Incident Response for Windows

2

Understanding the Attack Life Cycle

In this chapter, we will take a look at the typical phases of a targeted cyber attack against Windows systems. We’ll cover the various stages involved in such an attack, such as initial access, network propagation, foothold establishment, data exfiltration, and impact. We’ll also discuss different tactics and techniques that are used by threat actors at each stage of the attack, including automated and human-operated activities. This chapter focuses on the attack life cycle from the threat actor’s perspective to facilitate the best defense approach when responding to sophisticated intrusions.

Upon having a deep understanding of the threat actor’s capabilities, motives, and objectives, cybersecurity teams ...