>> Hello and welcome to the third lesson
from the module, analysis and production.
In this lesson, we will discover together
another technique of analysis,
which is actually emerging or
mapping of Cyber Kill Chain and Diamond Model.
Let's define our objectives for this lesson.
We will start with the two models,
Cyber Kill Chain and Diamond Model,
and then we'll see the mapping of
Cyber Kill Chain and Diamond Model together,
and we will finish our lesson
>> with a practical use case,
>> we will see the example of a phishing case.
The concept of Cyber Kill Chain is attributed to
Lockheed Martin and their 2009 paper
entitled Intelligence-Driven
Computer Network Defense Informed
by Analysis of Adversary Campaigns
and Intrusion Kill Chains.
It's a defender-centric paper that
describes the steps an attacker must take
to successfully compromise their target
and extract the information thereafter.
The theory is that as defender,
all you need to do is distract one link in
the chain and the steps that
follow are no longer an issue.
Obviously, not all the steps
are apparent to the defender,
you may possibly be able to detect some of
the reconnaissance step if
the attacker is browsing your website, for example.
However, you are highly unlikely to
have any visibility of the weaponization stage.
How much visibility you have of what follows
will depend on how well you monitor your own network,
including the mail server and your endpoints.
The Cyber Kill Chain is a process composed of
seven steps that we will see briefly in this slide.
The first step is reconnaissance,
which means gathering data and
intelligence on target organization.
In this phase on particular,
hackers can take advantage of ascent,
which is something that we've seen
>> in a previous lesson.
>> The second phase is weaponization,
which means crafting malicious payload
using exploits for vulnerabilities.
The third step is delivery,
which means that payloads are sent to the target,
for example, using a phishing.
The fourth step is exploit,
which means exploiting a vulnerability to gain access.
Fifth step is installation,
which means installing a malware or
obtaining credentials and establishing vectors.
The sixth step is C2 or command and control,
which means navigate internal network
and set up a command and control.
The final step is actions on
objectives or actions on targets.
Here, ultimate goals are
achieved such as exfiltration of data.
The second model is Diamond Model.
The Diamond Model is one of the novel models for
cyber intrusion analysis where an adversary attacks
victim depending on two key motivations
rather than using a series of steps
>> like the Kill Chain.
>> The Diamond Model was published by
Center of Cyber Threat
Intelligence and Threat Research in 2013.
This model consists of
four basic elements that are adversary,
infrastructure, capability, and victim.
An adversary is an actor or a set of actors who
attack a victim after
analyzing their capability against the victim.
Initially, the adversary starts with
no knowledge of the capability of the victim.
After analyzing the capability of the victim,
the adversary may find that they have
more capability than the victim to attack them or not.
This model is important when dealing
with more advanced attackers such
as those whom have
already gained some control over the network.
The figure in the slide
illustrates that the adversary looks for
opportunity to attack a victim depending
on the capability or the infrastructure.
Now let's see the different elements or
diamonds constituting the Diamond Model.
The first one is adversary.
An adversary is an actor or
organization that is responsible
for using a capability
against the victim to achieve their intent.
The second one is capability.
The capability feature describes
the tool or techniques of
the adversary that are used to affect
the victim from
the most manual and sophisticated methods,
example, manual password guessing,
to the most sophisticated automated techniques.
The third element is infrastructure.
The infrastructure feature describes
the physical or logical communication structures
that the adversary
uses to deliver a capability
to maintain control of their capabilities,
example, C2 servers and effect results from the victim,
example, exfiltrate data.
The final one is victim.
A victim is a target of the adversary and against whom
the vulnerabilities and exposures
are exploited and capability used.
It can be people,
network system, or an organization.
The Diamond Model and Cyber Kill Chain analyses
are highly complimentary.
When there are dependent events composed of adversary,
infrastructure, capability,
and the victim, they can create what we call
activity threats across the kill chain.
These activity threats are also called merging of
Cyber Kill Chain and Diamond Model or
mapping of Cyber Kill Chain and Diamond Model.
These activity threats not only span
vertically along a single adversary victim pair,
but horizontally as adversaries
take advantage of knowledge and
access gained in one operation
to enable all operations.
The activity thread example that is
displayed on this slide illustrates
an adversary's operations
>> against two victims as well as
>> another unknown adversary's operation
against a third unrelated victim.
Furthermore, the dashed elements
illustrate the ability for analysts to integrate
hypothesis that can be further tested
or supported with additional evidence gathering.
This organization of knowledge is useful in many ways,
including the identification of
knowledge gaps and adversary campaigns,
as well as hypothesis generation and documentation.
Now, let's move to the practical use case.
The use case is around phishing scenario.
We took a real example of phishing email that
was analyzed by Cofense Phishing Defense Center.
But here we are supposing
>> that the target is called Bob.
>> He received a phishing email and clicked
on the link that redirects to Google Doc page,
which contain a fake error message
and another embedded link.
The link in the Doc file
downloads the malicious payload,
it's an exit file which has been
>> disguised as a PDF file.
>> Once the payload is executed,
it creates a copy of itself and a program
data where it undertakes
control over execution of a malware.
Furthermore, it creates another copy
in user's RAM and data roaming
speed LAN that also
includes the config file for a trig bot.
Additionally, if we open up the task scheduler,
we can see it also set a task that
starts the malicious file from speed LAN folder.
Looking at the trigger step,
we can see it has been set to repeat
itself every 11 minutes
for 414 days for this particular version of trig bot.
Now that we have an overview of the story,
we can create the activity threats
>> related to this case.
>> We can start with the first phase
which is reconnaissance,
and since we have no information
regarding this phase from the article,
we can leave it empty.
The second phase, which is weaponization,
we have an idea about
the infrastructure and
the capability because the adversary
used social engineering capability and
the infrastructure walls to create
the Google Doc and the file that was downloaded,
which is the payload,
and the victim here is Bob.
For the third step, which is delivery,
the adversary which is still unknown
uses the capability which is social engineering,
and for infrastructure, they used
the Google Doc legit email to send it to the victim,
which is Bob email address.
For the exploitation phase,
the capability is the malware itself,
the exit file, the infrastructure is unknown,
and the victim is Bob and his computer.
For the installation phase,
the adversary is still unknown,
the capability is the trick bot
Trojan and it was dropped from the previous payload.
For the infrastructure is still unknown,
and the victim is Bob and his computer.
For the two next steps,
we have no idea from the report,
but based on the nature of trick bot Trojan,
which is a banking Trojan,
we can assume that the actions on objectives will be
exfiltrating banking information from Bob's computer.
Briefly, in this lesson,
we've seen the Cyber Kill Chain and
the Diamond Model and then we combine
these two models to create
a new technique which is activity threats.
Finally, we finish this video with
a real example of an analysis using a phishing case.
In the end, I believe that we should not ask
is it better to use Cyber Kill Chain or Diamond Model?
But instead, we should ask are
we using them both effectively?
This is all for this lesson.
I hope you enjoyed this video.
In the next lesson,
we will cover another analysis technique and it
will be the Cyber Kill Chain
and Course of Actions Matrix.