1. Conquering all phases of the attack lifecycle

2. The Headlines: Damage. Damage. Damage.

3. The Technical Headlines: Penetration.

4. The Attack Lifecycle Penetration ↓ Hacking operation ↓ Breach detected
Damage
Sec.
Min.
Hrs.
Days
Weeks
Months
Time
Breach
C & C
Recon
Spread
Damage

5. The Attack Lifecycle

6. External Recon Social Networking Conferences Call Help Desk or Admin
External Scans
Buy Information/Tools in Black Market

7. Breach: Penetration. Privilege escalation. Obfuscation.
Phishing & spear phishing
Vulnerability exploit
Social Engineering
Infected USB drive
Compromised credentials
Autorun
Process Injection
Breach
C & C
Recon
Spread
Damage

8. Process Injection Evasion Reading host process memory
Running another procedure as a thread inside another process.
Evasion
Reading host process memory
Affecting host process behavior

9. Process Injection
Code injection is a great way to hide yourself. It's a great way to gain privileges to do things that might be blocked otherwise. This is part of the first step of an attack, part of the [foothold]. If we're able to identify this specific technique, we can stop the attack in the very, very early stage.

10. Command & Control Operation. Exfiltration. Legitimate HTTP
Legitimate DNS request
Fust Flux
TOR
Facebook / Twitter / YouTube comments
Domain Generation Algorithm
Breach
C & C
Recon
Spread
Damage

11. Command & Control Domain generation algorithm
Regular C&C servers can be blacklisted and firewalled
DGA is generating a daily domain list (1000’s of domains)
Malware tries to resolve each one of those random domains.
The attack (who created the algorithm) knows which domains will be generated.
Once a certain C&C domain is blocked, attacker can select one of the daily generated domains, register it and continue his endeavors.
Breach
C & C
Recon
Spread
Damage

12. Command & Control
DGA
Breach
C & C
Recon
Spread
Damage

13. Recon Scanning ARP scanning SYN scanning FYN scanning Port scanning
("half-open scanning“)
FYN scanning
Port scanning
Breach
C & C
Recon
Spread
Damage

14. Reconnaissance Port Scanning
Services are using ports to communicate (HTTP = 80, DNS = 53, etc.)
When an attacker gets a foothold on a computer, he needs to move around the organization.
The attacker scans the subnet to find exposed and exploitable services on other computers and platforms.
Once an open port is found, further exploitation occurs.

15. Reconnaissance
Port Scanning

16. Spread Pass The Hash/Ticket Shares PSExec
Lateral movement - Legitimate tools used maliciously.
Pass The Hash/Ticket
Shares
PSExec
Breach
C & C
Recon
Spread
Damage

17. Spread PSEXEC - Legitimate tools used maliciously.
A legitimate tool by Microsoft.
Commonly used by IT professionals
Allows to run a process on a remote machine interactively.
Attackers use that technique to spread their malware through an entire network.
Breach
C & C
Recon
Spread
Damage

18. Lateral Movement --- Pass-the-ticket

19. Lateral Movement --- Pass-the-ticket

20. Damage. Business. Money. Physical.
Breach
C & C
Recon
Spread
Damage

21. The Attack Lifecycle

22.
Thank you.