Unit 1: Who attacks and how · Lesson 2 of 4 · 18 min
The attack lifecycle
Learn the eight stages every intrusion moves through and why catching any one of them stops the rest.
mission
- You are
- The same analyst, now preparing for a case review.
- Situation
- Last month's intrusion is closed and kept for training. The SIEM tagged every alert with a stage, and the stages are listed in stages.txt.
- Goal
- Learn the stages in order and say where a defender has the cheapest chance to stop an attack.
- Hand in
- The stage name you would invest in detecting first, and why.
Read the stages
The list is ordered. An attacker cannot steal passwords from a network they never got into.
cat stages.txt
1 reconnaissance scans, staff lookups, probing login pages
2 initial-access phishing email, exposed service, stolen password
3 execution a document or script runs code
4 persistence new scheduled task, mailbox rule or account
5 credential-access passwords typed into fake pages, dumped hashes
6 lateral-movement logins from one internal host to the next
7 exfiltration archives and large uploads leaving the network
8 impact fraud, encrypted files, deleted data
you should see Eight stages, from reconnaissance to impact.
Pull out just the names
awk splits each line on spaces. Printing the second field gives a clean list you can paste into a report.
awk '{print $1, $2}' stages.txt
1 reconnaissance
2 initial-access
3 execution
4 persistence
5 credential-access
6 lateral-movement
7 exfiltration
8 impact
Find a stage by what you saw
Analysts work backwards: you see a symptom and need the stage. Search for the symptom.
grep -i 'mailbox rule' stages.txt 4 persistence new scheduled task, mailbox rule or account grep -i 'fake pages' stages.txt 5 credential-access passwords typed into fake pages, dumped hashes
you should see A forwarding rule is persistence. A password typed into a fake page is credential access.
defender tip The same tool can serve two stages. A mailbox rule is persistence when it keeps access open, exfiltration when it ships data out.
See which stages last month reached
Line the case alerts up against the list. Every stage the attacker reached is a stage where a detection was possible.
tail -n +2 alerts.csv | cut -d, -f5 | sort -u
credential-access
execution
exfiltration
impact
initial-access
lateral-movement
persistence
reconnaissance
you should see All eight stages appear. The attacker went the whole way, so every stage had at least one alert that could have ended it.
The cost curve
- ReconnaissanceLoud and early
- Initial accessUsually phishing
- Execution and persistenceCode runs, access sticks
- Credentials and movementSpread inside
- Exfiltration and impactWhat they came for
What a defender takes away
- 1Attacks move through stages in order, and each stage depends on the last.
- 2Detecting early stages is cheapest: a blocked phishing email costs nothing to clean up.
- 3Work backwards from a symptom to the stage, then look for the stages either side of it.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.