Network Attacks

---

Network attack is an attack directed against cabled and/or wireless network infrastructure.

• informed by the place of the attack in the cyberattack lifecycle:
  • reconnaissance
  • credential harvesting
    • type of recon where threat actor get credentials to network systems
  • Denial of service (DoS)
  • Weaponization, delivery, and breach
    • refer to techniques that allow a threat actor to get access without having to authenticate
    • involves:
      • malicious code being directed at a vulnerable application host or service over the network
      • or sending code concealed in file attachments, and tricking a user into running it
  • Command and control (C&C, C2), beaconing, and persistence
    • refer to techniques and malicious code that allow a threat actor to operate a compromised host remotely, and maintain access to it over a period of time
    • has to disguise the incoming command and outgoing beaconing activity as part of the network’s regular traffic
      • by using encrypted HTTPS
  • Lateral movement, pivoting, and privilege escalation
    • refer to techniques that allow the threat actor to move from host to host within a network or from one network segment to another, and to obtain wider and higher permissions for systems and services across the network
    • detected via anomalous account logins and privilege use
  • Data exfiltration
    • refers to obtaining an information asset and copying it to the attacker’s remote machine