Summary

In this chapter, we discussed the various techniques used by threat actors to gain access to the network and how to find their traces on zero patients.

The most common initial access techniques are exploiting public-facing applications, using external remote services, exploiting people through spear phishing, and drive-by compromise. Despite the differences in the execution of these techniques, we can use similar sources to detect them during investigation. So, analyzing event logs can help us detect the use of remote services as well as trusted relationships, a particular case of which would be the use of remote services to access adjacent infrastructure. Analysis of browsers and their extensions can be used to find traces of targeted phishing and drive-by compromise, as can analysis of active processes and network connections, which can also be an aid in detecting exploited public-facing applications. At the same time, investigating filesystem changes using $MFT analysis...