Establishing a Foothold
According to the unified kill chain of sophisticated cyberattacks, the next step after gaining access to a network is establishing a foothold. During this stage, threat actors attempt to find a way to maintain access to a victim’s infrastructure. Often, such actions are accompanied by privilege escalation, credential access, and defense evasion, all while communicating with a command-and-control (C2) server in the background.
From an analysis point of view, the aforementioned actions have many overlaps, and we can utilize similar data sources and investigative approaches to uncover the traces left by threat actors.
As before, in this chapter, we will focus on specific artifacts and the opportunities they provide. We will delve into analyzing the Windows registry, event logs, and various system files needed to reconstruct the threat actors’ chain of activities.
In this chapter, we will discuss the following:
- Methods of post-exploitation...
