In this stage, like a typical burglar forcing their way through the door, cyber criminals usually gain entry through an infected file, a USB stick, an exploited vulnerability, or in some cases, someone giving them the key to the door.

In most cases, attackers gain initial access, or what we call a stage 1 Initial Compromise, through the following:

• • • Phishing
    • Spear Phishing
    • Whaling

Then they typically exploit a vulnerability, either a human vulnerability or a software vulnerability.

In some special cases, for example the famous Solarwinds backdoor which, companies that use their service are vulnerable since the threat actors distribute their malware together with a signed binary that will not be flagged as malicious by security tools. 

To mitigate these types of attacks, organizations can invest in user awareness and conduct phishing tests, which can test their organization.

In this stage, a level 1 initial compromise is established, just like a burglar would after they successfully breach the house. Now they contact the other party for further instruction.

What happens on this stage is that actors perform an enumeration of the system, exploring the territory and looking for possible accounts with administrator privileges to compromise. But, at this stage, threat actors aim to be as stealthy as possible. What they do to become stealthy is that they move slowly. Sometimes they let their malware sleep for a few days, weeks, or months to avoid the noise it can make that might blow up their cover.

At this stage, typically, you may want to look for possible enumeration commands like:

• • • whoami
    • net user *
    • tasklist 
    • Get-Services 

#note: System Administrators use these commands everyday to complete their tasks; look for anomalies such as executing these commands within a minute and the account name associated with it.  Again, these commands are used for legitimate purposes, just look for anomalies.

At this stage, an account with administrator privilege is identified and compromised. With this account, attackers can now perform to move laterally inside the network, which aims to elevate from level 1 initial compromise to level 2 compromise, jumping from machine to machine to reach the keys to the kingdom.

At this stage, attackers perform their moves as stealthily as possible to avoid detection. Attackers perform “living off the land” techniques, which use legitimate tools that are used by administrators to propagate to the network.

Threat actors enumerate the following in this stage:

• • • local routing tables: routeprint
    • ARP cache: arp cache
    • User and Account Privs: net user / net groups
    • System Data: tasklist, wmi, powershell

Those are some of the commands to monitor. Again, those commands are legitimate and used by administrators in their day-to-day tasks. Just look for anomalies and odd usage of the tool and you are set.

At this stage, threat actors have successfully leveraged from level1 compromise to the keys to the kingdom at this point. Once adversaries have found valuable data within the network, their next task is to copy that data outside of the company’s network, to a target location of their choosing, presumably a place outside of the jurisdiction of the authorities of the victim organization and one that masks the identity of the attackers.

This final step is the payoff for the attackers, allowing them to monetize their operation by ransoming the data, selling it on the black market, or otherwise exploiting it.

What threat actors had done on this stage are:

• • • Archive: Gzip, zip, tar, winrar
    • Tunneling: FTP Server, Dropbox, Google Drive 
    • Establish Destination: FQDN, DNS, URL

As a hunter, we can monitor this type of data inside our network for anomalies. In such cases, for example monitoring data transfer that exceeds up to 500MB in a single transfer or day.

#note: You must have IDS/IPS and data sources to detect these types of events inside your network. Without log/data sources it is impossible to detect exfiltration.

In this stage, threat actors try to stay on the compromised network as stealthily as possible. At this point, registry keys, kernel configurations, and security tools may have been altered, allowing them to move freely without fear of detection.

Advance threats keep the system monitoring their target for as long as possible, giving them an advantage in seeing what tactics the security team is using to hunt for specific threats and changing their TTPs to avoid detection. Also, by maintaining persistence, threat actors are able to capture new data such as company’s intellectual property.

In this stage, threat actors maintain and persist on the system through the following registry keys:

• • • Services 
    • Winlogon
    • Run
    • RunOnce
    • Known_DLLs

These are some of the most common persistent techniques used by attackers.

#note: To detect such changes, hunters can use security tools and actively compare the current system’s baseline to the previous baseline with a clean state status.