View
58
Download
0
Category
Preview:
Citation preview
1
Advanced targeted attacksAndrey Dulkin, Andy Givens, Andy Thompson, Lauren Horaist, Nick Dulavitz
2
What makes an attack “advanced?
An advanced attack is…
a targeted attack against a specific organization, during which an attacker operates extensively inside the
network
Contrary to:
Opportunistic endpoint attacks
Opportunistic endpoint attacks
Quick, targeted attacks (ex: call centers)
3
BREACH• Phishing• USB• Unsecured servers
RECON• Network queries• Passive listening• Probing
LATERAL MOVEMENT• Look for credentials• Look for access
DOMAIN COMPROMISE• Sufficient privileges
ACTIONS ON TARGET• Access servers, apps etc.
Stages of an Advanced Attack
4
Breach▪ Email with malicious attachment
5
Domain Controller
File Server 1
Admin Workstation
Web Server 3
Help Desk Workstation
Recon▪ What privileges do I HAVE?
▪ WHO are the privileged users?
▪ WHERE are they connected?
▪ What privileges can I GET?
Nmap Maltego
COMMON TOOLS USED FOR RECON
6
Domain Controller
Web Server 3
Help Desk Workstation
Lateral Movement▪ Connect to the shared machine
▪ Search for credentials
▪ Steal privileged credentials
File Server 1
Admin Workstation
PsExecmimikatz
COMMON TOOLS USED FOR LATERAL MOVEMENT
*****
Domain Admin credentials found!
7
Domain Compromise▪ Connect to Domain Controller
▪ Steal krbtgt hash
▪ Create a Golden Ticket with required privileges
▪ Locate and access desired system: SWIFTNet Domain Controller
NEXT: Steal the krbtgt hashGenerate golden ticket for full domain access
!
SWIFTNet
8Recipient Bank
SWIFTNet
SWIFT User 1
SWIFT User 2
Actions on target
!
SWIFTNet Server
▪ Access the SWIFT server
▪ Locate pending transaction file
▪ Inject fraudulent transaction
9
Profit!
10
Recommendations
Endpoint Network Credentials Monitoring Remove local privileges Control applications Detect malicious
executions
Patch systems Segment off sensitive
assets Route access through
jump servers
Enforce credential tiers Require multi-factor
authentication Secure and manage
privileged credentials
Set alerts on malicious events
Monitor behavior to detect anomalies
Monitor privileged users
11
Recommended