Upload of first Killchain SI

[JohnHuebenerSI]

Hey there,

as discussed, I wanted to upload Signal Iduna's first Killchain, let me know if everything works for you and if this is adequate. I could't upload the native .afb file from MITREs kill chain builder, is this a common issue?

Thanks in advance,

John

[romaindoumenc]

Great first submission @JohnHuebenerSI !

After review, the attack chain is absolutely credible, and it is worth adding it to the repository.

Next step, please attach a bit of context in your PR:

• is these a reconnaissance step before attacking the (publicly exposed) Confluence server? Is this where Metasploit is coming in?
• is there a phase of EDR disablement before Anydesk can be pushed? Or should we used for a Java-based reverse shell, which would leverage a Living Off the Land scenario?
• do we expect ProcessHacker to be required? It seems that the benefit of listing process is already a feature in Windows, and it could lead to being targeted.
• do we expect the Confluence Server to run as a local admin?
• is there a setting in Active Directory that would enable the Confluence service user to create arbitrary SMB shares and access desktops over RDP?

You can attach the afb file in your pull request directly – looking forward to it!

[JohnHuebenerSI]

Hey @romaindoumenc !

1. Correct, Metasploit is used to identify vulnerable publicly exposed confluence servers
2. In this instance, EDR disablement would be a necessary pre-requisite (if an EDR is in place)
3. Good point, that would not be necessary
4. For this example we expect the Confluence Server to be run as local admin
5. For this example I assumed that would be possible

Should I add this information to the kill chain or is this sufficient as context ?

[Basile-Professional]

@JohnHuebenerSI

Hello sir, sorry for the delay in my response!

So, yes, could you add this context to the attack chain and make a Pull request with the link to the issue?
Thank you for your contribution, I will put this in the EU-TIS/killchains/Attack-Flow/Generalities_in_Enterprise_attacks directory if that's okay with you?

Have a nice day.