The Cyber Attack Lifecycle, Cyber Kill Chain

Cyber Kill Chain

The term “Kill Chain” originated as a military term. Its purpose is to define the stages of an attack carried out by militaries against a specific targeted location.

Before carrying out cyberattacks, attackers or hacker groups conduct detailed research. One of the models that cybersecurity researchers have developed and continue to work on is the “Cyber Kill Chain” model. The Cyber Kill Chain model was developed by Lockheed Martin to help analyze targeted attacks (APTs) and make them easier to detect.

In a cyberattack, an attack plan is built to reach the targeted system and achieve the attacker’s underlying motivations. The steps followed in targeted attacks generally show a lot of similarity. The general model that captures these steps is called the Cyber Kill Chain model. As mentioned above, this model is used to make detecting and analyzing attacks easier.

This model, which spans from the reconnaissance stage all the way to the attack stage, consists of 7 stages. These 7 stages are as follows:

Reconnaissance
Weaponization
Delivery
Exploitation
Installation
Command & Control, C2
Actions On Objectives

Each of the steps in the model mentioned above proceeds as a continuation of the previous one, and you cannot move on to the next step without succeeding at the current one. This is exactly why it’s called a “Chain.” The core idea behind this model is that “failure at any one of the attack steps causes the entire attack to fail.”

Here’s an explanation of each of these steps.

1) Reconnaissance

In the first step of the model, the reconnaissance stage, the goal is to identify points of entry into the targeted system. Once these points have been identified, the attacker starts gathering the information needed to develop the attack. The information that matters to us here includes IP addresses, open ports, working hours, information about employees, the organizations they serve (if any), and information about the products in use. We can gain access to this information through social engineering, OSINT work, personal and corporate information-gathering tools, research on social media, and forums.

2) Weaponization

At this stage, after gathering information, we use the vulnerabilities and weak points we’ve identified about the target to answer questions like how and from where we’ll carry out the attack. After that, we need to build our weapon around the attack vector we’ve chosen. By “weapon,” we mean creating and packaging the malware. To be able to inject the malware we’ve created into the target, we can hide it inside a web page or any other file.

3) Delivery

In the delivery stage, work focuses on how the malware created in the weaponization stage can be smuggled into the target system. One of the most effective methods used to deliver malware at this stage is phishing. We might try to breach the system by hiding malware in an email and presenting it as a normal email.

4) Exploitation

In the exploitation stage, the vulnerability in the system is leveraged. The goal is to get the delivered malware installed on the system and to establish covert remote access. For this to work, there needs to be a flaw in some system or application the user is using. When the malware sent during the delivery stage is opened on the other end, the vulnerability in the system is exploited.

5) Installation

After the target system has been exploited, this is the stage aimed at becoming a persistent threat on the system, downloading the malware onto the target system, and extending how long the software remains on the system, all in order to successfully keep security systems under control.

6) Command & Control

The command and control stage is where the target system is controlled remotely. The target (or targets) opened up for remote access establishes a connection to a command-and-control server located on the internet. With this stage, the target system is now considered fully compromised.

7) Actions on Objectives

Having successfully carried out all the previous stages, the attacker now has access to the target system. At this stage, they can carry out their goals, such as stealing data, deleting data, modifying data, or damaging the system. After taking over the user’s systems at this stage, the attacker can also pursue further goals, such as attacking other systems (building a botnet).

At this stage, measures such as restricting the flow of data from the internal network to the external network, and allowing data to flow only to previously determined servers, can help. Continuously maintaining backups of the data on the system can also reduce the impact of attacks.

Thanks for reading this far. :)

Sources:

https://www.muhammedaygun.com/2020/03/cyber-kill-chain-siber-saldr-yasam.html
Cyber Security Operations Center (Evren Pazoğlu - M.Nezir Yücesoy)