Correlation in Cyber kill chain phases

Correlating different log sources is an essential aspect of detecting a malware attack. By mapping out the kill chain of a malware attack and understanding what logs are generated during each stage, an analyst can identify patterns and anomalies that indicate a potential attack. Here’s a step-by-step guide on how to correlate different log sources to detect a malware attack, starting from the reconnaissance stage to the actions stage.

1. Reconnaissance Stage

The reconnaissance stage involves an attacker gathering information about the target network, such as IP addresses, open ports, and vulnerabilities. Log sources that can provide insights into reconnaissance activities include:

• Firewall logs: Check for incoming traffic from suspicious IP addresses or to unusual ports.
• DNS logs: Check for requests for unknown or suspicious domains, particularly those with short lifetimes.
• Web logs: Check for traffic to suspicious URLs or domains, particularly those associated with phishing or drive-by downloads.
• Email logs: Check for phishing emails or suspicious attachments.

Example: An attacker sends a phishing email to an employee in the target organization. The employee clicks on a link in the email that takes them to a malicious website.

2. Weaponization Stage

The weaponization stage involves an attacker creating or obtaining a weaponized payload, such as a malware dropper or exploit. Log sources that can provide insights into weaponization activities include:

• Endpoint logs: Check for the execution of suspicious or unauthorized processes, particularly those associated with droppers or exploit kits.
• Email logs: Check for suspicious attachments or links in emails that could download a weaponized payload.

Example: The malicious website that the employee visits in the reconnaissance stage downloads a dropper that installs malware on their endpoint.

3. Delivery Stage

The delivery stage involves an attacker delivering the weaponized payload to the target network. Log sources that can provide insights into delivery activities include:

• Firewall logs: Check for incoming traffic from suspicious IP addresses or to unusual ports.
• Email logs: Check for outgoing emails with suspicious attachments or links.
• Web logs: Check for downloads of suspicious files or executables.

Example: The dropper installed in the weaponization stage downloads the malware payload from a command and control server.

4. Exploitation Stage

The exploitation stage involves an attacker exploiting a vulnerability in the target network to execute the weaponized payload. Log sources that can provide insights into exploitation activities include:

• Endpoint logs: Check for the exploitation of known vulnerabilities or the use of exploit kits.
• IDS/IPS logs: Check for the detection of known exploit attempts.
• Web logs: Check for attempts to exploit vulnerabilities in web applications or web servers.

Example: The attacker exploits a vulnerability in an unpatched system to execute the malware payload.

5. Installation Stage

The installation stage involves an attacker installing the malware on the target network. Log sources that can provide insights into installation activities include:

• Endpoint logs: Check for the installation of unknown or unauthorized software.
• Windows Event Logs: Check for the creation of new user accounts or modifications to existing ones.
• IDS/IPS logs: Check for suspicious network traffic associated with the installation of the malware.

Example: The malware payload installs itself on the compromised system and establishes persistence.

6. Command and Control Stage

The command and control stage involves an attacker establishing a connection to a remote server to receive commands and exfiltrate data. Log sources that can provide insights into command and control activities include:

• Firewall logs: Check for outgoing traffic to suspicious IP addresses or domains.
• DNS logs: Check for requests to known command and control domains.
• Endpoint logs: Check for the creation of new processes or modifications to existing ones associated with command and control activity.

Example: The malware connects to a remote server to receive commands and exfiltrate data.

By correlating different log sources across the kill chain, analysts can detect anomalies