English
Menu

Cyber Attacks and Defense in Practice

The Cyber Kill Chain presented by Lockheed Martin in 2011 divides the flow of a targeted attack into seven stages. Which of the following gives the stages in the correct order?

  1. ADelivery → reconnaissance → weaponization → exploitation → installation → C2 (remote control) → actions on objectives
  2. BReconnaissance → weaponization → delivery → exploitation → installation → C2 (remote control) → actions on objectives
  3. CReconnaissance → delivery → weaponization → installation → exploitation → actions on objectives → C2 (remote control)
Show answer and explanation

Answer: B. Reconnaissance → weaponization → delivery → exploitation → installation → C2 (remote control) → actions on objectives

The Cyber Kill Chain describes an attack in seven stages: reconnaissance (researching the target), weaponization (preparing, for example, a file carrying attack code), delivery (getting it to the target by an email attachment or a website), exploitation (exploiting a vulnerability to run code), installation (making the malware persist), C2 (establishing a channel to an external command server) and actions on objectives (stealing or destroying information). Defenders line up controls according to the stage at which they can break the chain, and the earlier it is broken, the smaller the damage. For example, stopping a suspicious attachment at the email stage ends the attack at delivery. However, it does not represent insider misconduct or long post-intrusion activity well, so it is used together with the more detailed MITRE ATT&CK.

  • A. Without preparing the attack code (weaponization), nothing can be delivered. Reconnaissance and weaponization come before delivery.
  • B. Correct. The order is preparation (reconnaissance, weaponization), intrusion (delivery, exploitation, installation), then post-intrusion (C2, actions on objectives).
  • C. The malware is made to persist (installation) after a vulnerability has been exploited to run code (exploitation). Also, actions on objectives is the last stage.
Practice this topic Back to topic

Books on Cyber Attacks and Defense in Practice Ad

As an Amazon Associate I earn from qualifying purchases.

More Cyber Attacks and Defense in Practice questions

  1. MITRE ATT&CK is a knowledge base that organizes the methods observed in real attacks into "tactics", which represent the attacker's goals, and "techniques", which represent the concrete methods for achieving those goals. Which of the following correctly pairs an observed action with the tactic it falls under?
  2. Which of the following is an "initial access" method, by which an attacker first gets into an organization's network?
  3. An examination of the records of traffic on an internal network found the following traffic. Which of them most strongly suggests that malware is communicating with an external command server (C2 server)?
  4. An attacker who exploited a vulnerability in a web application can now run commands with the same ordinary user privileges as the web server program. Which of the following is an example of the "privilege escalation" the attacker carries out next?
  5. Which of the following is the most appropriate control for making "lateral movement" difficult, that is, the spread of a compromise from one hijacked employee PC to other PCs and servers inside the company?

Comparisons in this topic