In this lesson,
we will learn about Post-exploitation
and Evasion Methods.
Post-exploitation
and evasion methods in threat modeling
refer to the techniques attackers use
after gaining initial access
to maintain control,
expand their reach within the system,
and avoid detection.
Post-exploitation and evasion methods
include threat actor tactics, techniques,
and procedures such as lateral movement,
unauthorized execution,
and defensive evasion.
Lateral movement involves the attacker
navigating through the network,
often by compromising additional systems
to gain access to more valuable assets or data.
Next, unauthorized execution refers
to an attacker running malicious code
or commands on compromised systems,
usually to conduct data exfiltration
or system disruption.
Finally, defensive evasion encompasses attacker tactics
to avoid detection
by security tools and analysts.
Let's learn more about lateral movement,
unauthorized execution,
and defensive evasion.
First, we have lateral movement.
Lateral movement is a technique where attackers,
after gaining initial access to a system,
navigate within the same network segment
to access additional resources.
The goal of lateral movement is to explore
and compromise other systems
within the attacker's immediate reach,
often to find high value assets like databases
or servers with administrative privileges.
This technique helps attackers expand their control
without triggering security alarms,
allowing them to persist undetected
within the compromised environment.
A related technique is pivoting.
Pivoting allows attackers to access different,
often more secure network segments
beyond the one initially breached.
Pivoting enables attackers to use
the compromised system as a launchpad
to reach other security zones
or network segments
that were previously inaccessible.
By setting up tunnels
or routes from the compromised systems,
attackers effectively bridge
to other parts of the network
that may have additional protections or segmentation.
The primary distinction
between lateral movement and pivoting
is the scope and direction of movement.
Lateral movement remains
within the initial security zone,
focusing on systems and resources
in the same network segment.
Pivoting, however, involves crossing security boundaries
to gain access to separate
and often more secure network segments,
allowing attackers to move deeper
into the organization's infrastructure.
In this lesson,
we will focus our discussion on lateral movement.
An example of lateral movement
occurred in the 2017,
WannaCry ransomware attack,
where attackers used lateral movement techniques
to spread ransomware within the corporate network.
WannaCry exploited a vulnerability
in the Windows Server Message Block protocol
using the EternalBlue exploit
to move from one Windows computer to another
within the same network segment,
allowing the ransomware to spread laterally
without crossing into different network zones.
Once it gained a foothold,
WannaCry propagated
by scanning for other vulnerable machines
within the same network segment,
targeting only devices it could reach directly.
This lateral movement enabled
WannaCry to lock down data on many systems
within each segment very quickly,
encrypting files and demanding a ransom.
By moving laterally
rather than pivoting into other network segments,
WannaCry spread across large portions
of networked computers
and affected organizations.
So preventing lateral movement requires
robust segmentation of network assets
and strict access controls.
Network segmentation limits the reach
of compromised accounts,
while implementing least privileged access ensures
that only users have the minimal access
required for their roles.
Additionally, monitoring
for unusual internal traffic patterns,
particularly those related to account device activity,
can help detect unauthorized
lateral movement attempts.
And finally, disabling or restricting
remote execution tools like a PsExec
and enforcing multifactor authentication
can further reduce the risk.
Second, we have unauthorized execution.
Unauthorized execution refers to attackers
running unauthorized commands or scripts
on compromised systems.
This often involves using malware,
remote code execution exploits,
or custom scripts
to achieve their objectives,
which may include data exfiltration
or service disruption.
Unauthorized execution gives attackers
greater control over a compromised system
and allows them to manipulate it
to their advantage.
An example of unauthorized execution
is the Emotet malware campaign
where attackers used unauthorized code execution
to deploy malware across compromised systems.
Emotet, initially, a banking Trojan
evolved into a modular malware loader
capable of delivering various payloads
such as ransomware
or data-stealing malware.
Once Emotet infected a system,
it executed unauthorized scripts
to establish persistence,
spread to additional systems,
and install other malicious software
based on the attacker's objectives.
So, to prevent unauthorized execution,
organizations should ensure
that all systems are updated
with the latest security patches
to fix known vulnerabilities.
Next, endpoint detection and response tools
can help by detecting unusual scripts
or command execution patterns,
stopping potential attacks
before they can spread.
Finally, restricting user permissions,
monitoring for unauthorized command executions,
and using robust malware detection mechanisms
further reduce the risk of unauthorized execution
in enterprise environments.
Third and last, we have defensive evasion.
Defensive evasion includes a variety
of techniques attackers use
to avoid detection
and maintain control over compromised systems.
This often involves disabling
or modifying security software,
hiding malicious processes,
clearing logs,
or using encrypted communication
to evade monitoring systems.
Defensive evasion helps attackers
remain undetected for longer,
increasing their chances of achieving
their objectives without interruption.
An example of defensive evasion
is the use of malware obfuscation
and anti-detection techniques
to hide malicious activity from security tools.
Using these methods,
attackers may obfuscate their code
or use encryption to bypass
traditional signature-based detection mechanisms,
making it difficult for antivirus
and endpoint detection tools
to identify malicious scripts.
Attackers might also disable
or tamper with security controls
such as disabling Windows Defender
or other antivirus software.
They would do this to prevent detection
of their malicious activity.
Additionally, attackers may delete
or modify system logs
to erase traces of their activity,
which helps them avoid forensic detection.
These evasive tactics allow attackers
to operate within compromised systems
for extended periods
without alerting security teams.
So, to prevent defensive evasion,
organizations should employ
behavioral-based detection systems
that monitor unusual activity patterns
rather than relying solely
on signature-based detection.
Also, enabling advanced logging,
employing tamper protection on security software,
and conducting regular audits
of security configurations
can also help detect
and prevent defensive evasion techniques.
So, remember, in post-exploitation and evasion,
attackers use techniques
to expand their access
within a compromised network
and avoid detection.
They may start with lateral movement
by exploring systems in the same network segment
to find more valuable assets
without raising alarms.
Sometimes attackers then engage
in unauthorized execution,
where they run malicious commands or scripts
to exfiltrate data or disrupt services.
With these techniques,
attackers can gain more control over systems
and pursue their objectives more effectively.
Finally, attackers use defensive evasion techniques
to cover their tracks,
like disabling security tools
or clearing logs,
making it harder for defenders
to trace their steps.
Detecting and stopping these attacker techniques
requires a combination of network segmentation,
strict access controls,
regular software updates,
and advanced behavioral monitoring.