Instructor: Attack frameworks. 2 2
In this lesson, we're going to talk about 3 3
the three different attack frameworks: 4 4
the Lockheed Martin Kill Chain, 5 5
the MITRE ATT&CK Framework, 6 6
and the Diamond Model of Intrusion Analysis. 7 7
First, let's talk about the kill chain. 8 8
This kill chain model was first developed 9 9
by Hutchins, Cloppert and Amin, 10 10
under contract from Lockheed Martin's Corporation. 11 11
It was then released into the public domain 12 12
for everyone to use. 13 13
Now, the kill chain has a seven-step method 14 14
that starts with reconnaissance, 15 15
and then moves into weaponization, delivery, exploitation, 16 16
installation, commanding control, and action on objectives. 17 17
And as you can see, it is very linear, 18 18
going from the top, all the way down to the bottom, 19 19
starting with step one and going to step seven. 20 20
This is an older model and newer variations of frameworks 21 21
are doing more of an iterative approach. 22 22
But let's go through this step-by-step, 23 23
so we can see what happens in each of these stages 24 24
because it is still a good way to think about things. 25 25
First, we have reconnaissance, 26 26
and in this stage 27 27
the attacker's going to determine what methods they need to use 28 28
to complete the other phases of their attack. 29 29
Now, one of the big issues here is that the attacker 30 30
doesn't want to get caught 31 31
while they're doing reconnaissance, 32 32
so they try to be sneaky. 33 33
They try to use things like open source 34 34
and passive information gathering, and things like that, 35 35
so that they cannot be detected. 36 36
This phase, you can use both passive or active 37 37
scanning techniques 38 38
on the target network, 39 39
but generally, 40 40
we're going to start out with passive information gathering, 41 41
and then move into active scanning. 42 42
By the time you're done with reconnaissance, 43 43
you should have a good idea of what that network looks like, 44 44
what type of software they're using, 45 45
and what type of vulnerabilities may exist. 46 46
At that point, we can start figuring out 47 47
how we want to move into phase two, 48 48
which is weaponization. 49 49
During weaponization, 50 50
the attacker is going to couple payload code 51 51
that will enable access with exploit code, 52 52
and this will allow them to go after a vulnerability 53 53
to execute onto that target system. 54 54
Now, by doing this, 55 55
you basically are coding or creating the malware 56 56
or the exploit you want to run, 57 57
but you are not running it yet, 58 58
you've only created inside your own lab, 59 59
and haven't sent it to the victimized system. 60 60
This brings us to step three: delivery. 61 61
This is where the attacker is going to identify a vector 62 62
by which they can transmit the weaponized code 63 63
to the target environment. 64 64
This may be by email, this may be by dropping a USB drive, 65 65
loaded with that malware, 66 66
in their parking lot. 67 67
Whatever the mechanism is, doesn't really matter right now. 68 68
We just have to think about the fact 69 69
that we have to get it there, 70 70
and that's what delivery is all about. 71 71
Step four takes us to exploitation. 72 72
This is where the weaponized code is actually executed 73 73
on the target system, 74 74
by whatever mechanism you've done. 75 75
If you sent them an email with a phishing link 76 76
and they click that link, 77 77
the sending of the email was delivery. 78 78
Clicking the link is when exploitation happens, 79 79
and they actually start running that code. 80 80
Or if you dropped it on a USB drive, 81 81
and they plug that into their system, 82 82
and the Autorun started up that code, 83 83
that would be exploitation. 84 84
At this point, the code has been run, 85 85
and this brings us to step five, which is installation. 86 86
During installation, we're going to have a mechanism 87 87
that enables the weaponized code to run a remote access tool 88 88
and achieve persistence on that target system. 89 89
So if we had a stage one dropper that was run 90 90
as part of exploitation, 91 91
we now have downloaded and installed our phase two. 92 92
This would be our installation 93 93
and this gives us control of that system moving forward 94 94
and that persistence that we're looking for. 95 95
At that point, we move into step six. 96 96
Step six is command and control or C2. 97 97
This is where the weaponized code 98 98
establishes an outbound channel 99 99
to remote server 100 100
that can then be used to control that remote access tool 101 101
and possibly download additional tools 102 102
to help you progress in your attack. 103 103
At this point, you now pretty much own this system. 104 104
You have access to it, you can remote into that system, 105 105
and you can now run commands on that system. 106 106
That's what C2 is all about. 107 107
Now, the final step is actions on objectives. 108 108
This is where the attacker is typically going to use the access 109 109
that they've achieved through steps one through six, 110 110
to now start doing what they wanted to do. 111 111
That may be transferring data from a remote system 112 112
such as data exfiltration or some other goal or motive. 113 113
Whatever their goal was originally with reconnaissance, 114 114
they've now achieved that by being on the system; 115 115
they have two-way communication using command and control, 116 116
and now we can perform action on objectives. 117 117
Now, when we look at this kill chain, 118 118
going from step one all the way down to step seven, 119 119
we use this to do an analysis, 120 120
and a kill chain analysis can be used 121 121
to identify defensive courses of action, 122 122
by being able to counter the progress 123 123
of an attack at each stage. 124 124
So if I can start mapping out 125 125
what are all the ways somebody can break into my system, 126 126
run malicious code, gain persistence, do C2 on my servers, 127 127
and do some kind of action, 128 128
I can then put in things to block that. 129 129
I can try to detect that. 130 130
I could try to deny that. 131 131
I could try to disrupt it or degrade it. 132 132
I might want to try to deceive them, 133 133
or destroy their capabilities. 134 134
All of these things are the Six Ds 135 135
that we're going to try to do to an attacker 136 136
who's trying to break into our systems. 137 137
So this is the idea of using the kill chain 138 138
and why we do this. 139 139
Now, as I said, this is a very linear method, 140 140
but there are newer methods out there 141 141
that work in more of an iterative manner, 142 142
or allow you to think holistically 143 143
across multiple lines of attack. 144 144
For example, the MITRE ATT&CK framework 145 145
is one of those models. 146 146
Because the kill chain was criticized 147 147
for focusing too much on perimeter security, 148 148
with that linear method going from outside in, 149 149
the MITRE ATT&CK framework was developed. 150 150
Now, the MITRE ATT&CK framework is a knowledge base 151 151
that's maintained by the Mitre Corporation 152 152
for listing and explaining specific adversary tactics, 153 153
techniques and common knowledge, 154 154
which is where the ATT&CK comes from. 155 155
And these are also known as procedures. 156 156
You can find all of these at attack.mitre.org 157 157
and this is a free, open source website 158 158
that you can go and look at all this information. 159 159
Now, where the kill chain was a very linear process, 160 160
the MITRE ATT&CK framework is not. 161 161
It uses more of a matrices model, 162 162
and you can see that here on the screen. 163 163
Notice there are different columns here, 164 164
and each one is a certain type or category of attack 165 165
that might occur. 166 166
For instance, there's defense evasion, 167 167
there's credential access, 168 168
there's discovery, and lateral movement and execution, 169 169
and underneath each of these is a tactic or technique 170 170
that could be used by an attacker 171 171
to be able to accomplish that particular goal. 172 172
Now again, this is a free resource, 173 173
and you can go play with it at attack.mitre.org 174 174
Now, when you go there, 175 175
you're going to see something that looks like this, 176 176
and this is what we call the attack navigator. 177 177
From here, you can select different things 178 178
and highlight them with different colors. 179 179
What you're seeing here on the screen 180 180
is an example of one actor's TTPs that we've mapped out. 181 181
Based on that, 182 182
we know that if we're talking about APT 28, for example, 183 183
these are the things that they might be used to doing. 184 184
And if you click on each one of these 185 185
you'll get more details 186 186
about the particular TTP that they use. 187 187
Now, again, this is a great model 188 188
for being able to map out an overall adversary 189 189
and all their different capabilities and capacities 190 190
that they use in their different attacks. 191 191
And so we can compare one to another, 192 192
and then if we're on the incident response, 193 193
we can start looking, okay, 194 194
I have this and this and this that I've noticed, 195 195
and they fall into these columns, 196 196
and when I compare that against the mitre matrix, 197 197
I know that that is common 198 198
against this particular adversary. 199 199
And so that might help me figure out what defenses 200 200
I want to use. 201 201
As you look at this chart, you may notice 202 202
that it is very focused on the exploitation phase, 203 203
and it's not really focused on the reconnaissance phase. 204 204
And so if we go back and look 205 205
at the reconnaissance phase, 206 206
there's actually another matrix 207 207
called the pre-ATT&CK matrix. 208 208
The pre-ATT&CK matrix is going to align 209 209
to the reconnaissance and weaponization phases 210 210
of the cyber kill chain, 211 211
and that way we can also see what those things look like 212 212
and try to detect things before it becomes a real attack, 213 213
and while it's still in the pre-acttack phase, 214 214
'cause if we can get it earlier, 215 215
we're further left of boom, 216 216
we can then prevent that 217 217
from becoming a full-blown incident. 218 218
The third model I want to talk about 219 219
is the Diamond Model of Intrusion Analysis. 220 220
Now, this model is used to represent an intrusion event. 221 221
Anytime you have an intrusion event, 222 222
it has some relation to these four categories: 223 223
the victim, the capability, the adversary, 224 224
and the infrastructure, 225 225
as you see here on the screen. 226 226
Now, you can also put some meta-features in there; 227 227
things like a timestamp, what phase you're in, 228 228
the result, the direction, the methodology or the resources. 229 229
But these four categories are really where the focus is. 230 230
Now, for each incident, 231 231
we would want to map them out and look at this model. 232 232
For instance, this model is going to allow an analyst 233 233
to exploit the fundamental relationship 234 234
between the different features. 235 235
If we start out here, the victim starts this process, 236 236
they discover there's malware. 237 237
Now that points to capability, 238 238
because we have the ability to see that we've been had. 239 239
Then, if we see that capability, 240 240
we can then see that the malware might contain a C2 domain 241 241
as we go through our incident response. 242 242
If we do that, that now points to infrastructure 243 243
because C2 is an infrastructure problem. 244 244
Once we look at that, 245 245
we start seeing the C2 domain resolves to a C2 IP address. 246 246
Again, that's infrastructure, 247 247
so we're still in the same place. 248 248
As we start digging into that further, 249 249
we might look at our firewall logs and that reveals 250 250
that the victims have been contacting that C2 IP address, 251 251
so that points down to our victim. 252 252
But also that IP address is owned 253 253
and it provides details about the adversary, 254 254
so that now points to the adversary. 255 255
As you can see with these arrows, 256 256
how these different things tie together, 257 257
and very quickly you can see where you should focus 258 258
your efforts. 259 259
For instance, if I focus on infrastructure and C2, 260 260
that is going to help me point 261 261
towards the adversary and the victim in this case, 262 262
and it really does help me point those things 263 263
out much quicker, 264 264
using this type of a model. 265 265
Now for each event, we're also going to define a tuple 266 266
and this is in the format of e equals something. 267 267
And this is basically an array of information 268 268
that contains information on the adversary, the capability, 269 269
the infrastructure, and the victim. 270 270
And we also have things like our timestamp 271 271
and other metadata that we have. 272 272
By putting all this information into this format, 273 273
we can then use it inside of some sort of automated system, 274 274
for instance, our SIEM, 275 275
that can then help correlate all this information together 276 276
for us. 277 277
Now, each of these three models have their benefits 278 278
and their drawbacks, 279 279
and the good thing about them 280 280
is you can use them individually, 281 281
or you can actually combine them together, 282 282
and that way you can get the best of both worlds. 283 283
For instance, if I wanted to combine the diamond model 284 284
with the kill chain, 285 285
I might get something that looks like this. 286 286
You can see going from top to bottom, 287 287
I have the different steps of the cyber kill chain, 288 288
and then I have three different threads going across. 289 289
As I'm tracking these threads, 290 290
I'm starting to look at where they are 291 291
inside the diamond model, 292 292
and you can see how I went from one to two, 293 293
all the way down to fourteen, 294 294
and in there I have three different threads 295 295
or three different attacks 296 296
that are going on, 297 297
that could be three different adversaries, 298 298
and how these things connect to each other, 299 299
based on those four areas of the diamond. 300 300
So starting with one, we got up to capability, 301 301
and that tied into infrastructure of attack number two. 302 302
And then as we went down to number three, 303 303
that took us from the victim of number two 304 304
into the adversary of number three, 305 305
and so on and so on, 306 306
as we connect all these things together. 307 307
Again, the real benefit here 308 308
is starting to use these things together 309 309
to start figuring out how we can model the behavior 310 310
of our adversaries, 311 311
so we can better define how we're going to stop them 312 312
by using our analysis, 313 313
to be able to better define our defensive techniques.