Technical Aspects of Cyber Kill Chain

Abstract

Abstract-Recent trends in targeted cyber-attacks has increased the interest of research in the field of cyber security. Such attacks have massive disruptive effects on organizations, enterprises and governments. Cyber kill chain is a model to describe cyber-attacks so as to develop incident response and analysis capabilities. Cyber kill chain in simple terms is an attack chain, the path that an intruder takes to penetrate information systems over time to execute an attack on the target. This paper broadly categories the methodologies, techniques and tools involved in cyber-attacks. This paper intends to help a cyber security researcher to realize the options available to an attacker at every stage of a cyber-attack.

Unicorn: Runtime Provenance-Based Detector for Advanced Persistent Threats

“…We assume APT scenarios for host intrusion detection: an attacker illegitimately gains access to a system and plans to remain there for an extended period of time without being detected. The attacker may conduct the attack in several phases and use a variety of techniques during each phase [131]. The goal of UNICORN is to detect such attacks at any stage by interpreting the provenance generated by the host.…”

“…To simulate APT attacks, we follow the typical cyber kill chain model that consists of roughly 7 nonexclusive phases, i.e., reconnaissance (identify a target and explore its vulnerabilities), weaponize (design a backdoor and a penetration plan), delivery (deliver the weapon), exploitation (victim triggers the vulnerability), installation (install the backdoor or malware), command and control (C&C) (give remote instructions to the victim), and actions on objectives [131].…”

A cyber kill chain based taxonomy of banking Trojans for evolutionary computational intelligence

“…After delivery of the malware, intruders' code should be triggered on the target machine by running the malicious application or exploiting a system vulnerability [20], [23], [31]. A successful exploitation may lead to exfiltration of private information, injection of code into web applications, log keystrokes, steal passwords, steal cookies or download other modules that may perform intended malicious activities.…”

“…This is a mechanism by which a malware registers to its Command and Control (C&C) server [20], [23], [31], [36], [81]. Malware are registering on a C&C domain to receive commands or upload exfiltrated data.…”

“…Cyber Kill Chain (CKC) is one of the most widely used operational threat intelligence models to explain intrusion campaigns activities [23], [31]. CKC is based on the kill chain tactic of the US military's F2T2EA (find, fix, track, target, engage and assess) [20], and contains seven stages/steps as shown on Figure 1 [20], [23], [31]- [34]. Reconnaissance includes the identification, selection and profiling of potential targets.…”