Reversing the Killchain

	A	B	C	D	E	F
1	Kill Chain Step	Malicious Action	Defensive Mitigation	Ease of Deployment	Potential Monitoring	Detailed Alerting
2	Reconnaissance	Attacker obtains email addresses, technologies used, and creates an organizational profile based on that information.	Create policies around sharing internal information on sites such as LinkedIn or using corporate email addresses for nonbusiness use.	Easy	Have corporate emails been seen in breaches elsewhere? How many emails are found with OSINT?	Schedule theharvester.py to log email addresses found
3			After a major breach has been seen on the news run a password reset. Even though they shouldn't, employees will reuse passwords for other services and sites.	Easy		Setup google alerts
4				Easy		Pastebin Alerts https://pastebin.com/alerts
5	Weaponization	Attacker creates a malicious exploit to send to the victim, or uses a current exploit.	Knowledge and awareness of threats currently being used by attackers will allow for better constructed and tuned mitigation steps.	Easy	n/a
6	Delivery	A user receives a phishing email.	Assess which attachment types are needed in the organization. File types such as .js can be extremely harmful and are rarely exchanged from external sources. Group policy can be used to set the default application to notepad or something other than what is intended (java, word, etc)	Medium	Filetypes of a certain size known to be malicious and associated with ransomware.	Flag .scr files over 22 MB and .js over 15 MB unknown file extensions such as .xyz
7			Implement mailing blacklists and greylists such as Spamhaus and dnsbl to block known malicious mail servers.	Medium
8			Instill the idea of "trust but verify" to your users.	Hard
9			Implement Ad-Blocking	Easy
10	Exploitation	Endpoint downloads a JavaScript file or Word document with malicious macro.	Disable macros and malicious filetypes via group policy.	Medium	Monitor proxy logs for unexpected file retrievals (e.g., JavaScript is the first file fetched from that host, host is on a threat intel list, etc.)
11	Exploitation		Ensure any endpoint protection is up-to-date and installed.	Easy	Use proxies or IDS (if cleartext) to monitor for known deobfuscation strings.
12	Installation	The payload is executed on the end user’s device. (Lucky, Cerber, and CryptoWall use the built-in Windows Cypto API to handle the encryption.)	Keep backups (that are not permanently attached) so that encrypted files can be restored easily.	Medium	High increase in Windows Crypto API over short amount of time.
13			Depending on OS, you can use "filesystem firewalls" such as as Little Flocker to permit access to files on per-process basis. That means that you can permit read access to MS Word, but not IE, for example.	Medium	Excessive numbers in a domain or low % of meaningful strings in domain.
14			There are experimental techniques that can be used to block crypto-based ransomware (e.g., Decryptonite)	Hard
15	Command & Control (C&C)	The ransomware contacts a C&C server on the internet to transmit the decryption key.	Implement sinkhole DNS and autoblock outbound connections to known malicious IP addresses.	Medium	Connection to known C&C servers.
16	Command & Control (C&C)	Many times attackers use DGA (or Domain Generating Algorithms) to create temporary domains for C&C or exploitation.	Use domain age as a DNS filtering category. Rank newer domains as higher threats and possibly block based on this criteria.	Medium	Alert on unlikely domains (over 20 characters with no dictionary words). For Example, WannaCry used iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com These domains will also have responses of NXDOMAIN.
17	Actions on Objectives	Volume Shadow Copy Deletion	Implement Honey Directories—the ransomware goes into C:\$$ it sees another $$ directory, when it goes into C:\$$\$$ it sees another $$ directory, and so on.	Hard		Advanced file auditing can be enabled for alerting on an extreme increase in filesystem changes. (Windows EventID 4663)
18	Actions on Objectives	The malware starts encrypting the files on the hard disk, mapped network drives, and USB devices. Once completed, a splash screen, desktop image, website, or text file appear with instructions for the ransom.
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100