2.1 Network, Host, and Password Attack Techniques

Cyber Threats and Their Security Impact

A cyber threat is a circumstance or actor with the potential to harm an information system or organization. A threat is not the same as a vulnerability, an exploit, or an incident. A vulnerability is a weakness; an exploit is a method or code that takes advantage of a weakness; an event is an observable occurrence; and an incident is an occurrence that actually or imminently jeopardizes confidentiality, integrity, or availability, or violates security policy under the organization’s definition.

SOC analysis connects technical behavior to risk. An external scan may be routine background activity, but the same source exploiting an exposed service, obtaining credentials, and reaching a safety-critical or regulated asset changes likelihood, scope, and impact. Analysts therefore enrich indicators with the actor’s apparent intent and capability, the target’s exposure and value, observed control failures, and evidence of successful action.

Impact Dimensions

Impact is not inferred from a malware family name alone. A credential-stealing tool blocked before execution and the same tool successfully used against a domain administrator require different classifications. Likewise, an administrator’s approved bulk change may look damaging in isolation but be benign when identity, ticket, timing, and expected results align. The analyst’s job is to distinguish attempted behavior, successful technical effect, and business consequence.

During triage, ask: What asset and identity were involved? Which security property could be affected? Did the action succeed? What is the current and plausible scope? Is the condition ongoing? Which evidence would disprove the leading hypothesis? The answers drive severity and response under the local incident plan; neither a threat label nor a CVSS score automatically determines incident priority.

---

Network Reconnaissance Mechanics and Scanning Signatures

Adversaries rarely initiate exploitation without first mapping the target organization's external perimeter and internal network topology. Reconnaissance activities follow a structured progression from passive intelligence gathering to active host and service interrogation.

Passive vs. Active Reconnaissance

1. Passive Reconnaissance: Gathers intelligence without transmitting packets directly to the victim's infrastructure. Techniques include querying Open Source Intelligence (OSINT) repositories, analyzing domain WHOIS registrations, harvesting DNS records via passive DNS databases (e.g., SecurityTrails, VirusTotal), querying Certificate Transparency logs (crt.sh), and indexing publicly exposed devices via Shodan and Censys.
2. Active Reconnaissance: Involves direct packet exchange with target systems to identify live hosts, open transport ports, running software services, and operating system builds. Active probing generates observable network traffic, triggering alerts in Network Intrusion Detection Systems (NIDS) and host firewalls.

Transport Layer Port Scanning Strategies

SOC analysts must evaluate scanning methods by analyzing packet headers, TCP flags, and kernel response behaviors:

• TCP Connect Scan (nmap -sT): Completes the full three-way handshake (SYN → SYN-ACK → ACK), immediately followed by a teardown (RST or FIN-ACK). Because this scan establishes a complete operating system socket via the connect() system call, it generates prominent application-level connection logs and socket open events.
• TCP SYN Stealth Scan (nmap -sS): The de facto standard for active scanning. The scanner transmits a raw SYN packet. When the target responds with SYN-ACK (indicating an open port), the scanner transmits a RST frame rather than the final ACK. Because the three-way handshake is never completed, the connection remains half-open and avoids application-layer socket logging. However, modern firewalls and NIDS track stateful TCP connections and readily detect half-open sweeps.
• UDP Port Scan (nmap -sU): UDP is connectionless and does not utilize a handshake. The scanner sends an empty or protocol-specific UDP packet. If no response is returned, the port state is interpreted as open|filtered. If the target returns an ICMP Type 3, Code 3 (Destination Unreachable: Port Unreachable) error, the port is verified as closed. Because operating system kernels rate-limit ICMP generation (e.g., Linux limits ICMP responses to one per second), comprehensive UDP scans are time-intensive.
• Inverse and Stealth TCP Flag Scans: RFC 793 states that any incoming segment not containing a SYN or RST flag sent to a closed port must elicit a RST response, while open ports must drop the segment silently.
  • FIN Scan (nmap -sF): Transmits packets with only the FIN flag set.
  • Xmas Scan (nmap -sX): Transmits packets with the FIN, PSH, and URG flags illuminated simultaneously (lighting the packet up like a Christmas tree).
  • Null Scan (nmap -sN): Transmits packets with no TCP flags enabled.

[Suricata Rule: Detecting High-Volume Rapid TCP SYN Scans]
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SCAN Potential Rapid TCP SYN Portscan"; \
flags:S; flow:stateless; threshold:type both, track by_src, count 30, seconds 3; \
classtype:attempted-recon; sid:2001211; rev:3;)

---

Man-in-the-Middle (MITM) and Network Redirection Attacks

Man-in-the-Middle (MITM) attacks position an adversary between two communicating endpoints, allowing the attacker to intercept, inspect, modify, or inject traffic.

Address Resolution Protocol (ARP) Poisoning

ARP translates Layer 3 IPv4 addresses into Layer 2 Ethernet MAC addresses. ARP does not authenticate an IP-to-MAC assertion. Host implementations and cache states differ, but many accept or learn from unsolicited ARP messages. An attacker can attempt to poison the local segment by sending forged assertions that associate the attacker's MAC address with the gateway or victim IP, causing traffic to be redirected when the target cache accepts the change.

• SOC Telemetry and Detection: Monitored via network sensors detecting IP-to-MAC mapping flapping (e.g., arpwatch) and NIDS rules flagging duplicate ARP responses. Enterprise access switches mitigate this vector via Dynamic ARP Inspection (DAI), which validates incoming ARP packets against the switch's DHCP Snooping binding table and drops unauthorized mappings at the physical switch port.

DNS Spoofing and LLMNR/NBT-NS Poisoning

• DNS Cache Poisoning: Involves injecting fabricated DNS mapping records into recursive DNS resolver caches (exploiting predictable transaction IDs or unauthenticated UDP responses), redirecting enterprise users to malicious servers.
• LLMNR / NBT-NS Poisoning: When Windows clients fail to resolve a hostname via DNS, they broadcast queries over Link-Local Multicast Name Resolution (LLMNR - UDP 5355) and NetBIOS Name Service (NBT-NS - UDP 137). Attackers running tools like Responder answer these broadcasts, claiming ownership of the requested resource. The client attempts authentication by transmitting NetNTLMv1/v2 challenge-response hashes, which the attacker captures for offline cracking or relays directly to other domain hosts via SMB relay attacks.

SSL/TLS Stripping

Popularized by tools such as sslstrip, this technique transparently converts secure HTTPS connections into plaintext HTTP. When a client requests an unencrypted webpage or is redirected via HTTP 301/302 redirects to HTTPS, the attacker intercepts the traffic, establishes a valid HTTPS session with the legitimate remote server, and proxies the page back to the victim over standard HTTP. The victim's browser displays unencrypted HTTP, exposing credentials and session tokens.

• Defensive Engineering: Enforcing HTTP Strict Transport Security (HSTS) with the includeSubDomains and preload directives. For a correctly matched preloaded domain, a conforming browser knows to require HTTPS before the first network request, blocking the downgrade path. HSTS effectiveness still depends on hostname coverage, browser support and state, certificate validation, and the absence of a compromised endpoint or trusted certificate authority.

---

Password Attack Methodologies and Authentication Telemetry

Credential compromise represents the most prevalent initial access and privilege escalation mechanism observed in enterprise security operations.

Windows Security Event Log Telemetry

SOC analysts must differentiate between standard user error and automated credential attacks by analyzing Windows Security Event Log IDs and their associated sub-status hexadecimal error codes:

• Event ID 4624 (Successful Logon): Contains the Logon Type:
  • Logon Type 2: Interactive (physical console login).
  • Logon Type 3: Network (accessing shared folders, SMB, or remote services).
  • Logon Type 10: RemoteInteractive (Terminal Services, Remote Desktop Protocol / RDP).
• Event ID 4625 (Failed Logon): Provides vital diagnostic sub-status codes:
  • 0xC000006A: User name is valid, but the password entered was incorrect (indicates targeted password brute-forcing or password spraying).
  • 0xC0000064: The user account specified does not exist (indicates username enumeration or indiscriminate credential stuffing).
  • 0xC0000234: The user account is locked out due to exceeding the maximum failed attempt threshold.
  • 0xC0000072: The user account is currently disabled.
• Event ID 4740: A user account was locked out by the Active Directory Domain Controller.
• Event ID 4776: The Domain Controller attempted to validate credentials for an account using NTLM authentication.

---

Denial of Service (DoS) and Distributed Denial of Service (DDoS)

Denial of Service attacks target the Availability pillar of the CIA triad, aiming to disrupt business operations by overwhelming network bandwidth, consuming operating system connection state tables, or exhausting application worker threads.

1. Volumetric Reflection and Amplification Floods (Layer 3/4)

Volumetric attacks overwhelm inbound network transit circuits by transmitting spoofed requests to publicly accessible UDP services. Because UDP is stateless, reflectors send unrequested response packets directly to the spoofed victim IP address:

• NTP Amplification: Attackers issue the monlist command (querying the last 600 IP addresses that interacted with the NTP daemon). This produces an amplification factor of approximately 556:1, transforming a 1 Gbps attack stream into over 500 Gbps of outbound traffic.
• DNS Amplification: Attackers issue ANY or TXT queries with DNSSEC extensions enabled to open recursive resolvers. The resulting responses produce amplification factors exceeding 50:1.
• SSDP & Memcached Floods: Vulnerable SSDP (Simple Service Discovery Protocol) and unauthenticated Memcached servers (UDP port 11211) achieve amplification factors reaching up to 50,000:1.

2. Protocol and State Exhaustion Floods (Layer 4)

Protocol attacks consume physical server and stateful network device resources (firewalls, NAT tables, load balancers):

• TCP SYN Flood: The adversary transmits a high volume of SYN packets with spoofed source addresses. The destination host responds with SYN-ACK and allocates memory in its SYN backlog queue while awaiting the final ACK. Because the spoofed source IP never returns an ACK, the connection remains in SYN_RECEIVED state until a timeout occurs, exhausting the backlog queue and blocking legitimate incoming connections.
• SYN Cookie Defense: The host operating system avoids allocating memory in the SYN backlog upon receiving a SYN. Instead, it generates a cryptographically encoded sequence number based on client IP, client port, server IP, server port, and a secret seed. Only when the client returns an ACK containing this sequence number is state memory allocated.

3. Application-Layer Resource Starvation (Layer 7)

Application-layer attacks mimic legitimate user traffic, bypassing volumetric network thresholds:

• Slowloris: The attacker establishes multiple HTTP connections to a web server (e.g., Apache) and transmits partial, incomplete HTTP headers at periodic intervals (e.g., sending X-Header: keep-alive\r\n every 15 seconds) without ever transmitting the terminating double CRLF (\r\n\r\n). The server holds worker threads open indefinitely, exhausting its concurrent connection limit.
• RUDY (R-U-Dead-Yet?): Operates by sending HTTP POST requests with a large Content-Length header, followed by transmitting the request body at an agonizingly slow rate (one byte every few seconds), consuming application thread pools.