# Classification and Analysis of Malicious Code Detection Techniques Based on the APT Attack
## 4 Attack Techniques Used by Malicious Code  
APT attack techniques can be categorized into those pertinent to the preliminary investigation step, penetration step, latency step, internal search step, and internal activity step. The following Table 2 lists the techniques that are used at each stage. The preliminary step involves preparing for penetration. Commonly, an attacker makes a manipulated web site and prepares it for penetration. To manipulate a web site, the attacker uses attack techniques that exploit SQL injection and Web vulnerabilities. SQL injection is a code injection attack technique that manipulates a database by causing a malicious SQL query to be executed. Some attackers have attempted to change the target's homepage screen [11; 12; 13; 26]. An example of an attack that exploits Web vulnerabilities is one wherein an environment is built in which malicious code is penetrated by vulnerable Web sites that are frequently visited by victims. When accessing the manipulated website, a malicious code is downloaded to the victim's system [13]. To achieve such an attack, malicious codes must be inserted into the prepared website; these codes include malware [11; 27], spyware [11; 26], and code that exploits zero-day vulnerabilities [10; 13; 26; 28]. In the latter, \begin{table}
\begin{tabular}{c c} \hline \hline
**Attack Step** & **Attack Techniques** \\ \hline \multirow{4}{*}{Preliminary investigation} & Preparation of manipulated websites \\  & SQL injection \\  & Web vulnerability \\  & Malware and Spyware \\  & Malware and Spyware \\  & Zero-day vulnerability \\ \hline \multirow{4}{*}{Penetration} & Mail (phishing, spam, spear phishing) \\  & DBD (Drive-By-Download) \\  & Watering hole \\  & Manual attack \\ \hline \multirow{2}{*}{Latency} & Mail (phishing, spam, spear phishing) \\  & DBD (Drive-By-Download) \\  & Watering hole \\ \hline \multirow{2}{*}{Internal search} & Backdoor \\  & Network monitoring and analysis \\  & System monitoring \\ \hline \multirow{4}{*}{Internal activity} & Keylogger \\  & IRC \\ \cline{1-1}  & Interception of password hash values of victim accounts \\ \cline{1-1}  & Eavesdropping on conversations recorded by microphone \\ \cline{1-1}  & Information exposure and leakage \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Attack techniques using malicious codes. the attacker attempts to exploit a zero-day vulnerability that has been discovered in systems, protocols, operating systems, and applications, but has not been addressed. It does not take much time to write new malicious code that utilizes zero-day vulnerabilities, so target systems often cannot defend against such an attack because the new malicious code cannot be detected by anti-virus systems that look for existing malware signatures. In fact, at the end of March 2014, Microsoft published a Security Advisory (MS Security Advisory 2953095) detailing vulnerabilities in RTF files in MS-WORD 2010, and also provided examples of RTF files that utilized this vulnerability and were attached to many spam emails [10; 13; 26; 28]. The penetration step is a practical step in which an attacker penetrates into the target system by downloading from a website or malicious code prepared in advance. Attackers may attempt to attack via email, such as in phishing, spam, spam, spear phishing, drive-by-download, watering hole, and manual attacks. Penetration by email is an attack technique that consists of inviting users to connect to a malicious server and executing a file when they click a malicious web site address or path, or when they click a malicious file attachment; this type of attack is mainly done through phishing or spam emails [11; 13; 26; 29; 30]. However, attackers have developed more reliable attack techniques since some phishing and spam emails can now be detected by filters. For example, spear phishing has emerged.