USING AN

EXPANDEDCYBER KILL CHAIN MODELTO INCREASE ATTACKRESILIENCYSEAN T MALONE@SEANTMALONE
WWW.SEANTMALONE.COM

WWW.FUSIONX.COM

PRESENTER BACKGROUND• 10+ Years in Offensive Information
Security• 4 Years of Adversary Simulation
with FusionX• Executing Realistic Attack
Simulations – and Responding
When it’s NOT a Drill

2AGENDA• Legacy Cyber Kill Chain Model• The Expanded Cyber Kill Chain Model- The Internal Kill Chain- The Target Manipulation Kill Chain• Understanding the Stages of a Sophisticated Attack• Using the Expanded Model to Build a Resilient Enterprise3

LEGACY CYBER KILL CHAIN MODEL
Reconnaissance• Harvesting email addresses, conference
information, etc.

Weaponization• Coupling exploit with backdoor intodeliverable payload

Delivery• Delivering weaponized bundle to the victim
via email, web, USB, etc.

Exploitation• Exploiting a vulnerability to execute codeon victim’s system

Installation• Installing malware on the asset

Command & Control (C2)• Command channel for remotemanipulation of victim

Actions on Objectives• With “Hands on Keyboard” access,intruders accomplish their original goal
From http://cyber.lockheedmartin.com/solutions/cyber-kill-chain

4

LEGACY CYBER KILL CHAIN MODEL“The Cyber Kill Chain model, as sexy as itis, reinforces old-school, perimeterfocused, malware-prevention thinking.”- Giora Engel, Deconstructing The Cyber Kill Chain,
Dark Reading 2014

“Excellent for [external] attacks,
but doesn’t exactly work forinsider threats.”“In today’s environment, every
cyber attacker is a potentialinsider.”- Patrick Reidy, Combating the Insider Threat at
the FBI, Black Hat USA 2013

- Matt Devost, Every Cyber Attacker is an Insider,
OODA Loop 2015

5“Perimeter Breach Kill Chain”

LEGACY CYBER KILL CHAIN MODEL
Reconnaissance• Harvesting email addresses, conference
information, etc.

Weaponization• Coupling exploit with backdoor intodeliverable payload

Delivery• Delivering weaponized bundle to the victim
via email, web, USB, etc.

Exploitation• Exploiting a vulnerability to execute codeon victim’s system

Installation• Installing malware on the asset

Command & Control (C2)• Command channel for remotemanipulation of victim

Actions on Objectives• With “Hands on Keyboard” access,intruders accomplish their original goal

GAME
OVER ?
6Example Target Manipulation Objectives:• Financial Theft‒ Modify queued wire transfers to redirect payments• Reputation Impact and Loss of Market Share through DoS‒ Disable all company workstations• Disable Infrastructure in Preparation for Kinetic Attack‒ Quickly cycle smart electric meters to overload grid

• Provide Propaganda Support for Coup Attempt‒ Hijack television broadcast• Cause Terror in Regional Population‒ Change concentration of chemicals added to water supply

THE EXPANDED CYBER KILL CHAIN MODELLEGACY CYBERKILL CHAIN
INTERNAL KILLCHAINTARGET
MANIPULATIONKILL CHAIN

Breach the Enterprise
Network Perimeter
Gain Access toTarget Systems
Manipulate Target Systems
to Achieve Objective
8THE EXPANDED CYBER KILL CHAIN MODELLEGACY CYBER KILL CHAIN
External
Weaponization
ReconnaissanceCommon to Most
Objectives

Objective-Specific

Delivery

External
Exploitation

Installation

Command &Control

Actions on
Objectives

INTERNAL KILL CHAIN
Internal
Internal
Reconnaissance Exploitation

Ent. Privilege
Escalation

LateralMovement

TargetManipulation

TARGET MANIPULATION KILL CHAIN
TargetTargetReconnaissance Exploitation

Weaponization

Installation

Execution910ALTERNATIVE: SPIRAL MODEL11ALTERNATIVE: TREE MODELX
OriginX
ObjectiveX

XXX

12UNDERSTANDING THE STAGES OF A
SOPHISTICATED ATTACK13INTERNAL RECONNAISSANCE

INTERNAL KILL CHAIN

Internal
ReconnaissanceInternal
Exploitation

OBJECTIVE

TIME REQUIRED

Data mine available systems
and map the internal
network and vulnerabilities

1 to 2+ Weeks

OFFENSIVE TTPS

DEFENSIVE TTPSEnterprisePrivilege
Escalation
LateralMovement
TargetManipulation••

DOMEX of local files,
network shares, browser
history, wiki/SharePoint
Light service probing••Prevent: Granular resource
authorization
Detect: Behavioral changes
from this IP & user account

14INTERNAL EXPLOITATIONINTERNAL KILL CHAIN

Internal
ReconnaissanceInternal
Exploitation
EnterprisePrivilege
Escalation
LateralMovement
TargetManipulation•••

OBJECTIVE

TIME REQUIREDExploit information andvulnerabilities on internalsystems

2 DaysOFFENSIVE TTPS

DEFENSIVE TTPS

System vulnerabilities
Web application
vulnerabilities
LLMNR/NBNS Spoofing••

Prevent: Patch & vuln.
management (including dev& test systems)
Detect: Endpoint protection

15

ENTERPRISE PRIVILEGE ESCALATIONINTERNAL KILL CHAIN

Internal
ReconnaissanceInternal
Exploitation
EnterprisePrivilege
Escalation
LateralMovement
TargetManipulation••••

OBJECTIVE

TIME REQUIRED

Leverage compromised
accounts and trust
relationships to gain a highlevel of privilege

1 to 3 Days

OFFENSIVE TTPS

DEFENSIVE TTPS

Kernel / system vulns.
Pass-the-hash & Mimikatz
Unprotected SSH keys
Creds in configuration files••Prevent: Run as leastprivilege accounts; use good
security hygiene
Detect: Behavioral analytics

16

LATERAL MOVEMENT

INTERNAL KILL CHAIN

Internal
ReconnaissanceInternal
Exploitation

OBJECTIVE

TIME REQUIRED

Pivot through compromisedsystems into restrictednetwork zones

4 HoursOFFENSIVE TTPS

DEFENSIVE TTPSEnterprisePrivilege
Escalation
LateralMovement
TargetManipulation••

Target virtualization, backup,
config management layers
Layer SSH proxy tunnels to godeep••

Prevent: Segmented security
zones at all layers
Detect: Behavioral analysis ofsuccessful login events

17

TARGET MANIPULATION KILL CHAIN

TARGET RECONNAISSANCEOBJECTIVE

TIME REQUIRED

Map & understand objectivespecific systems

1 Week to 3 Months

OFFENSIVE TTPS

DEFENSIVE TTPS

TargetReconnaissanceTargetExploitation
Weaponization

Installation

Execution••

DOMEX of Vendor
documentation, internal
training, source code
Standard admin utilities••

Prevent: Restricted access todocumentation &specifications
Detect: Access patterns

18

TARGET MANIPULATION KILL CHAIN

TARGET EXPLOITATION
TargetReconnaissanceTargetExploitation

OBJECTIVE

TIME REQUIREDGain access to target systems
via trust relationships or new
vulnerabilities

1 HourOFFENSIVE TTPS

DEFENSIVE TTPS

Weaponization

Installation

Execution••

Default credentials, EOL
systems, vendor backdoors
Trust relationships withcentral authentication system••

Prevent: Change defaults &segregate authentication
Detect: Endpoint protection
and behavioral analytics

19

TARGET MANIPULATION KILL CHAINWEAPONIZATIONTarget
ReconnaissanceTargetExploitation

OBJECTIVE

TIME REQUIREDDevelop platform-specificmalware to subvert target
systems & businessprocesses

1 Week to 3 Months

OFFENSIVE TTPS

DEFENSIVE TTPS

Weaponization

Installation

Execution••

Duplicate target environment
in a lab
Extract, decompile, andreverse proprietary software••

Prevent: Harden/obfuscate
applications to makereversing difficult
Detect: N/A - working offline

20

TARGET MANIPULATION KILL CHAIN

INSTALLATION
TargetReconnaissanceTargetExploitationOBJECTIVE

TIME REQUIRED

Deploy custom malware totarget systems

1 HourOFFENSIVE TTPS

DEFENSIVE TTPS

Weaponization

Installation

Execution••

Patch or replace scripts,binaries, and configurations
Tamper with detectivecontrols••

Prevent: Application signing
Detect: File integrity
monitoring, redundant
processing systems

21

TARGET MANIPULATION KILL CHAINEXECUTION
TargetReconnaissanceTargetExploitation

OBJECTIVE

TIME REQUIRED

Activate malware to subvert
target system operation,with material consequences

1 Second

OFFENSIVE TTPS

DEFENSIVE TTPS

Weaponization

Installation

Execution••

Wait for optimal timing(market or geopolitical)
May be all at once or slow
damage over time••

Response controls – have youwar-gamed this?
Breach insurance may help
mitigate impact

22

BUILDING A RESILIENT ENTERPRISE

23

THE RESILIENT MINDSETEVERY CONTROLWILL FAIL
If the adversary has access to:• The internal corporate network• Any username and password• All documentation & specifications

What would you do differently?
24Prevention Controls

Threshold of Defender Success

Detection &Response Controls

THE CYBER DEFENSE THRESHOLD(For a Given Adversary Sophistication)

Time Required for Adversary toAchieve Objective

Time Required to Detectand Eradicate Intrusion
25

CHANGING THE ECONOMICS
Safe Zone(Negative Adversary ROI)

Level ofSophistication=Level of Adversary’s
Investment

Adversary Investment ($)

Value to Adversary of
Defended Asset ($)

Danger Zone
(Positive Adversary ROI)
Strength of Defenses (Prevention + Detection)
26

FINAL THOUGHTS,
QUESTIONS, AND DISCUSSIONSEAN T MALONE@SEANTMALONE(SLIDES AVAILABLE AT) WWW.SEANTMALONE.COM
27