Hello and welcome to another
application of the minor attack
framework discussion today
we are going to be looking at
what is initial access,
which is that top area of the
framework where we're talking
about the particular
area in which the attackers focus
in, in this case, trying to gain
initial access.
And so what are our objectives
of this particular discussion?
Well, we're going to
define what initial
access is and then
we are going to look
at and define some
attack types and examples
of those attack types.
So with that, let's go ahead
and jump right in to our definition.
So initial access
consists of techniques
that an adversary would use
to get into your network, plain and
simple. And this can be anything
from spearfishing to
the exploitation of public facing
Web servers or services.
And so what we're trying to do is
have that initial access granted
to the system.
And at that point, the attacker will
start to get a lay of the land
and figure out what their next steps
are. There are also some tools out
there that will go through multiple
phases at a time all the way to
potentially impacting the system
and encrypting the system.
Now, some of the techniques
that are defined by the minor attack
framework are as follows.
Drive by compromise like on a site
or something of that nature.
Public facing application
exploitation, extend or
remote service exploitation, valid
account use, trusted relationship
supply chain compromise.
We're going to go over a few
of these in our particular
review.
And we'll go over some of the
mitigation and detection
techniques that can be used as well.
So let's touch on some
examples real quick.
So supply chain compromised.
So in this particular instance,
we'll use the example of cleaner.
So I don't know if you remember,
but CCE Cleaner was compromised
by hackers for over a month
and the tool was impacted by
malware that gave the attackers a
back door to user systems.
There were over two point two seven
million downloads of this
particular tool
at the time that it was compromised.
And so another example of supply
chain compromised would be mobile
games.
Some examples of this were games
such as Infestation and
point blank were identified by
Perski and ESET as having
backdoor versions of the games being
distributed.
And so essentially, when you think
about supply chain compromised,
which will go into more detail, it's
a trusted application,
a trusted platform
that is impacted
in a way that an attacker infects
a legitimate update or
a legitimate application
and then has some
type of back door or malicious
intent that can be enacted through
what people believe to be a trusted
resource,
another type of attack.
And I'm sure you're very familiar
with our spear fishing
attachments. And so we're not
really going to dove into that too
deeply. But, you know, the examples
given are essentially you get an
email, it's got an attachment
that looks legitimate.
You interact with that attachment
and voila, initial
access is gained and granted
to the attacker.
And a lot of times with these types
of attachments, you may run them and
they may also take you to third
party sites that ask for
credentials, which could then
lead to a valid account being
provided.
So let's do a quick check on
learning for this particular
discussion.
True or false?
Initial access is when a user
in the organization first logs into
a system to start their work day.
All right, well, if you need some
additional time to think this over,
please pause the video
and take it.
So when we're talking about initial
access, we're not talking about the
context of a user
logging into a system to start their
workday. We're talking about threat
actors gaining access to the system
initially.
So this particular statement is
false.
So with that, let's go ahead and
jump over to our summary.
So in summary of today's
discussion, we defined initial
access is being when a threat
actor initially gets on a system
or gained access to a system,
and then we define some attack types
and examples.
Again, we'll reiterate some of these
areas focusing on mitigation and
detection techniques, as well
as some of the threat actors that
have been noted as taking advantage
of some of these initial access
factors.
So with that in mind, I want to
thank you for your time today, and
I look forward to seeing you again
soon.