Incident Response for Windows

5

Gaining Access to the Network

Previously, in Chapter 2, we started the discussion of a unified kill chain for sophisticated attacks and its main phases:

• Phase 1 – Gaining an initial foothold
• Phase 2 – Maintaining enterprise-wide access and visibility
• Phase 3 – Impact

Now, it is time to dive deeper into each phase and stage described before.

In this chapter, we will cover the intricacies of the first stage, Phase 1 – gaining an initial foothold. This phase is very important because it lays the foundation for maneuvering and scaling up the threat’s presence in the target infrastructure. We will scrutinize the most popular techniques used by threat actors to gain initial access to the network, such as exploiting public-facing applications, ...