You're reading from Incident Response for Windows Adapt effective strategies for managing sophisticated cyberattacks targeting Windows systems

Product type Paperback

Published in Aug 2024

Publisher Packt

ISBN-13 9781804619322

Length 244 pages

Edition 1st Edition

Concepts

Cybersecurity

Authors (2):

Anatoly Tykushin

Svetlana Ostrovskaya

View More author details

Table of Contents (20) Chapters

Preface

1. Part 1: Understanding the Threat Landscape and Attack Life Cycle

2. Chapter 1: Introduction to the Threat Landscape FREE CHAPTER

3. Chapter 2: Understanding the Attack Life Cycle

4. Part 2: Incident Response Procedures and Endpoint Forensic Evidence Collection

5. Chapter 3: Phases of an Efficient Incident Response on Windows Infrastructure

6. Chapter 4: Endpoint Forensic Evidence Collection

7. Part 3: Incident Analysis and Threat Hunting on Windows Systems

8. Chapter 5: Gaining Access to the Network

9. Chapter 6: Establishing a Foothold

10. Chapter 7: Network and Key Assets Discovery

11. Chapter 8: Network Propagation

12. Chapter 9: Data Collection and Exfiltration

13. Chapter 10: Impact

14. Chapter 11: Threat Hunting and Analysis of TTPs

15. Part 4: Incident Investigation Management and Reporting

16. Chapter 12: Incident Containment, Eradication, and Recovery

17. Chapter 13: Incident Investigation Closure and Reporting

18. Index

Why subscribe?

19. Other Books You May Enjoy

Methods of post-exploitation

Post-exploitation is a crucial step in the attack process. It occurs when an adversary has successfully gained access to the target system and wishes to maintain access, escalate privileges, or gather necessary information. This involves performing actions to bypass detection and maintain persistence, enabling threat actors to continue their activities on the system and the victim’s infrastructure.

There are various techniques that can be applied by threat actors to reach their goals at this stage. Boot or Logon Autostart Execution (T1547) and Initialization Scripts (T1037), Event Triggered Execution (T1546), Scheduled Task/Job (T1053), or Valid Accounts (T1078) might be used to get persistence or escalate privileges. In many cases, in the initial stages of attack, such actions can be performed automatically. Abuse Elevation Control Mechanism (T1548), Domain or Tenant Policy Modification (T1484), Hijack Execution Flow (T1574), and Process Injection...