>> Hey guys, welcome back
to the cyber kill chain course on Cybrary.
This is Abdulrahman Alnaim and today we're
covering action on objectives.
We reach the end the goal of the attack.
Now that we've finished our successful reconnaissance,
successful weaponization, successful delivery,
successful exploitation, and installation,
and then went through
a textbook example of command and control.
Now, the attacker went through the environment,
however, so far,
he did not gain a single thing, nothing.
The only thing that he can say now
is he was able to hack this or that company,
but he does not even have the proof that he did that.
Now, he moves to action on objective.
In the action on objectives,
the attacker performs the steps to achieve that goal.
Basically going through the sixth step
is to achieve the action on objective.
Now the attacker is in the network,
>> he has connectivity.
>> Now, he needs to get basically the payment histories,
the login data, account information,
any other sensitive information
to ransom the whole network,
and hope people would pay for that.
That's action on objective.
This step, by the way, might take months.
It's because the attacker tries to
be as less noisy as possible.
He's trying to take
a billion thousand steps without being detected.
He needs to be silent.
That's why it takes a lot of time.
During that time he needs, again communication,
which is command and control
so action on objective is the goal.
Let's go back to our example.
I'm not sure if you guys noticed
one thing when I displayed the picture.
There's one thing that actually caught my eye.
Basically, the machine has no antivirus, nothing.
It's not showing. The other thing,
it's a laptop, which means it's portable.
Basically, these are the things
that someone would look into.
Because it's a laptop, it's portable,
there's a lot of data stored on
the laptop because he needs to access
even when he's away from the office.
Let's go back to the machine itself and start
with going to the desktop because a lot of
people would save some data on the desktop.
I need to put cd users
then let's go to desktop.
Then we're going to look
what things they have on the desktop.
This might seem interesting.
Obviously, in a real life situation
would not be as easy as this,
however, a folder in the desktop
is called Crown Jewels.txt.
I know in reality,
this will never happen but why not?
Let's open that file and see what information is in it.
It's not really a Linux machine,
so say
less crown jewels.txt.
Again, I'm sorry about that.
I thought for some reason when you use Linux,
less is one of the things that you get used to.
I'm showing the crown jewels are
texts and it says crown jewels.
Obviously, this is just capture
the flag situation where it was extremely obvious.
But there you go.
You want to go through the or
the attacker would go through the machine file by file
until he reaches his goal that he started this for.
Again, don't forget that I
still have all of these options that I can run.
I can record the mic.
Again, it's a laptop,
if I run a mic
when they are in the meeting or something like that,
I would be able to get more information
>> that I hope for.
>> You can terminate processes.
You can basically clear the event logs.
Obviously, a lot of hackers
would do that before they leave.
There's a lot of capabilities that you can do that.
Don't forget that.
We covered the final step of the cyber kill chain,
what is the main purpose of
the action on objective phase?
As I said, now the intruder
takes the action required to achieve that goal,
getting the data that he wants,
credit card information,
payment history, any other possibility.
There's a limitless number of possibilities
of objectives that a hacker might have.
It might be just destructive where he destroy
the whole system and leave
>> what can be ransomware thing.
>> It depends on the objective.
We have a number of true or falses here.
The first one is action on objective can be
done quickly and shouldn't take too long.
That's actually not true.
Action, as I said, the attacker has to be as quiet as
possible during action on
objective because you don't want to be discovered.
You want to take your time now that you are beyond
any security system or
any capabilities for them to discover you,
you want to be as quiet as possible.
Take your time, explore
everything that you can to explore,
and then action on your objective.
Second, hacker use or hackers use actions
on objective to erase any log and leave.
In other kill chain,
that's one, usually,
the last phase where basically action on objective,
and then erase all of your logs and leave.
However, in the cyber kill chain
it's usually not something
that they pay attention to erasing the logs
because it's the action on objective.
He got the goal regardless
>> if they discovered him or not.
>> After the fact he achieved his objective.
However, it's usually a good idea for an attacker to
erase any logs before leaving the environment.
Finally, action on objective is the goal of the attack.
That's actually true because what we
said is the first six-step is for me
>> to reach that goal,
>> to reach basically the capability to
get my objective out of the whole attack.
Today, we covered the action on objectives.
We covered the full cyber kill chain.
We went through reconnaissance,
>> weaponization, delivery,
>> exploitation, installation, command and
control and we just covered action on objectives.
In the next video,
we're going to use the cyber kill chain to
design a defense in-depth
model for a corporate or a company.
Thank you so much and I'll see you then.