Category: Defensive Techniques (Page 1 of 6)

In our last post, we explored how attackers gather valuable information through the Collection tactic. Once adversaries have a foothold and have collected data, they need a way to maintain control over compromised systems and coordinate their activities. In military operations, you’ll see a mix of overt and covert forms of communications. But we know they are happening. Without them, the various units involved would be uncoordinated and the attack would fail before major objectives could be accomplished. Cyber adversaries need this sustained control as well. Payloads are unable to act autonomously for long. And exfiltrating data without it is futile. This is where the next MITRE ATT&CK Tactic comes into play: Command and Control (C2). Let’s dive into how attackers use C2 to orchestrate their operations and why it’s a critical component of almost every sophisticated cyber attack.

In last week’s post, we tool at look at how attackers move laterally. They do this to get to their goals and to better entrench themselves. Whether the adversary is an APT or special forces unit, gathering information is critical to the success of any mission. If there are exceptions, they’re probably limited to bombardments (in physical warfare) or Denial of Service (DoS) attacks (in cyber). It’s tough to have long-lasting effects without going further than those brute-force attacks. FThe information may be the end goal, or it may be essential to achieving it. The next MITRE ATT&CK tactic is Collection. Let’s look at how almost every adversary on the very diverse spectrum of threats needs it.

It has been almost a month since my last MITRE ATT&CK Tactic-focused entry, and I apologize! When we discussed Discovery, we saw many ways adversaries explore the target environment after Initial Access. Depending on the threat, that information might be used for any number of malicious goals. Threat actors locate files and credentials of interest and uncover details of defenses and configurations. They could learn compromising information about a victim. Many aim to gain illicit access into victim’s financial or intellectual property. Almost every threat actor plans on expanding their reach and to pivot throughout an environment. This “lateral movement” allows the attacker to spread activities out, impact more systems, and achieve even greater levels of persistence. Whether a cyber adversary or an invading army, lateral movement is essential to many other goals or tactics. So let’s take a look at how the ATT&CK tactic of Lateral Movement works!