1. Detection Scenarios ReconWeaponizationDeliverExploitationInstallationC2 Act on Objectives File File - Name URI – Domain Name URI – URL HTTP - GET HTTP – UA String Address – e-mail Address – ipv4- addr File File - Path URI - URL Behavior File File - Path File - Name URI- Domain Name URI - URL HTTP - POST Email Header - Subject Email Header – X- Mailer Hash – MD5 Hash – SHA1 Address – e-mail Address – ipv4- addr Behavior Win Registry Key File File - Name URI – Domain Name URI – URL Hash – MD5 Hash – SHA1 Address – cidr Address – ipv4- addr Code – Binary Code Win Process Win Registry Key File File - Path File - Name URI – Domain Name URI - URL HTTP - GET HTTP – UA String Hash – MD5 Hash – SHA1 Address – e-mail Address – ipv4- addr Behavior Win Process Win Registry Key File URI – Domain Name URI - URL HTTP - GET HTTP - POST HTTP – UA String Hash – MD5 Hash – SHA1 Address – e-mail Address – ipv4- addr Behavior Win Registry Key Win Service File File - Path File - Name URI – Domain Name URI – URL Hash – MD5 Hash – SHA1 Address – ipv4- addr

2. Platform Strengths (example IDS Solution) ReconWeaponizationDeliverExploitationInstallationC2 Act on Objectives File File - Name URI – Domain Name URI – URL HTTP - GET HTTP – UA String Address – e-mail Address – ipv4- addr File File - Path URI - URL Behavior File File - Path File - Name URI- Domain Name URI - URL HTTP - POST Email Header - Subject Email Header – X- Mailer Hash – MD5 Hash – SHA1 Address – e-mail Address – ipv4- addr Behavior Win Registry Key File File - Name URI – Domain Name URI – URL Hash – MD5 Hash – SHA1 Address – cidr Address – ipv4- addr Code – Binary Code Win Process Win Registry Key File File - Path File - Name URI – Domain Name URI - URL HTTP - GET HTTP – UA String Hash – MD5 Hash – SHA1 Address – e-mail Address – ipv4- addr Behavior Win Process Win Registry Key File URI – Domain Name URI - URL HTTP - GET HTTP - POST HTTP – UA String Hash – MD5 Hash – SHA1 Address – e-mail Address – ipv4- addr Behavior Win Registry Key Win Service File File - Path File - Name URI – Domain Name URI – URL Hash – MD5 Hash – SHA1 Address – ipv4- addr Notes: Security solutions are able to investigate, analyze and monitor this indicator type Security solutions are unable to track this indicator type. These areas represent gaps

3. All Detection Platforms (aggregated view) ReconWeaponizationDeliverExploitationInstallationC2 Act on Objectives File File - Name URI – Domain Name URI – URL HTTP - GET HTTP – UA String Address – e-mail Address – ipv4- addr File File - Path URI - URL Behavior File File - Path File - Name URI- Domain Name URI - URL HTTP - POST Email Header - Subject Email Header – X- Mailer Hash – MD5 Hash – SHA1 Address – e-mail Address – ipv4- addr Behavior Win Registry Key File File - Name URI – Domain Name URI – URL Hash – MD5 Hash – SHA1 Address – cidr Address – ipv4- addr Code – Binary Code Win Process Win Registry Key File File - Path File - Name URI – Domain Name URI - URL HTTP - GET HTTP – UA String Hash – MD5 Hash – SHA1 Address – e-mail Address – ipv4- addr Behavior Win Process Win Registry Key File URI – Domain Name URI - URL HTTP - GET HTTP - POST HTTP – UA String Hash – MD5 Hash – SHA1 Address – e-mail Address – ipv4- addr Behavior Win Registry Key Win Service File File - Path File - Name URI – Domain Name URI – URL Hash – MD5 Hash – SHA1 Address – ipv4- addr Notes: Security solutions are able to investigate, analyze and monitor this indicator type Security solutions are unable to track this indicator type. These areas represent gaps

4. Visibility Gaps by Threat Actor Recon Weaponization Deliver ExploitationInstallationC2 Act on Objectives HTTP – UA String File File - Path URI - URL Email Header - Subject Email Header – X-Mailer Hash – MD5 Hash – SHA1

5. Post-Incident Review (What did the actor do?) ( Why did it work?)(What should we do?) Kill ChainActor ActionActor ActionFailure ModeMitigation Action Reconnaissance Used commercial web scannerPotential gaps in threat tool & scanning capability Establish detection capability Weaponization SQL injection on vulnerable ASP page to gain admin user access Could not detect SSL traffic; vulnerable to SQL injection Explore Secure Development and Application Security Assessments Delivery Exploitation Installation IIS web service used to upload web shell Failure to restrict file upload types or configure web server to not execute uploaded files Explore Secure Development and Application Security Assessments Comm & Control Used web shell on initially compromised host Could not detect SSL traffic Actions on intent Accessed “id.txt” which held account information with admin access Management scripts failed to delete “id.txt” after running Scripts retired and environment scanned.