Reconnaissance

In this initial stage, the adversary gathers information about a target organization, its internal systems, and potential security vulnerabilities.

Attackers will identify individuals with privileged access, such as system administrators and C-suite members.

Example scenario

An adversary identifies that an e-commerce company is utilizing a specific banking app, which is accessible through the company's SSO system. Authenticating into the SSO requires a password and push notification through the a mobile app. The adversary spots that the SSO authentication lacks phish-resistance.

With a plan to exploit this vulnerability for financial gain, the adversary begins collecting email addresses of key personnel - notably those in the finance department, the CFO, and IT members with administrative access to the SSO.

How do you break the kill chain at this step?

Collect website visitor logs to determine access from known malicious IPs and build detections for unique browsing behaviors designed to identity browsing behavior characteristics of reconnaissance. Prioritize defenses around particular technologies based on recon activity.

Check out how Beyond Identity can directly break the kill chain at the Reconnaissance step below.

Weaponization

At this stage, the adversary prepares the tools and payloads needed to exploit an identified vulnerability, typically using phishing tactics.

The adversary crafts convincing email and other messages designed to lure the victim into taking action, such as clicking on a malicious link or attachment.

Example scenario

Having identified the vulnerability in the SSO system, the adversary creates a fake SSO phishing page. This page will capture not only passwords, but also session cookies upon authentication.

The adversary also prepares a script that will alert and enable them to impersonate the victim as soon as the session cookie is captured, bypassing authentication.

How do you break the kill chain at this step?

While we are unable to detect weaponization as it occurs, we can make inferences by analyzing malware artifacts.

Detecting weaponizer artifacts (phishing kits, malware kits) often leads to the establishment of the most robust and enduring defense mechanisms.

Delivery

At this stage, the adversary launches their phishing operation. They begin dispersing crafted phishing emails and messages to the targeted individuals within the organization.

The emails and messages may appear to come from a trustworthy sources and typically contain a prompt to click on a malicious link or attachment.

Example scenario

With the targets identified, the adversary crafts and delivers the following phishing messages:

1. An email masquerading as a security alert, urging the target to "reset their compromised account password".
2. A text message, seemingly from the CEO, directed at the finance team to check if a recent purchase went through
3. An email offering a gift card redemption as part of an employee benefits scheme.

How do you break the kill chain at this step?

Email Security: Implement advanced email security solutions to filter out malicious attachments and links. Use email authentication mechanisms like SPF, DKIM, and DMARC to prevent email spoofing.

Endpoint Protection: Use endpoint security software to detect and block malicious payloads that may be delivered through email attachments or links.

Employee Training: Educate employees on the nature of phishing attacks and run simulated phishing exercises.

Exploitation

In this step, the victim interacts with the phishing content, typically by clicking on a malicious link. This leads them to a fraudulent site where they are prompted for their credentials.

Unsuspectingly, the victim inputs their credentials and authenticates. Although the login experience may look and feel legitimate, the adversary has successfully hijacked their session in the background.

Example scenario

A member of the IT team is lured by a phishing email, and enters their credentials on the fake SSO page.

The adversary is alerted and steals the session cookie from the phished authentication.

How do you break the kill chain at this step?

Implement multi-factor authentication solutions that are phish-resistant. This way, even if a user falls for a phishing attempt, the authentication will be deemed as malicious and access will be denied. Your authentication process should recognize and stop any unsafe access from occurring.
‍
Check out how Beyond Identity can directly break the kill chain at the Exploitation step below. Implement advanced email security solutions to filter out malicious attachments and links. Use email authentication mechanisms like SPF, DKIM, and DMARC to prevent email spoofing.

Installation

After the successful exploitation of a victim for their session cookie, the adversary uses the session cookie to assume the identity of the phished victim.

Example scenario

With the targets identified, the adversary crafts and delivers the following phishing messages:
Using the stolen session cookie from the phished authentication, the adversary injects the cookie into their browser, impersonating the IT admin was phished.

How do you break the kill chain at this step?

Command and Control

At this stage, the attacker establishes a link to a system under their control, typically referred to as a Command and Control (C2) server.

This connection allows the attacker to maintain persistence within the compromised environment, enabling ongoing control and coordination of malicious activity.

Example scenario

Operating under the guise of the compromised IT admin's session, the adversary has a plethora of options at their disposal.

They could directly execute their primary objective to transfer corporate funds illicitly. But also with the privileges of an IT administrator, they can disrupt access for legitimate users and plant backdoors for future access.

How do you break the kill chain at this step?

Actions on Objectives

t this stage, the adversary launches their phishing operation. They begin dispersing crafted phishing emails and messages to the targeted individuals within the organization.

The emails and messages may appear to come from a trustworthy sources and typically contain a prompt to click on a malicious link or attachment.

Example scenario

The adversary, given access to the financial application, initiates a large transfer to an offshore account.

With the primary objective achieved, the adversary can go back to the previous step (Command and Control) and perform additional malicious activity on the target organization.

How do you break the kill chain at this step?