Tutorial 4.2: Intrusions, Attack Methodologies, and Threat Landscapes

🎯 Learning Objectives

After completing this tutorial, you should be able to:

• Define intrusion and distinguish between various types of attacks and threat actors.
• Characterize the motivations, capabilities, and common tactics of external attackers, insiders, and APT groups.
• Explain the attack lifecycle from reconnaissance to exfiltration using the Cyber Kill Chain model.
• Analyze the MITRE ATT&CK framework and its utility for understanding adversarial behavior.
• Describe specific phases such as privilege escalation, lateral movement, persistence, and data exfiltration.
• Compare and contrast different threat actor types and their typical attack patterns.
• Evaluate the role of threat intelligence in anticipating and defending against attacks.
• Apply the Kill Chain and MITRE ATT&CK concepts to real-world breach scenarios.

---

📖 Overview

In Tutorial 4.1, we established the foundations of security monitoring and defensive systems. We now turn our attention to the threats that these systems are designed to detect and mitigate. A deep understanding of intrusions, attack methodologies, and the threat landscape is essential for any security professional. Without knowing how attackers operate, we cannot effectively design, tune, or operate our defenses.

This tutorial provides a comprehensive survey of the modern threat environment. We begin by defining what constitutes an intrusion and distinguish between different categories of threat actors — from external cybercriminals and state-sponsored groups to disgruntled insiders. We then explore the most sophisticated form of threat, the Advanced Persistent Threat (APT), and examine its lifecycle.

The core of the tutorial is dedicated to the attack lifecycle, using two of the most widely adopted models in the industry: the Cyber Kill Chain (originally developed by Lockheed Martin) and the MITRE ATT&CK framework. We will dissect each phase of an attack — from reconnaissance and weaponization to privilege escalation, lateral movement, persistence, and data exfiltration — providing detailed technical explanations and real-world examples.

By the end of this tutorial, you will have a mental model of how cyber adversaries think and operate. This knowledge will be crucial for the subsequent tutorials in Unit 4, where we will explore intrusion detection, firewalls, and prevention systems — technologies that are specifically designed to disrupt the attack chain.

The content aligns with Stallings & Brown (2024), Chapter 7, and integrates guidance from NIST, the MITRE Corporation, and the SANS Institute. We will also draw on recent high-profile breaches to illustrate the concepts in action.

1. Intrusion Concepts and Terminology

1.1 What Is an Intrusion?

An intrusion is any deliberate unauthorized attempt to access, manipulate, or disrupt a computer system or network. Intrusions are not limited to external actors; they can originate from inside an organization as well. The key characteristic of an intrusion is that it violates the security policy of the target environment.

In cybersecurity, we often differentiate between:

• Attempted intrusion: An unsuccessful effort to gain access (e.g., a blocked brute-force attack).
• Successful intrusion: When an attacker gains unauthorized access to a system or data.
• Compromise: A successful intrusion that results in the attacker having control over systems, data, or credentials.
• Breach: An intrusion that results in unauthorized disclosure, modification, or loss of sensitive data (often used in the context of data breaches).

1.2 Intrusion vs. Attack

An attack is a broader term that encompasses any action taken to compromise a system. An intrusion is a specific type of attack that involves unauthorized access. An attack may be passive (e.g., eavesdropping) without being a direct intrusion, but the two are often used interchangeably in casual discourse.

1.3 The Intrusion Kill Chain — A Preview

Intrusions are rarely single-step events. Most sophisticated intrusions follow a multi-stage process that we will explore in depth later in this tutorial. The stages typically include:

• Reconnaissance: Gathering information about the target.
• Initial access: Gaining a foothold (e.g., via phishing or vulnerability exploit).
• Privilege escalation: Gaining higher-level permissions.
• Lateral movement: Expanding access to other systems.
• Persistence: Ensuring continued access.
• Exfiltration / impact: Achieving the attacker's ultimate goal (stealing data, ransomware, disruption).

2. Threat Actors: Categories and Motivations

Threat actors are the individuals or groups that perpetrate intrusions. Understanding who they are, what they want, and how they operate is critical for prioritizing defenses. Below is a taxonomy of common threat actor categories.

Threat Actor Type	Motivation	Typical Capabilities	Examples
Cybercriminals	Financial gain	Medium to high; use commodity malware, phishing, ransomware-as-a-service	Ransomware gangs (e.g., LockBit, REvil)
State-Sponsored Groups (APT)	Espionage, political advantage, sabotage	Very high; advanced, persistent, well-funded	APT28 (Fancy Bear), APT29 (Cozy Bear)
Insider Threats	Financial, revenge, ideology, carelessness	Variable; have trusted access	Disgruntled employees, negligent staff
Hacktivists	Political or social activism	Low to medium; use DDoS, defacement, data leaks	Anonymous, LulzSec
Cyberterrorists	Intimidation, disruption, ideological	Low to medium; often use DDoS or propaganda	Various state-sponsored or independent groups
Script Kiddies	Notoriety, curiosity	Low; use automated tools	Teenagers using publicly available exploits

Table 1: Common Threat Actor Categories

2.1 External Attackers

External attackers operate from outside the organization's network. They use a variety of techniques to gain access, including phishing, exploiting internet-facing vulnerabilities, compromising third-party services, and using stolen credentials. External attackers are the most common concern for perimeter defenses, but the rise of cloud and remote work has blurred the perimeter.

2.2 Insider Threats

Insider threats are often underestimated, yet they can be the most damaging. An insider may be a current or former employee, contractor, or business partner with authorized access. Their actions can be malicious (intentional harm), negligent (accidental), or compromised (their credentials are stolen). According to various industry reports, insider threats account for a significant percentage of data breaches.

2.3 Advanced Persistent Threats (APTs)

APTs are the most sophisticated threat actors. They are typically nation-state-sponsored or highly organized criminal groups. The key characteristics of APTs include:

• Advanced: They use custom tools, zero-day exploits, and complex attack chains.
• Persistent: They maintain long-term access, often for months or years.
• Targeted: They focus on specific organizations or sectors (e.g., government, critical infrastructure, finance).
• Patient: They are willing to wait for the right opportunity and move slowly to avoid detection.

We will explore APTs in more detail in the next section.

3. Advanced Persistent Threats (APTs)

3.1 Defining APTs

The term APT was coined by the US Air Force to describe a new class of threats that are highly sophisticated and persistent. APT groups are typically state-sponsored or affiliated with state intelligence agencies, but some are highly organized cybercriminal syndicates that mimic APT behavior.

3.2 APT Lifecycle

The APT lifecycle is a longer, more deliberate version of the general attack lifecycle. A typical APT operation may last for months or years and includes:

• Targeting: Careful selection of a high-value target.
• Reconnaissance: Extensive intelligence gathering about the target's people, processes, and technologies.
• Initial compromise: Often via a targeted spear-phishing email with a zero-day exploit or a watering-hole attack.
• Establishing foothold: Installing backdoors, command-and-control (C2) channels.
• Lateral movement and privilege escalation: Moving to high-value systems and obtaining domain-level credentials.
• Data collection and exfiltration: Stealing intellectual property, sensitive documents, or other strategic data.
• Maintaining persistence: Leaving behind multiple access methods to ensure they can return even if discovered.

3.3 Notable APT Groups

• APT28 (Fancy Bear): Russian military intelligence-linked, known for targeting political organizations, defense contractors, and media.
• APT29 (Cozy Bear): Also Russian, linked to espionage against governments and corporations; involved in the SolarWinds supply chain attack.
• APT41 (Double Dragon): Chinese state-sponsored, active in both espionage and financial crime.
• Lazarus Group: North Korean, responsible for the Sony hack, WannaCry ransomware, and numerous financial thefts.

4. The Attack Lifecycle

Regardless of the threat actor, most attacks follow a similar pattern. We can represent the attack lifecycle as a series of phases that an attacker must complete to achieve their objective. Two of the most widely used models are the Cyber Kill Chain (Lockheed Martin) and the MITRE ATT&CK framework.

Let's first establish a generic attack lifecycle:

Figure 1: A Generic Attack Lifecycle

We will explore each phase in detail in the following sections, but first, we introduce two structured models that provide a more granular view.

5. The Cyber Kill Chain Model

The Cyber Kill Chain was developed by Lockheed Martin in 2011 as a military-inspired framework to describe the stages of a cyber attack. It is a linear model with seven phases:

1. Reconnaissance: Harvesting email addresses, social media profiles, system information, etc.
2. Weaponization: Creating a deliverable payload (e.g., a phishing email with a malicious attachment).
3. Delivery: Transmitting the weapon to the target (e.g., email, USB drive, web).
4. Exploitation: Triggering the malicious code (exploit of a vulnerability).
5. Installation: Installing malware on the target system (backdoor, RAT).
6. Command & Control (C2): Establishing a channel to send commands and receive data from the compromised system.
7. Actions on Objectives: Achieving the attacker's goal (data exfiltration, encryption, destruction).

The Kill Chain is intuitive and maps directly to defensive actions: we can "break" the chain at any point to prevent the attack. For example:

• Preventing reconnaissance (e.g., by limiting public information).
• Blocking delivery (e.g., email filtering, web filtering).
• Preventing exploitation (patching, application whitelisting).
• Detecting installation (HIDS, EDR).
• Disrupting C2 (network monitoring, DNS filtering).
• Stopping actions on objectives (data loss prevention, access controls).

6. MITRE ATT&CK Framework Overview

The MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) framework is a more comprehensive and detailed model than the Kill Chain. It provides a matrix of tactics (the "why" of an attack stage) and techniques (the "how") that adversaries use. It is based on real-world observations of adversary behavior.

ATT&CK covers multiple platforms (Windows, Linux, macOS, Cloud, Mobile) and organizes adversary behavior into a set of tactics that roughly correspond to the stages of an attack, but with more granularity. As of 2026, the Enterprise matrix includes 14 tactics (e.g., Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact).

Each tactic has dozens of techniques and sub-techniques. For example, "Initial Access" includes techniques such as:

• Phishing: Spearphishing attachments, spearphishing links, etc.
• Exploit Public-Facing Application: Exploiting vulnerabilities in web servers, databases, etc.
• Valid Accounts: Using compromised credentials to log in.
• Supply Chain Compromise: Compromising a software vendor or update mechanism.

6.1 Using ATT&CK for Defense

MITRE ATT&CK is invaluable for security professionals because it:

• Provides a common language for describing adversary behavior.
• Helps in threat intelligence reporting (mapping observed activity to techniques).
• Enables gap analysis: which techniques can your defenses detect or prevent?
• Supports red teaming and penetration testing.
• Informs the creation of detection rules (e.g., Sigma, Splunk) and response playbooks.

7. Reconnaissance and Weaponization

7.1 Reconnaissance

Reconnaissance is the phase where attackers gather information about their target. This can be passive (open-source intelligence - OSINT) or active (scanning, probing). Key activities:

• OSINT: Searching public sources (LinkedIn, social media, company websites, job postings, press releases) to identify employees, technologies, partners, and organizational structure.
• Network scanning: Using tools like Nmap, Shodan, or masscan to discover IP addresses, open ports, running services, and operating systems.
• DNS enumeration: Querying DNS to discover subdomains, mail servers, etc.
• Email harvesting: Collecting email addresses for phishing campaigns.
• Social engineering: Pretexting, eliciting information from employees via phone or email.

Defenders can limit reconnaissance by minimizing public information, using honeypots, monitoring network scans, and implementing threat intelligence sharing.

7.2 Weaponization

In the Kill Chain, weaponization occurs after reconnaissance. The attacker creates a deliverable payload that combines an exploit with a backdoor or dropper. This might be a malicious Office document, a PDF with embedded exploit, or a custom malware binary. In modern attacks, weaponization is often outsourced to exploit kits or malware-as-a-service.

8. Privilege Escalation

Once initial access is obtained, the attacker typically has limited permissions (e.g., a standard user account). Privilege escalation is the process of gaining higher-level permissions, such as administrator or SYSTEM/root access. This is often a critical step that enables the attacker to perform many subsequent actions.

8.1 Types of Privilege Escalation

• Vertical escalation: Moving from a lower-privileged user to a higher-privileged user (e.g., user to administrator).
• Horizontal escalation: Moving to another user account with similar privileges (often to access additional resources or credentials).

8.2 Common Techniques

• Exploiting vulnerabilities: Using known or zero-day exploits (e.g., Windows privilege escalation vulnerabilities, misconfigured services).
• Credential dumping: Extracting hashed passwords from memory (e.g., using Mimikatz) and then cracking or passing them.
• Abusing system misconfigurations: Weak sudo permissions, unquoted service paths, insecure registry permissions.
• Token manipulation: Stealing or duplicating access tokens (Windows).
• Abusing group policy or scheduled tasks: Taking advantage of poorly secured administrative scripts.

Defenders can mitigate privilege escalation by applying the principle of least privilege, regular patching, hardening configurations, using application whitelisting, and monitoring for suspicious processes and authentication events.

9. Lateral Movement

Lateral movement is the technique attackers use to move within a network from one compromised system to another. The goal is to reach high-value targets (e.g., domain controllers, database servers, file shares) and expand control.

9.1 Common Lateral Movement Techniques

• Pass-the-hash: Using the hash of a user's password (obtained from one machine) to authenticate to another machine without needing the plaintext password.
• Pass-the-ticket (Kerberos): Stealing Kerberos tickets and using them to authenticate to other services.
• Remote services: Using Windows Management Instrumentation (WMI), PowerShell Remoting, Remote Desktop Protocol (RDP), or Secure Shell (SSH) to execute commands on other systems.
• SMB/Admin shares: Copying tools to remote systems using administrative shares (C$, ADMIN$).
• SSH key harvesting: Stealing SSH private keys to pivot to other Unix-based systems.
• Proxy and tunneling: Using tools like SOCKS proxies or SSH port forwarding to route traffic through compromised hosts.

9.2 Defending Against Lateral Movement

• Network segmentation: Restrict east-west traffic between network segments.
• Least privilege for accounts: Avoid using administrative accounts for day-to-day operations.
• Monitoring: Detect unusual RDP or SMB connections, use of tools like PsExec, and suspicious authentication patterns.
• Hardening: Disable unnecessary services, restrict PowerShell usage, and enforce strong password policies.

10. Persistence and Data Exfiltration

10.1 Persistence

Persistence refers to techniques that enable an attacker to maintain access even after reboots, credential changes, or partial remediation. Attackers want to ensure they can return to the compromised environment.

• Backdoors: Install web shells, remote access trojans (RATs), or SSH backdoor accounts.
• Scheduled tasks / cron jobs: Set up recurring execution of malicious code.
• Registry entries (Windows): Use Run or RunOnce keys to launch malware at boot.
• Service creation: Install a malicious Windows service.
• Credential persistence: Create new user accounts with known passwords; add authorized_keys for SSH.
• Bootkits / rootkits: Hidden persistence in the boot process or kernel.

Detecting persistence requires monitoring for unexpected changes to system configuration, new services, scheduled tasks, and startup items. EDR and HIDS are critical for this.

10.2 Data Exfiltration

Data exfiltration is the unauthorized transfer of data from an organization's systems to an external location controlled by the attacker. This is often the ultimate objective of espionage or ransomware (where data is both stolen and encrypted).

• Exfiltration channels: HTTPS/HTTP, DNS tunneling, SMTP (email), FTP, SSH, custom protocols, cloud storage APIs.
• Data compression and encryption: To avoid detection and reduce size.
• Steganography: Hiding data inside images or other benign files.
• Slow and low exfiltration: Throttling data transfer to blend in with normal traffic.

Defenders can detect exfiltration through network monitoring for anomalous outbound traffic, data loss prevention (DLP) systems, and advanced anomaly detection. However, encrypted traffic makes detection more challenging.

11. Insider Threats

While much of the focus is on external attackers, insiders pose a significant risk. Insiders have legitimate access, making them harder to detect. Insider threats fall into three main categories:

• Malicious insider: An employee or contractor who intentionally abuses their access for personal gain, revenge, or espionage.
• Negligent insider: An employee who inadvertently causes a security incident (e.g., misconfigured cloud storage, falling for a phishing email).
• Compromised insider: An employee whose credentials have been stolen by an external attacker.

11.1 Common Insider Attack Patterns

• Data theft: Downloading sensitive files to removable media or cloud storage before leaving the company.
• Sabotage: Deleting critical files, installing malware, or disrupting operations.
• Privilege abuse: Accessing systems or data outside of job duties.
• Fraud: Manipulating financial records or transactions.

Defending against insiders involves strict access control, monitoring user activity, implementing separation of duties, conducting background checks, and fostering a positive security culture. User and Entity Behavior Analytics (UEBA) is particularly useful for detecting insider anomalies.

12. Real-World Attack Scenarios and Case Studies

12.1 Case Study: The SolarWinds Supply Chain Compromise (2020)

One of the most sophisticated attacks in history, the SolarWinds breach, involved the compromise of the Orion software supply chain. Attackers (believed to be APT29) injected a backdoor into legitimate software updates distributed to over 18,000 customers, including numerous US government agencies.

Attack chain phases:

• Reconnaissance: Targeted software build environment.
• Weaponization: Inserted malicious code into the Orion source code.
• Delivery: Distributed the poisoned update via the official update mechanism.
• Exploitation/Installation: Customers applied the update, installing the backdoor (SUNBURST).
• C2: The backdoor communicated with attacker-controlled domains using a covert protocol.
• Actions: Attackers moved laterally, stole data, and maintained persistence for months.

This attack highlights the importance of supply chain security and the difficulty of detecting a well-executed APT.

12.2 Case Study: Colonial Pipeline Ransomware (2021)

A ransomware attack on Colonial Pipeline, the largest fuel pipeline in the US, caused widespread disruption. Attackers (the DarkSide group) gained access through a compromised VPN password and then deployed ransomware.

• Reconnaissance: Possibly through leaked credentials on dark web.
• Initial access: Used a compromised VPN account (no MFA).
• Privilege escalation & lateral movement: Moved to high-value systems.
• Impact: Encrypted critical systems, demanded ransom.

This case underscores the importance of MFA, network segmentation, and incident response readiness.

12.3 Case Study: Insider Data Theft at Tesla (2018)

A Tesla employee who had been passed over for a promotion allegedly stole sensitive manufacturing data and shared it with a third party. The insider was able to access and exfiltrate data using their legitimate credentials, but the activity was eventually detected by the company's security team.

This illustrates the need for monitoring employee activity, even for those with trusted access.

📌 Summary

📝 Quiz

🛠️ Exercises

📚 Homework

---

COMP400 – Computer and Network Security (Revision 3) • Unit 4: Security Systems and Models