The Cyber Kill Chain framework is part of an intelligence‑driven
defense model for the identification and prevention of cyberattack
activity. Originally developed by Lockheed Martin, the model
describes the anatomy of a cyberattack,
identifying activities an adversary must complete in
order to achieve their objective.
But perhaps more importantly,
it also identifies the opportunities the defender has to detect and
defeat an adversary. In 2015, Mike Assante and Robert M.
Lee,
both of the SANS Institute, extended the classic Lockheed Martin model
to account for the additional steps an adversary would need to take
when targeting industrial control systems.
Let's look at the classic version of the kill chain first
before moving on to the ICS extension.
If you're going to rob a bank,
the first thing you do would be to scope the joint out, and
the same applies to planning a cyberattack.
During this initial information‑gathering mission,
an adversary is seeking any information that might support the attack,
such as vulnerabilities and weak points into the system.
They could use automated scanners to find weak points and vulnerabilities,
or they may investigate the target's security systems, like intrusion
detection, authentication mechanisms, and firewalls.
During the weaponization stage,
the adversary uses the information they've collected about their
target and devises an exploit that takes advantage of the weaknesses
and vulnerabilities they've discovered.
For example,
they could create malware that targets vulnerabilities discovered during the
recon phase. At this stage, everything is still in the attacker's
environment; the target hasn't been exploited or actively attacked. To
commence the intrusion element of the campaign, the adversary tries to gain
access through the victim's security perimeter by delivering the exploit
created during the weaponization stage.
This usually involves somehow injecting malware into the
target systems to gain control of them.
The malware can be delivered by a number of routes,
such as phishing emails,
supply chain compromise, or by targeting external or remote
services. During the exploitation phase,
the adversary will identify new internal vulnerabilities and
opportunities to advance the attack that couldn't be
determined by external reconnaissance.
For example,
they may identify an opportunity to gain privileged access to a
backend database which wasn't accessible externally.
At this stage,
an adversary may start to bring in their own tools to advance the attack, or
may seek to use tools and features of the system they find themselves in. The
objective in this phase is to elevate privileges to gain further and deeper
access to systems and to move laterally,
gaining more and more access to the network and its assets.
Adversary techniques in this stage range from a very noisy,
brute‑force approach to stealthier approaches of seeking out
unprotected repositories of security credentials or monitoring
encrypted network flows to obtain credentials.
Having gained those new credentials,
the adversary moves on to accessing other systems to
find even more vulnerable assets.
Now the adversary has a good foothold in the target's
environment, it's time to dig in for the long haul.
There's a good chance they could be discovered at any time, and it may
have taken weeks or even months to get to this stage.
An adversary will typically establish a command and control,
or C2 network, which often comprises a number of layers.
They don't want to rely on a single point of entry,
in case it's discovered or somehow closed down and doing
all the good work they've done so far.
They will therefore seek to establish multiple channels for different purposes.
Some may be used for exfiltrating data or bringing
new tools into the environment.
These can be noisy and easily detected, so another tier is built, which can
give access to rebuild those channels that are discovered and taken down.
Every cyberattack has at least one objective,
whether it's to exfiltrate or delete data,
hold an organization to ransom, disrupt operations, or create some other effect.
All of the activities that have been undertaken by the
adversary to this point have been done to cause this effect.
To get to this stage can take weeks, months, or even years,
but eventually all of these activities come together to cause an
impact on the target to achieve the objective.
In October 2015, Mike Assante and Robert M.
Lee published their seminal white paper on the
industrial control system's cyber kill chain.
They recognized that attacks against industrial control systems require
adversaries to become intimately familiar with the process being automated
and the design of the system. Gaining this knowledge enables the adversary
to understand the systems well enough to cause predictable effects on
systems in a way that circumvents or impacts safety mechanisms and achieves
real‑world physical effects.
Assante's and Lee's model extends the classic Lockheed Martin
framework, which is described as stage 1, with a number of
additional steps, which comprise stage 2.
During attack development and tuning, an adversary develops a new
capability tailored to affect a specific OT environment to achieve the end
objective. Development and tuning is usually undertaken offline and will
rely on data exfiltrated during stage 1.
This can create a significant lag between stage 1 and stage 2. During
validation, an adversary tests their capability on similar or
identically configured systems. Development, tuning, and testing are
difficult to detect and defend against.
The next 3 steps comprise the ICS attack phase of stage 2,
where the adversary will deliver the capability,
install it or modify existing system functionality, and then execute the attack.
But this is a two‑dimensional problem because the attack can
have many preparatory and concurrent attacks that fall into
the categories of enabling,
initiating, or supporting to achieve the attack objective.
For example,
it may be necessary to trigger the conditions needed to
manipulate a specific element of the process,
initiate changes in parameter set points, or to support the attack
over time by spoofing the plant status to trick operators into taking
an action they shouldn't, or vice versa.