Stage 1: Gain Access
The attacker gets remote access to the victim’s machine to create a base of operations for the attack. While most brute force attacks get access to computers through malicious emails or exploit kits, a substantial proportion of attacks begin much more simply – attackers just guess weak passwords. Strictly speaking, the usage of scripts and macros to achieve the first breach is not a fileless procedure. Scripts are frequently placed into archive files (.zip,.rar,.7z, etc.) or seemingly harmless files such as Microsoft Office documents or PDFs. There are additional script files, which can be readily disguised and difficult to identify.
Stage 2: Steal Credentials
The attacker attempts to get credentials for the environment that has been infiltrated, allowing the attacker to move quickly to other systems in that environment. Once a computer has been hacked, an attacker’s focus might turn to several traffic post-exploitation objectives, ranging from releasing malicious payloads to moving laterally around the network.
Windows saves credentials in various locations, including the LSASS process memory, the Security Accounts Manager (SAM) database and Credential Manager, and can even contain domain users’ and administrators’ credentials who have signed onto the system. As a result, attackers and penetration testers have naturally created tools and methods to exploit this.
Stage 3: Maintain Persistence
The attacker creates a backdoor that will allow a return to this environment at any time without having to repeat the attack’s initial stages.
Stage 4: Exfiltrate Data
This is the final stage in which the attacker must collect the data desired and prepare for the exfiltration. The attacker must also copy one place before using the compact technique. Finally, the attacker must remove the data from the victim’s environment by uploading the data through FTP.