Key Technical Concepts

Introduction

Understanding key technical concepts is essential for effective threat intelligence analysis. This module covers fundamental technical aspects that every CTI analyst should know.

Cryptography

Understanding basic cryptographic concepts and their application in cyber threats.

DNS

The Domain Name System (DNS) is a hierarchical, distributed database that translates human-readable domain names (e.g., www.example.com) into IP addresses (e.g., 192.168.1.1 or 2001:db8::ff00:42:8329), allowing devices to locate and communicate over the internet. Without DNS, users would have to remember numerical IP addresses instead of domain names.

Types of DNS Servers

Types of DNS Queries

Understanding the different types of DNS Queries available

Fast Flux DNS

Fast Flux is a technique used by cybercriminals to hide the actual location of malicious servers by rapidly changing DNS records this makes it much more difficult to track or take down malicious websites. It is primarily used in botnets, phishing campaigns, and malware hosting to maintain resilience against takedown efforts.

The DNS A record rapidly changes, associating the domain with different IP addresses typically every few minutes. Requests to the domain are dynamically routed to different infected hosts making it difficult to block or take town the operation. The threat actors backend, which would be their command and control servers remain protected while infected machines act as intermediaries

Uses for Fast Flux

Cybercriminals use Fast Flux to protect their malicious infrastructure from takedowns. Common uses include:

Overview of IP Protocols and Their Use in Cyber Attacks

Internet Protocol is the foundation of network communication, and different protocols operate within or alongside it to enable various functionalities. Below is a breakdown of key protocols and their security implications.

Overview of Key IP Protocols

Vulnerabilities

Understanding vulnerabilities and their exploitation is crucial for defending against cyber threats. By analyzing how adversaries use vulnerabilities, security teams can detect, attribute, and mitigate attacks effectively.

Aside from the vulnreability lifecycle which is a good benchmark for how to tackle vulnerabilities within your environment there are of course some concepts specific to how threat actors use vulnerabilities.

Vulnerability Lifecycle

Vulnerabilities exist across different platforms, allowing attackers to exploit them for unauthorized access, data theft, and system compromise. I will detail some of these below. I will make an assumption that most if not all you reading this are somewhat familiar different types of vulnerabilities.

Desktop Operating Systems

• Privilege Escalation
• Remote Code Execution
• Weak Default Credentials
• Unpatched Systems

Web Server and Web Application Vulnerabilities

Check the Top 10 OWASP Web Application

• SQL Injection
• Cross-Site Scripting
• Remote Code Execution
• Directory Traversal

Mobile Device Vulnerabilities

Check the Top 10 OWASP Mobile Application

• Jailbreaking/Rooting
• App-based Malware
• Insecure Data Storage
• Bluetooth/Wi-Fi Exploits

Understanding Zero-Day Exploits and Adversary Usage

A zero-day vulnerability is a flaw that has no patch available when it is first discovered. Attackers exploit these vulnerabilities before developers release a fix.

Nation-State Cyber Attacks like APT groups use zero-days for cyber espionage (e.g., Stuxnet exploiting Windows zero-days). Malware and Ransomware Delivery is used by attackers, they use zero-days to install backdoors and ransomware (e.g., CVE-2021-34527 (PrintNightmare) exploited in ransomware campaigns). Targeted Attacks on High-Value Organizations, its common that exploits are sold on the dark web or used by cybercriminals to breach critical infrastructure.

Command & Control

Command and Control or commonly abbreviated to (C2) refers to the communication infrastructure used by attackers to remotely manage compromised systems in a target environment. It enables adversaries to issue commands, execute malicious payloads, exfiltrate data, and maintain persistent access to a victim’s network.

Attackers use various methods to establish and maintain C2, we will detail some of them below.

I discuss the above in detail and we use and setup some common tools to understand how these work and how attackers actually use and abuse them in my Advanced Cyber Threat Intelligence Course