Cyber Defense eMagazine May 2019

Uncovering a Compromised Insider
Imagine this scenario: An attacker wants to steal the source code for a new product from the leader in
the market. They’re going to compromise the machine of an engineer inside the company’s network and
use that as a jumping off point to search the network and find code repositories with product software.
Thanks to a new framework from MITRE called ATT&CK, we can realistically detail the techniques an
attacker might use to pull it off.
First, the attacker sets up a watering hole attack, knowing that an engineer at the target organization is
likely to visit the website of an upcoming user conference. Once the engineer visits the website (Driveby
Compromise), the malicious code on the webpage is triggered and executed by the browser of the
engineer’s machine. At this point, the attacker achieves code execution (User Execution) to gain a
foothold on the targeted machine.
After this initial execution, the attacker then covers their tracks by deleting a portion of the malware on
the system (File Deletion), in an attempt to avoid detection.
Now that the attacker controls the machine, they locate an SMB share that may contain the desired data
(Discovery). As it turns out, the desired data requires privileged credentials, so the attacker escalates
privileges to gain access to a user account with administrator credentials (Lateral Movement). Now the
attacker can access the file share and copy over the sensitive data.
Next, the attacker will steal a token from a login script that was run with a privileged domain account
(Privilege Escalation), gaining access to a server in the DMZ and the ability to move data out of the
network. Now the data can be copied to the server and compressed in preparation for transfer over the
internet. The attacker then connects from the server in the DMZ to an attacker-controlled web server.
And just like that, they’ve stolen your new product source code.
In this scenario, many of these tactics and techniques would have at some point set off alarms in most
SOCs. But while the alerts may get investigated, too often the response by lower-tier analysts ends up
incomplete, and the attacker has already gained deeper access into the organization’s network and
systems. By the time an attacker reaches Lateral Movement, the trail often goes dark for SOC personnel,
since it is very difficult to distinguish between activity driven by the real user of an account and an attacker
using that account. And it is also this stage that the sensitive theft is taking place.
To ensure optimal protection, security teams must change their mindset to start looking at entire attack
sequences instead of individual steps. SOC teams need to be able to compare a user’s behavior to their
normal patterns in order to understand if compromised credentials are being used by an attacker.
48