Cyber Kill Chain vs MITRE ATT&CK
1. Cyber kill chain framework -
The Cyber kill chain is a foundational cybersecurity framework developed by Lockheed Martin that models the stages of a cyber attack. It is a linear model based on attacker's journey.
Cyber kill chain- attacker's lifecycle
Breaking chain = stop entire attack.
2. MITRE ATT&CK framework-
The MITRE ATT&CK framework (Adversarial Tactics, Techniques, and Common Knowledge) is a globally accessible, continuously updated knowledge base that catalogs real-world cyber adversary behaviours, created by in MITRE corporation 2013.
# Standard Hacking Methodology-
Practical execution workflow.
Reconnaissance
Scanning
Gaining Access
Maintaining Access
Clearing Tracks
1. Reconnaissance- Information gathering
Before attacking, i must know who, what, where & how
Defence view for SOC:
Monitor excessive DNS queries
Track scanning behaviour
Watch unusual OSINT based phishing pattern
2. Weopanization
Attacker prepare a payload + exploit.
Payload = what runs after exploit Exploit = How vulnerability is abused
e.g. Malware embedded in a PDF.
Defence view for SOC:
File hash analysis
Malware sandboxing
Detect known exploit signature
3. Delievery
Weapon is delievered to the victim.
e.g. HR recieve a "Resume.pdf.exe" file in email. (double extension file)
Defence view for SOC:
Email gateway filtering
URL reputation
Attachment Sandboxing
4. Exploitation
Vulnerability is actually triggered.
e.g. User click phishing link, Software buffer overflow.
No exploit = no compromise
5. Installation
Malware install persistance/backdoor.
Techniques:
Registry Run keys
Scheduled task
Startup folder
Backdoor users
Defence view for SOC:
EDR
Registry Monitoring
Autorun analysis
6. Command and Control (C2)
Compromise system talks to attacker's server.
e.g. Beaconing every 60 seconds, DNS tuneeling, HTTP based C2.
Steps:
Initial compromise (Phishing email)
Malware installed/diploy on host
C2 channel established
Command issued(Remote control by attacker)
Data exfilterated/Lateral movement
Defence view for SOC:
Abnormal outdated traffic
Beconing pattern
Known bad IPs/domains
7. Attack on objectives
Attacker does what they came for.
Their objectives:
Data theft
Ransomware Deployment
Credential dump
Lateral movement
financial fraud
THis is where real damage happend
Alert Reporting
Alert reporting is the process of formally documenting.
What was detected
What was analyzed
What conclusion was reached
What action was taken or recommended
SOC Golden Rule-
If it's not documented, it did not happened.
bad report = bad analyst,
even if triage was correct.
Document everything
Escalation
"This alert is beyond tier-1 authority and require higher expertise or action."
Tier-1 : Doesn't fix incident, identifies and hand over correctly.
When should tier-1 escalate?
Condition | Example |
1. Confirmed malicious activity | Malware detected |
2. Privilege account involved | Admin user |
3. Critical assest affected | Server/Domain Controller(DC) |
4. Multiple alerts correlated | Phishing + Execution |
5. Data risk exists | Possible exfiteration |
6. Policy requires escalation | Severity high/critical |
Esacalation is not failure, It's professionalism
Alert escalation documentation-
e.g. Tier-1 escalation note:
Escalation reason : Confirmed suspecious powershell execution with external communication.
Evidence attached : Process tree, command line, destination domain.
Severity : high
Recommended action : Endpoint isolation and memory analysis.
This makes L2 analyst trust you instantly.
SOC Communication
SOC Communication :
Analyst --> Analyst
Analyst --> IR Team
Analyst --> IT/Admin
SOC -->Managment
You are tranlating technical risk into actionable information.
Communication Principle-
Clear
Factual
No assumptions
No panic language
No blame
instead of "System hacked badly", say Suspecious activity detected, under investigation.
Communication types-
1. Internal SOC communication:
Used during-
Shift handover
Escalation
Collaboration
e.g. Handover Note:
Alert escalated to L2, endpoint pending isolation. Monitoring outgoing.
2. IT/Admin communication:
used when action is needed.
e.g. Please isolate FIN-Lap-07 from the network as suspecious activity was detected.
3 . Managment communication (High Level):
Managment doesn't want logs, they want impact + status.
e.g. Suspecious activity detected on one finance user's system. No evidence of data exfilteration so far, incident under investigation.