In this lesson,
we will learn about Indicators of Attack.
Indicators of Attack are observable behaviors
and patterns that suggest an ongoing or imminent attack.
Indicators of Attack focus on the Tactics, Techniques,
and Procedures, or TTPs, that adversaries use.
TTPs outline specific methods attackers employ
to accomplish their goals such as spear-phishing
to gain Initial Access,
using PowerShell scripts for Privilege Escalation
or leveraging remote desktop protocol
for Lateral Movement across systems.
By identifying attacker TTPs,
threat hunters can quickly detect malicious activities
on their network and predict an attacker's next steps.
Let's learn more about the Tactics, Techniques
and Procedures, or TTPs, that adversaries use.
Tactics, techniques, and procedures refer to the methods
and strategies attackers use to carry out attacks.
Tactics represent the overarching goal of the attack.
Techniques are the specific actions taken
to achieve these goals.
And procedures describe the exact methods used
to execute the techniques.
Understanding TTPs enables threat hunters to search for
and identify Indicators of Attack
by recognizing patterns and behaviors.
Then, by monitoring these behaviors with security tools,
security teams can predict, detect and prevent attacks.
Let's follow some specific TTPs
through the threat hunting process
and understand how Indicators of Attack may be discovered.
The TTPs we will specifically follow our Initial Access,
Privilege Escalation, Lateral Movement, Exfiltration,
Command and Control, and Persistence.
First, we have Initial Access.
Initial Access is the first step attackers take
to penetrate a network.
Common techniques include phishing,
exploiting vulnerabilities, and using stolen credentials.
Threat hunters must detect these tactics quickly
to prevent attackers from establishing a foothold
in the network.
Recognizing Initial Access TTPs,
such as spear-phishing attempts
or abnormal login activity allows security teams
to block entry points and stop the attack from escalating.
For example, security teams may detect a surge
in login attempts from unfamiliar IP addresses
or an increase in phishing reports.
These signs could indicate an adversary's attempt
to gain access.
So tools like email filtering systems
and multifactor authentication can be used
to prevent successful phishing attempts,
while Security Information and Event Management,
or SIEM, systems can be used
to track anomalies in login behavior.
Second, we have Privilege Escalation.
Privilege Escalation occurs when attackers attempt
to elevate their access to higher levels,
allowing them to control more sensitive data or systems.
Common techniques include exploiting unpatched software,
using malicious scripts or modifying user privileges.
Detecting Privilege Escalation TTPs early
helps prevent attackers
from gaining deeper control over the network.
To identify Privilege Escalation,
threat hunters monitor suspicious PowerShell commands
or unusual changes in user account privileges,
which could signal and attempt to escalate privileges.
Additionally, endpoint detection tools
like CrowdStrike are useful
for tracking abnormal script execution
or privilege modifications.
Detecting these behaviors enables security teams
to lock down affected accounts
and investigate malicious activities.
Third, we have Lateral Movement.
Lateral Movement refers
to attackers shifting from one system
to another within a network to reach high value targets
or sensitive data,
techniques such as exploiting Remote Desktop Protocol
or using administrative tools like PSExec are commonly used
in Lateral Movement.
So recognizing Lateral Movement TTPs can stop attackers
from expanding their access across the network.
Threat hunters may detect Lateral Movement
through unusual remote desktop protocol connections,
or the use of administrative tools on systems
that don't typically communicate.
SIEM systems and network traffic analyzers can
also help identify these types of activities,
allowing security teams
to isolate affected systems and investigate
before an attacker reaches their ultimate target.
Fourth, we have Exfiltration.
Exfiltration occurs when attackers attempt
to steal sensitive data and transmit it outside the network.
Exfiltration techniques include using encrypted channels,
disguising the data as normal traffic,
or leveraging legitimate cloud services
to exfiltrate the data unnoticed.
So recognizing Exfiltration TTPs prevents data theft.
Indicators of Exfiltration include unusual outbound traffic
or large file transfers to external cloud services.
Data loss prevention tools are effective in monitoring
and blocking unauthorized data transfers like these.
So when Exfiltration attempts are detected,
security teams can immediately sever network access
or disabled accounts to prevent data loss.
Fifth, we have Command and Control, or C2.
C2 is the method
by which attackers maintain communication
with compromised systems,
allowing them to control malware
or exfiltrate data remotely.
Common C2 techniques include DNS tunneling
or connecting to malicious servers.
So detecting C2 channels is vital
to cutting off attacker's ability
to control the compromise systems.
Threat hunters can detect C2 activity
through unusual outbound connections to suspicious domains
or unexpected DNS queries.
Intrusion detection systems
and network monitoring tools can help identify
and sever these C2 channels,
disrupting the attacker's control
and preventing further damage.
Sixth and last, we have Persistence.
Persistence techniques allow attackers to maintain access
to a system even after their initial presence is detected.
Common Persistence methods include
creating new administrative controls, installing back doors,
or modifying system settings.
So detecting Persistence TTPs can ensure
attackers do not regain access
after being removed from the network.
Threat hunters can identify Persistence by monitoring
for the creation of unauthorized user accounts
or unexpected changes in system configurations.
And Endpoint Detection and Response,
or EDR, tools like Carbon Black
or CrowdStrike can alert teams to these behaviors,
allowing security teams to remove the attacker's foothold
and prevent reentry.
In the end,
setting up alerts for known TTPs allow security teams
to detect suspicious activity early
and respond before the attack escalates.
For instance, if an EDR tool detects a known malicious
PowerShell script used for Privilege Escalation,
teams can investigate and neutralize the threat swiftly.
And by using a combination of these tools
and threat intelligence, organizations can stay ahead
of attackers and safeguard their critical assets.
So remember, Indicators of Attack are patterns
and behaviors that signal an ongoing or imminent attack.
Indicators of Attack are based on the Tactics,
Techniques and Procedures, or TTPs,
that attackers use, which outline their goals and methods.
In an enterprise setting,
understanding TTPs helps security teams detect attacks
before they escalate.
So by actively searching for TTPs,
such as Initial Access, Privilege Escalation,
Lateral Movement, Data Exfiltration,
Command and Control, and Persistence,
security teams can prevent attackers
from compromising critical systems
or stealing sensitive information.
This proactive approach combined
with the right tools like Endpoint Detection and Response
and SIEM platforms help keep organizations protected
and one step ahead of potential threats.