Guide for Conducting Risk Assessments
APPENDIX E

TABLE E-2: REPRESENTATIVE EXAMPLES - ADVERSARIAL THREAT EVENTS54
Threat Events
(Characterized by TTPs)
Description
Perform reconnaissance and gather information.
Perform perimeter network reconnaissance/scanning.
Adversary uses commercial or free software to scan organizational perimeters to
obtain a better understanding of the information technology infrastructure and
improve the ability to launch successful attacks.
Perform network sniffing of exposed networks.
Adversary with access to exposed wired or wireless data channels used to transmit
information, uses network sniffing to identify components, resources, and
protections.
Gather information using open source discovery of
organizational information.
Adversary mines publically accessible information to gather information about
organizational information systems, business processes, users or personnel, or
external relationships that the adversary can subsequently employ in support of an
attack.
Perform reconnaissance and surveillance of targeted
organizations.
Adversary uses various means (e.g., scanning, physical observation) over time to
examine and assess organizations and ascertain points of vulnerability.
Perform malware-directed internal reconnaissance.
Adversary uses malware installed inside the organizational perimeter to identify
targets of opportunity. Because the scanning, probing, or observation does not cross
the perimeter, it is not detected by externally placed intrusion detection systems.
Craft or create attack tools.
Craft phishing attacks.
Adversary counterfeits communications from a legitimate/trustworthy source to
acquire sensitive information such as usernames, passwords, or SSNs. Typical
attacks occur via email, instant messaging, or comparable means; commonly
directing users to websites that appear to be legitimate sites, while actually stealing
the entered information.
Craft spear phishing attacks.
Adversary employs phishing attacks targeted at high value targets (e.g., senior
leaders/executives).
Craft attacks specifically based on deployed information
technology environment.
Adversary develops attacks (e.g., crafts targeted malware) that take advantage of
adversary knowledge of the organizational information technology environment.
Create counterfeit/spoof website.
Adversary creates duplicates of legitimate websites; when users visit a counterfeit
site, the site can gather information or download malware.
Craft counterfeit certificates.
Adversary counterfeits or compromises a certificate authority, so that malware or
connections will appear legitimate.
Create and operate false front organizations to inject
malicious components into the supply chain.
Adversary creates false front organizations with the appearance of legitimate
suppliers in the critical life-cycle path that then inject corrupted/malicious information
system components into the organizational supply chain.
Deliver/insert/install malicious capabilities.
Deliver known malware to internal organizational
information systems (e.g., virus via email).
Adversary uses common delivery mechanisms (e.g., email) to install/insert known
malware (e. g., malware whose existence is known) into organizational information
systems.
Deliver modified malware to internal organizational
information systems.
Adversary uses more sophisticated delivery mechanisms than email (e.g., web
traffic, instant messaging, FTP) to deliver malware and possibly modifications of
known malware to gain access to internal organizational information systems.
Deliver targeted malware for control of internal systems
and exfiltration of data.
Adversary installs malware that is specifically designed to take control of internal
organizational information systems, identify sensitive information, exfiltrate the
information back to adversary, and conceal these actions.
Deliver malware by providing removable media.
Adversary places removable media (e.g., flash drives) containing malware in
locations external to organizational physical perimeters but where employees are
likely to find the media (e.g., facilities parking lots, exhibits at conferences attended
by employees) and use it on organizational information systems.
54 While not restricted to the APT as a threat source, the threat events in Table E-2 generally follow the flow of an APT
campaign. Within each stage in a campaign, similar events are listed in order of adversary capability.