktop
protocol to another system,
could be moving through secure
shell across a network.
It could be exploitation to get into
another computer and anything
the adversary is doing to move to
another system.
Collection collection
is technique's adversaries used to
gather information and
the sources that they're going
to want to follow through on the
rest of their objectives.
These are things like pulling
together the information that
they're getting ready to fill,
you know, pulling those together
into a single archive, moving into a
single system.
So it's the adversaries going
throughout a computer or
a network and gathering the
information that they're going to
take further activities on.
Command and control and control
is techniques and adversary uses
to communicate with systems
under their control, network
adversaries usually aren't
sitting next to the computer that
they're breaking into their, you
know, somewhere remote, maybe in
another country.
And they have to have some method
for actually controlling
the environments that they've landed
in.
So the techniques that are in there
in order to be able to actually talk
to a victim network or be able to
get commands in and out, fall
into command and control.
Exfiltration,
exfiltration is activities
adversaries are sending to send data
out the door.
It's often one of the main goals
of an adversary to violate
confidentiality, to steal
information that they're not
supposed to have access to.
And the specific techniques that are
sending these out the door usually
fall into exfiltration.
Finally impact so severe
the exfiltration. Most adversaries
are trying to steal data, trying
to compromise confidentiality.
But if you're familiar with the CIA
pyramid, we've got three
different goals that happen with
security, confidentiality,
integrity and availability.
So impact is the other two parts
of that triad.
It's the availability and integrity.
So it's techniques adversaries use
to disrupt availability or
compromised integrity by
manipulating business and
operational processes.
So this is your destructive
activities and your manipulative
activities.
So these are things like ransomware.
So encrypting data on end system
to make it so that people can't
access it anymore,
or things like manipulating data
on the wire to steal money.
So we've got those 14 tactics
in enterprise attack,
we went through this report before,
and this is a snippet from the same
report we used
in the previous lesson.
And this is a behavior we've
researched a little bit, too.
So our first establishes a
sock's five connection to specific
port, and then it's doing
these following commands or with the
matter.
So the adversary is creating
a connection in order to command
the power to do something.
So that's falling into command and
control.
And so this is something that we can
go through with each of the
behaviors in a report
in order to take a look at what
is it that the adversary is actually
trying to do and where
does it fall into those 14
tactics?
So in summary, some of the things
we're hoping he got out of this
lesson, I've gone
through some of the types of
behaviors that are associated with
each of the 14 tactics
in enterprise attack.
I got into a little bit about how to
link behaviors to these adversary
goals, get actually up to a tactic
and how to translate that behavior
into the corresponding tactic.