Cyberstudy
PDF p.346 In progress

Network Attacks

Open PDF at p.346 13 flashcards

Summary

PDF p.346

Network attacks involve various strategies and techniques used by threat actors to disrupt or gain access to systems via network vectors. These attacks are analyzed within the context of the cyberattack lifecycle.

Detailed explanation

PDF p.346
  • Reconnaissance
    • Host Discovery: Identifies active IP addresses.
    • Service Discovery: Identifies open TCP/UDP ports.
    • Fingerprinting: Identifies application types, versions, OS, and device types.
    • Detection: Rapid scanning generates detectable network traffic.
  • Credential Harvesting
    • Definition: Attempts to learn passwords or cryptographic secrets.
    • Purpose: To gain authenticated access to network systems.
  • Denial of Service (DoS)
    • Definition: Causes hosts and services to become unavailable.
    • Detection: Monitoring tools report non-responsive hosts or high request volumes.
    • Purpose: Can be an end goal or facilitate other attacks.
  • Weaponization, Delivery, and Breach
    • Definition: Techniques to gain access without authentication.
    • Methods: Malicious code directed at vulnerable hosts or tricking users into running code.
  • Command and Control (C2), Beaconing, and Persistence
    • Definition: Techniques to operate and maintain access to compromised hosts.
    • Detection: Identifying anomalous connection endpoints and unauthorized startup items.
  • Lateral Movement, Pivoting, and Privilege Escalation
    • Definition: Techniques to move within a network and gain higher permissions.
    • Detection: Anomalous account logins and privilege use, often detected by machine learning.
  • Data Exfiltration
    • Definition: Copying information assets to the attacker's remote machine.
    • Detection: Anomalous large data transfers or small, stealthy data movements.

Important terms

taken from the text above
Host Discovery
Identifies active IP addresses.
Service Discovery
Identifies open TCP/UDP ports.
Fingerprinting
Identifies application types, versions, OS, and device types.
Credential Harvesting
Attempts to learn passwords or cryptographic secrets.
Denial of Service (DoS)
Causes hosts and services to become unavailable.
Weaponization, Delivery, and Breach
Techniques to gain access without authentication.
Command and Control (C2), Beaconing, and Persistence
Techniques to operate and maintain access to compromised hosts.
Lateral Movement, Pivoting, and Privilege Escalation
Techniques to move within a network and gain higher permissions.
Data Exfiltration
Copying information assets to the attacker's remote machine.
DoS Denial of Service

What I should remember

Key Points PDF p.346
  • Reconnaissance
    • Host Discovery: Active IP addresses.
    • Service Discovery: Open ports.
    • Fingerprinting: Application and OS identification.
  • Credential Harvesting
    • Purpose: Gain authenticated access.
  • Denial of Service (DoS)
    • Purpose: Unavailability of hosts/services.
    • Detection: Non-responsive hosts, high request volumes.
  • Weaponization, Delivery, and Breach
    • Methods: Malicious code, user trickery.
  • Command and Control (C2), Beaconing, and Persistence
    • Detection: Anomalous connections, unauthorized startups.
  • Lateral Movement, Pivoting, and Privilege Escalation
    • Detection: Anomalous logins, privilege use.
  • Data Exfiltration
    • Detection: Large or stealthy data transfers.