Ayo Secu

ImpactIn the impact phase of an attack, the attacker executes actions that disrupt, degrade, or manipulate systems and data, often to achieve specific goals such as financial gain, reputational harm, or operational disruption. The impact phase includes techniques like deleting accounts or data, encrypting files (e.g., ransomware), defacing websites, and causing denial of service (DoS) or forced ..

Command and Control (C2)In the command and control (C2) phase, attackers establish and maintain communication with compromised systems to issue commands, retrieve data, and manage ongoing operations. C2 channels vary widely in sophistication, from simple web-based communications to advanced steganography and encrypted messaging. Here are common C2 techniques, including web service-based C2, remo..

ExfiltrationIn the exfiltration phase, attackers move the data they’ve collected out of the compromised environment to their own infrastructure, allowing them to access and leverage the information externally. Exfiltration techniques vary depending on the attacker’s goals, network controls, and the data’s sensitivity. Common methods include using removable media, command-and-control (C2) channel..

CollectionIn the collection phase, attackers gather data of interest from within the compromised environment. This phase is focused on harvesting valuable information such as databases, credentials, sensitive files, and communications. Common methods of collection include database dumps, capturing audio, video, or screen activity, and accessing internal documentation, network shared drives, and ..

Lateral MovementIn the lateral movement phase, attackers leverage their initial foothold to move within the network, accessing additional systems and resources. This phase enables them to spread throughout the environment, often with the goal of reaching high-value assets, escalating privileges, or maintaining persistent access. Common lateral movement techniques include remote access protocols ..

DiscoveryIn the discovery phase of an attack, attackers gather information about the compromised environment to understand its layout, identify high-value assets, and locate other systems they may wish to target. Discovery is essential for planning lateral movement and for gaining the context needed to elevate privileges or execute further attacks. Common discovery tactics include network scanni..

Credential AccessIn the credential access phase of an attack, attackers attempt to steal or obtain credentials (such as usernames, passwords, tokens, and other authentication secrets) that provide access to systems, services, and sensitive information. Access to credentials enables attackers to move laterally within a network, escalate privileges, and maintain persistence. Here’s a breakdown of ..

Defense EvasionIn the defense evasion phase, attackers use techniques to avoid detection, hide their presence, and maintain control over a compromised system. These tactics allow them to bypass security mechanisms, avoid forensic analysis, and prolong their access within the target environment. Key methods of defense evasion include disabling detection software, reverting VM/cloud instances, and..

Privilege EscalationIn the privilege escalation phase, attackers elevate their permissions within a compromised system, gaining higher-level access that allows them to control more resources and execute more damaging actions. Privilege escalation (often shortened to PrivEsc) is essential for attackers to bypass access restrictions, reach sensitive data, or maintain control over a network. Some p..

PersistenceIn the persistence phase of an attack, attackers establish methods to maintain access to a compromised system, even after reboots, log-offs, or security measures. Persistence techniques ensure that attackers can resume control without needing to re-exploit vulnerabilities, helping them stay in the system for extended periods. Here are some common persistence methods, including creatin..