Evaluate yourself page - GBM - Gulf Business Machines

Evaluate yourself

Reconnaissance

Delivery

Exploitation

Installation

Command and Control

Objective of Attack

Contact Details

Reconnaissance

1- Reconnaissance (Targeted System) Cyber attackers use the various ways of reconnaissance to identify the target assets. Please validate what all information you can gather using your existing security tools implemented in your IT Infrastructure. Patient Zero: System and User Information This steps aims to check the maturity of the IT Security Solution/teams capabilities to identify and highlight the source of an Malware infection.

	Yes	No	Partial
Computer Name of the "Patient Zero" or the source of the Infection of the Cyber attack.
Operating System of the "Patient Zero" machine.
Vulnerable Applications/Vulnerabilities exploited by attacker to infect the "Patient Zero" Machine.
Logged-in User Name on the "Patient Zero" machine when the cyber attack/infection was injected on the "Patient Zero"
MAC Address of the "Patient Zero" machine.
Host IP Address(es) of the patient zero machine at the time of infection.

Installation

4- Installation The installation phase relates to the backdoor created by malware into the IT network/IT Infrastructure allowing persistence access. The task involves identifying the capability of existing Security tools maturity and capability to identify forensics information of the "Installation" phase of the cyber attack kill chain. For Example: Attacker was able to execute the malicious code and is able to identify the target in the orgnization's IT Infra for example the Server which stores Credit Card Information or Server which stores the "login credentials" for multiple critical applications. Now the attacker can pull the data via SQL queries or other techniques. Malware Binary Information for "Installation" phase of Cyber Kill Chain.

	Yes	No	Partial
Identify is your existing Security tools can identify the "File Name" of the scripts/tools via which attackers can create backdoor.
Validate if your existing tools can identify the "Malware Family Name" for "Known Malware" and "Zero-day Malware".
Validate if your existing tools can identify the "File Type" used during the "installation phase" of Cyber kill chain.

Command and Control

5- Command and Control A Malware outbreak often begins with a communication with a command & control server. Some of the critical information which are gathered via such servers are "Key Stroke monitoring information", "exfiltrate critical confidential documents" etc. This part of the task looks at the maturity of existing Security tools to identify "C&C" servers via which attacks is surfaced. Command and Control (C2) Communications Information which can be captured by existing Security Tools.

	Yes	No	Partial
Domains Contacted Identify the tools via which your organization can identify the "Domains" to which the Malware has contacted. The maturity of the solution should be collectively looked at various layers such as Email Security, Web Security, Permiter Security or DNS Security. The maturity of the Security tools should also be validated wrt to the automated/manual Incident response capabilities.
URLs Contacted Identify the tools via which your organization can identify the "Malicious URLs" i.e. both known & unknown, to which the Malware has contacted both during and after the attack. The maturity of the solution should be collectively looked at various layers such as Email Security, Web Security, Permiter Security, DNS Security etc. The maturity of the Security tools should also be validated wrt to the automated/manual Incident response capabilities.
IPs Contacted Identify the tools via which your organization can identify the "Malicious IPs" i.e. both known & unknown, to which the Malware has contacted both during and after the attack. The maturity of the solution should be collectively looked at various layers such as Email Security, Web Security, Permiter Security, DNS Security etc. The maturity of the Security tools should also be validated wrt to the automated/manual Incident response capabilities.

Objective of Attack

6- Objective of Attack. Intruder takes action to achieve their goals, such as data exfiltration, data destruction, or encryption for ransom. This phase deals with identifying the capabilities of the Security tool to identify the objective of the attack via various threat behavior. Validate if you Security tools can identify details on the "Threat Behavior"

	Yes	No	Partial
Can your existing Security tools can detect & prevent from the attack triggered via "Process injection".
Confirm if the existing tool can detect & prevent from the technique used by attacker to perform "Privilege Escalation".
Confirm if your existing Security tools can identify if the attack is done via any of the fileless technique such as "PowerShell / scripting commands".

Contact Details

First Name

Last Name

Company Name

Company Email

Enter your Country

6 + 7 =

	Yes	No	Partial
Malicious Domains via which the delivery of the exploit occurred. Please validate if your existing Security tools (can fully report malicious domains via which the delivery of the attack was performed.
"Dropper File Name" Dropper is a type of Trojan whose purpose is to deliver an enclosed payload onto a destination host computer to surface the attack. The task aims at identifying Security tools maturity ( "Firewall, NGIPS, Email & Web Security gateway, SIEM Solution, Network Behavior solution, DNS Security etc") which can report information abour dropper file.
"Source IP Address & Destination IP address" of the first delivery of the attack.
Dropper File Type Dropper is a type of Trojan whose purpose is to deliver an enclosed payload onto a destination host computer to surface the attack. The task aims at identifying Security tools maturity ( "Firewall, NGIPS, Email & Web Security gateway, SIEM Solution, Network Behavior solution, DNS Security etc") which can report information about the type of dropper file such .exe/.bat etc.

	Yes	No	Partial
Email: Attachment Malicious email attachments are an increasingly dangerous threat to corporate security. Disguised as documents, voicemails, e-faxes or PDFs, malicious email attachments are designed to launch an attack on the victim's computer when the attachment is opened. The task aims to check the maturity of the exiting Security Tools to identify if the they are capable to report/identify attacks which penetrates via Email attachment. Please validate if your email Security Controls can stop "Unknown/Zero-Day" attacks which are not detected by Signature based solutions.
Email: Phishing Link Phishing emails are used by criminals to trick people into handing over sensitive information such as usernames, passwords, PIN numbers and credit card details. If the fraudulent emails are successful, recipients can become victims of identity theft or may find their credit card maxed out or their bank account emptied. The task aims at validating the maturity of the Email Security Solution to identify phishing URLs via which an attack is initiated. The effectiveness of the Email Security should be rated on below factors: Ability to identify malicious link in the email body. Ability to identify malicious link in the email attachment. Ability to sandbox unknown link/new domains.
Web: Phishing Link The task validates the maturity of the Web Security Tools/Solutions to identify the capabilities of Organization web security to identify Known & unknown phishing links. This also validates if the solution is capable perform retrospective prevention.
Web: Exploit Kit Exploit kits are the threats that utilize compromised websites to divert web traffic, scan for vulnerable browser-based applications, and run attcks or malware. The task involves in validating the effectiveness of the Orgnaization Security tools to identify the "Expolit Kit" used to perform the attack.
Active Exploitation With active information gathering and reconnaissance, the attacker actively interacts with the target system. An example of active information gathering and reconnaissance is port scanning, where the attacker works to enumerate open ports. The goal of the attacker, in this case, is to uncover ports that are vulnerable to exploitation and therefore would provide a means for the attacker to access the target system. For example "Wannacry Ransomware" looks for SMB ports via which further exploitation can be performed. The task involves validating the Security tools via which the "active exploitation" of the attack can be reported or flagged by Security tools.

Evaluate yourself

Haider Pasha

Amer Sharaf

Miguel Khourii

Fady Younes

Melih KIRKGOZ

Frida Kleimert Knibbs

H.E. Dr. Mohamed Al-Kuwaiti

Tarek Ghoul

Ossama El Samadoni

Hani Nofal

Click here to download

GET IN TOUCH

Schedule a demo