Phase 1 – gaining an initial foothold

The first phase of our unified kill chain of sophisticated cyber attacks explains the adversaries’ actions at the beginning of the breach. All activities included in phase 1 are performed on the initially compromised asset, as shown in the following figure:

Figure 2.2 – Attack stages of phase 1

The steps within this phase are covered in detail in the following sections.

Gaining access to the network

Every attack starts with the initial compromise. Usually, if an incident is discovered at this stage, it means that either the attack was not well-planned, or the organization’s security posture was well prepared for such an intrusion. To cover all the phases, for now, we will consider that attackers achieve their goals at every stage and proceed with the next steps undetected.

During initial access, adversaries use various entry vectors to gain their initial foothold within a network...