Unit 1: Who attacks and how · Lesson 2 of 4 · 18 min
The attack lifecycle
Learn the eight stages every intrusion moves through and why catching any one of them stops the rest.
mission
- You are
- The same analyst, now preparing for a case review.
- Situation
- Last month's intrusion is closed and kept for training. The SIEM tagged every alert with a stage, and the stages are listed in stages.txt.
- Goal
- Learn the stages in order and say where a defender has the cheapest chance to stop an attack.
- Hand in
- The stage name you would invest in detecting first, and why.
Read the stages
The list is ordered. An attacker cannot steal passwords from a network they never got into.
cat stages.txt
1 reconnaissance scans, staff lookups, probing login pages
2 initial-access phishing email, exposed service, stolen password
3 execution a document or script runs code
4 persistence new scheduled task, mailbox rule or account
5 credential-access passwords typed into fake pages, dumped hashes
6 lateral-movement logins from one internal host to the next
7 exfiltration archives and large uploads leaving the network
8 impact fraud, encrypted files, deleted data
you should see Eight stages, from reconnaissance to impact.
cat- Prints the contents of one or more files. Built into Linux and macOS.
Pull out just the names
awk splits each line on spaces. Printing the second field gives a clean list you can paste into a report.
awk '{print $1, $2}' stages.txt
1 reconnaissance
2 initial-access
3 execution
4 persistence
5 credential-access
6 lateral-movement
7 exfiltration
8 impact
awk- Splits each line into fields and prints or counts the ones you ask for. Built into Linux and macOS.
Find a stage by what you saw
Analysts work backwards: you see a symptom and need the stage. Search for the symptom.
grep -i 'mailbox rule' stages.txt 4 persistence new scheduled task, mailbox rule or account grep -i 'fake pages' stages.txt 5 credential-access passwords typed into fake pages, dumped hashes
you should see A forwarding rule is persistence. A password typed into a fake page is credential access.
defender tip The same tool can serve two stages. A mailbox rule is persistence when it keeps access open, exfiltration when it ships data out.
grep- Prints the lines of text that match a pattern. Built into Linux and macOS.
See which stages last month reached
Line the case alerts up against the list. Every stage the attacker reached is a stage where a detection was possible.
tail -n +2 alerts.csv | cut -d, -f5 | sort -u
credential-access
execution
exfiltration
impact
initial-access
lateral-movement
persistence
reconnaissance
you should see All eight stages appear. The attacker went the whole way, so every stage had at least one alert that could have ended it.
tail- Prints the last lines of a file, or follows it as it grows with -f. Built into Linux and macOS.
cut- Keeps only chosen columns or characters from each line. Built into Linux and macOS.
sort- Sorts lines of text. Built into Linux and macOS.
The cost curve
- ReconnaissanceLoud and early
- Initial accessUsually phishing
- Execution and persistenceCode runs, access sticks
- Credentials and movementSpread inside
- Exfiltration and impactWhat they came for
What a defender takes away
- 1Attacks move through stages in order, and each stage depends on the last.
- 2Detecting early stages is cheapest: a blocked phishing email costs nothing to clean up.
- 3Work backwards from a symptom to the stage, then look for the stages either side of it.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.