Gaining Access to the Network

Introduction

The first phase of the Unified Kill Chain model is Gaining an Initial Foothold. The first stage within this phase is the Gaining Access to the Network. This stage focuses on how the adversaries infiltrate a target environment to establish unauthorised access. This phase is critical, as it lays the foundation for subsequent stages of an attack, such as lateral movement and data exfiltration. Understanding the tactics and techniques attackers use during this phase is essential for effective threat detection, investigation, and response. The following techniques are commonly employed by attackers to achieve initial access in, for example, a Windows environment:

• Exploiting Public-Facing Applications: Attackers often target vulnerabilities in web applications or services exposed to the internet, such as web servers or APIs, to inject malicious code or gain unauthorised access.

• Phishing: Malicious emails designed to trick users into clicking on links or opening attachments containing malware remain one of the most prevalent methods for gaining initial access.

• External Remote Services: Attackers exploit poorly secured remote access protocols like RDP, VPNs, or SSH to gain a foothold, often using brute force or stolen credentials.

• Valid Accounts: Using compromised or stolen credentials, attackers log in as legitimate users to bypass basic security measures.

• Drive-by Compromise: By hosting malicious code on compromised or rogue websites, attackers trick users into downloading malware during regular browsing.

• Supply Chain Compromise: Adversaries infiltrate third-party vendors or software providers to distribute malware through legitimate software updates or packages.

• Trusted Relationships: Exploiting relationships with trusted third-party vendors or partners to gain access to internal systems.

• Replication Through Removable Media: The use of infected USB drives or other removable media to deliver malicious payloads when connected to the target system.

By applying the Unified Kill Chain model, investigators can systematically analyse the techniques used during this phase, identify relevant indicators of compromise (IOCs), and map the attacker’s behaviour to defensive strategies. This structured approach enhances detection and response efforts, enabling defenders to disrupt adversaries early in the attack lifecycle.

The following are basic KQL, Velociraptor, and Splunk queries used to investigate these techniques.

KQL (Microsoft Sentinel), Velociraptor VQL, and Splunk SPL to investigate each of the techniques in Phase 1 – Gaining an Initial Foothold, along with descriptions of what each query does and multiple query examples for each technique.

1. Exploiting Public-Facing Applications

Attackers often exploit vulnerabilities in public-facing applications, such as web servers or APIs, to gain unauthorised access.

KQL Queries

1. dentify SQL Injection Attempts

Identify SQL Injection Attempts

Description: Searches for potential SQL injection patterns in application logs, such as "select *" or explicit "sql injection" alerts.

AzureDiagnostics
| where Message contains "sql injection" or Message contains "select *"
| summarize count() by Message, ClientIP, TimeGenerated

2. Detect Unusual POST Requests

3. Monitor Error Messages Suggesting Vulnerabilities

Velociraptor VQL

1. Search for Command Execution in Logs

SELECT * FROM Audit.WindowsEventLogs
WHERE EventID = 4688 AND EventData.CommandLine =~ "cmd.exe /c"

Description: Identifies suspicious command-line executions that attackers might trigger through exploited applications.

2. Detect Web Shell Creation

3. Identify Abnormal HTTP Traffic

Splunk SPL

1. SQL Injection Detection

index=web_logs sourcetype=access_combined
| search uri_query="*union*" OR uri_query="*select*" 
| stats count by clientip, uri_query

Description: Searches for SQL injection attempts by filtering for SQL keywords in URL queries.

2. POST Requests with Large Payloads

3. Frequent 404 Errors

---

2. Phishing

Attackers deliver malicious payloads or steal credentials through phishing emails.

KQL Queries

1. Identify Emails from Suspicious Domains

Identify Emails from Suspicious Domains

EmailEvents
| where SenderDomain endswith ".ru" or SenderDomain endswith ".cn"
| summarize count() by Sender, Subject, ReceivedTime

Description: Searches for emails from unusual or high-risk domains.

2. Monitor for Malicious Attachments

3. Flag Emails with Suspicious Subjects

Velociraptor VQL

1. Search for Suspicious Office Documents

Search for Suspicious Office Documents

SELECT * FROM FileSystem
WHERE filename =~ ".*\\.docm$"

Description: Finds recently created Office documents with macros enabled.

2. Identify PowerShell Commands

3. Monitor New Executables in Downloads Folder

Splunk SPL

1. Email Attachment Analysis

Email Attachment Analysis

index=email sourcetype=mail_logs
| search attachment="*.exe" OR attachment="*.docm"
| stats count by sender, attachment

Description: Identifies suspicious attachments in emails.

2. High Volume Emails from Single Sender

3. Keywords in Email Subject

---

3. External Remote Services

Attackers exploit remote access services like RDP, VPNs, or SSH to gain a foothold.

KQL Queries

1. Detect RDP Authentication Failures

Detect RDP Authentication Failures

SecurityEvent
| where EventID == 4625 and LogonType == 10
| summarize count() by Account, IPAddress, TimeGenerated

Description: Flags failed RDP login attempts (LogonType 10).

2. VPN Logon from Unusual Locations

3. Repeated Brute-Force Attempts

Velociraptor VQL

1. Search for Failed Logins

Search for Failed Logins

SELECT * FROM Audit.WindowsEventLogs
WHERE EventID = 4625 AND EventData.LogonType = "10"

Description: Finds failed login attempts for RDP sessions.

2. Monitor Remote Services

3. Monitor for VPN Software Execution

Splunk SPL

1. Failed RDP Logins

Failed RDP Logins

index=authentication sourcetype=windows:security
| search EventCode=4625 LogonType=10
| stats count by AccountName, src_ip

Description: Flags failed RDP login attempts.

2. VPN Logins from New Locations

3. Repeated Login Failures

---

The included descriptions and multiple queries for each technique should aid the investigations using KQL, Velociraptor, and Splunk, ultimately enhancing the detection and response capabilities in a Windows environment.