Summary

Once advanced threat actors gain access to the victim infrastructure, they perform a series of actions that allow them to gain a foothold in a system, escalate their privileges, evade defenses, and access credentials if necessary. These actions are essential to further develop an attack, increase their presence in the target infrastructure, and achieve the threat actors’ final goals.

Despite their different purposes, the techniques used by threat actors to gain a foothold and escalate privileges are often the same or very similar. This fact allows us to focus not on finding traces of each technique but, rather, on analyzing the main sources, such as event logs, registries, filesystem metafiles, and system files. Analyzing these sources is also useful for detecting defense evasion.

Identification of the techniques used to investigate credential access techniques, as well as methods of communication with control servers, usually occurs in parallel with the analysis...