TryHackMe - Exploitation (Cyber Kill Chain) | SOC Analyst 1

on


To gain access to the system, an attacker needs to exploit the vulnerability. In this phase, "Megatron" got a little bit creative - he created two phishing emails, one that contains a phishing link to a fake Office 365 login page and another one containing a macro attachment that would execute ransomware when the victim opens it. "Megatron" successfully delivered his exploits and got two victims to click on the malicious link and open the malicious file.

After gaining access to the system, the malicious actor could exploit software, system, or server-based vulnerabilities to escalate the privileges or move laterally through the network. According to CrowdStrike, lateral movement refers to the techniques that a malicious actor uses after gaining initial access to the victim's machine to move deeper into a network to obtain sensitive data. 

If you want to learn more about server-based or web-based vulnerabilities, please refer to the TryHackMe room OWASP Top 10.

The attacker might also apply a "Zero-day Exploit" in this stage. According to FireEye, "the zero-day exploit or a zero-day vulnerability is an unknown exploit in the wild that exposes a vulnerability in software or hardware and can create complicated problems well before anyone realizes something is wrong. A zero-day exploit leaves NO opportunity for detection at the beginning."

These are examples of how an attacker carries out exploitation:

  • The victim triggers the exploit by opening the email attachment or clicking on a malicious link.
  • Using a zero-day exploit.
  • Exploit software, hardware, or even human vulnerabilities. 
  • An attacker triggers the exploit for server-based vulnerabilities. 
Answer the question below
Can you provide the name for a cyberattack targeting a software vulnerability that is unknown to the antivirus or software vendors? Zero-Day

Comments

Post a Comment