Welcome everyone to other video of expert malware analysis and reverse engineering course 1
And in this video we are going to give a detailed introduction to the cyber kill-chain model. 2
The term Kill-chain was originally used as a military concept related to the structure of an attack consisting of the target 3
identification, force dispatched to the target, decision and order to attack the target and finally destruction 4
of the target. 5
Also, the same idea is used in terms of breaking the open and scale chain in order to build a defensive 6
strategy against it. 7
Lockheed Martin adopted the same kill-chain model in cybersecurity and we call it as the cyber Kill-chain 8
model. 9
So what exactly this model consists of. 10
So it consists of seven different stages of intrusion which is called intrusion Kill chain. 11
It consists of reconnaissance, weaponization, delivery exploitation, installation, command and control & 12
action on objectives. 13
We have briefly seen some details about cyber kill chain in our previous interaction videos as well 14
here will slightly go into much more details of this step and we'll try and understand how this is critical 15
to any cybersecurity professional as it is very useful in day to day analysis of threats and attacks. 16
That was the intrusion part of the kill chain. 17
If you look at the lower part of this diagram you'll see that there are defeating steps as well which 18
are to detect, deny, disrupt, degrade, deceive and destroy. 19
So if you are an attacker you are basically following the instruction chain the top seven steps. 20
And if you are a defender you are basically following the lower seven steps or you are basically using 21
the 7 D's to kind of detect or destruct any ongoing attack or campaign. So let go into a much more detail explanation 22
of all the steps one by one. So we start with the Reconnaissance and at Weaponization stages. So in Reconnaissance 23
the attacker basically does an extensive research on the target to try and identify the servers, the 24
machines, the versions of softwares, the employees, their email ids, their contacts and things like that. 25
This is basically the information gathering stage where the attackers collect as much information as 26
possible. In the Weaponization stage, the attack uses the collected information from reconnaissance as its 27
next step towards building the attack. 28
The attacker basically starts thinking about the right mode for victimizing the target. 29
Then comes the delivery phase. 30
So once the attacker has identified his weaponization stage, the next attack vector would be to deliver the 31
weaponized item to the target. 32
For example spam emails. 33
Let's say the attacker in the weaponization phase was able to figure out the e-mail id of few HR's 34
working in an organization. 35
The attacker then decides to create a weaponized malicious e-mail and delivered it to all those H.R. 36
departments. 37
That particular e-mail would contain an attachment that would have an exploit inside it. 38
That's where the exploitations bit face comes into action. 39
So in the exploitation phase compromising the target in order to get unauthorized access and an elevated 40
privilege off the system that is compromised. Once the exploitation is done, 41
The next phase is the installation of the malware. 42
So the malware will now sit onto the system in order to start performing the command and control and 43
the command and control is basically the exfiltration of data, stealing of critical information from 44
the infected machine, from the infected network all the way out to its own control. 45
server. 46
So this is how the attack is layered 47
for all the seven steps of the cyber kill chain. 48
Similarly we have the proactive defense and mitigation steps as well. 49
So in the kill chain, if you look at the first three, three and a half steps. if we just divide the 50
exploitation into let's say two halfs, then the first three and a half steps basically tells you how you 51
can proactively detect and mitigate any threat. 52
That's where most of the security tools work upon. 53
For example you can have spam filters, 54
You can have anti-viruses, to basically proactively detect and mitigate the threats that happened 55
in the environment. 56
For the latter three and a half steps you basically do a containment and incidents response. 57
This means that the attack has already happened. 58
The network is already infected. 59
Now you try and contain it and you try to understand how that incident happen. 60
What was the reason for that infection. 61
Where else did that infection flow from the particular machine where it happened. 62
So here is a brief diagram of the example of a spam attack mapped on the cyber kill-chain. 63
If you see a spam email arrives on to the victim machine that contains a zip file. The zip file inside 64
contains a document file. The doc file can contain multiple different exploits based on which of them work 65
on the compromised. 66
So once the exploitation happens the malware gets installed onto the system and after that installation 67
the malware begins communicating with its command and control. 68
So this is how the entire attack is mapped with the cyber kill chain model. 69
This is going to be very helpful for us throughout this course because our analysis is also going to start in the 70
same way. We will first look at a spam e-mail then we'll go ahead we'll look into its attached document. Once 71
we analyze the document, 72
We are going to extract its features. It might contain an exploit or it may directly try and install a malware. 73
Then we are going to understand those exploits, we are going to understand those malware and then we 74
are going to see how their malware sits into the system. 75
How it elevates its privilege and later on how it performs the command and control. 76
So this is the overall structure the overall course design and this is how cyber kill chain basically 77
maps the entire attack onto a single model. 78
So that was a introduction for cyber kill chain. 79
There is a lot of information available on Google as well. 80
I would highly encourage you all to just go ahead and read more about cyber kill chian and how different 81
organizations are using it to build up their defense, to build up their proactive detection strategies 82
around this model. 83
That's all for this video. 84
Thanks everyone.