Helpful first: Threat, vulnerability, and risk: the core equation · Logs, alerts, and evidence: why an alert title is a hypothesis, not proof
Key points
- Name the stages an intrusion usually passes through, from initial access to impact
- Explain why malware is a tool used at one stage and ransomware is one kind of impact
- Place an observed event on the timeline and state which earlier stages it implies
- Identify one defender-controlled condition that each stage depends on
Eleven hours before the ransom note
This is a synthetic case. On Monday at 16:40, Engineer Kael Cho at Meridian Space & Robotics (chronos.) opens an email that looks like an antenna vendor's maintenance schedule. The attached spreadsheet asks him to enable its macro, a small program stored inside the file. He does, and the macro downloads and runs a second program on his ground-station workstation.
By Tuesday at 04:05, the pass-planning files on the ground-station file server are encrypted and a ransom note is on the screen. Operators cannot load the plan for the 06:00 satellite contact window. The note is the first thing anyone at Meridian sees, but it is the last step of the intrusion.
Most of the attacker's work happened in the eleven hours between those two moments. This lesson walks through that gap, because that is where a defender has room to act.
The stages, in the order they happened
Security teams describe an intrusion as a series of goals the attacker has to reach one after another. MITRE ATT&CK calls these goals tactics, and it catalogs the techniques seen in real intrusions under each one. The table uses ATT&CK tactic names for the Meridian case. Real intrusions skip stages, repeat them, or run them in a different order, so treat the list as a map and not as a script.
Malware is software written to do something the owner of the device did not approve. In this case it appears at the execution stage and keeps working through the control channel. Ransomware is one kind of impact. An intrusion with the same early stages could end in quiet data theft with no note at all.
| Stage | What it means | What happened at Meridian |
|---|---|---|
| Initial access | The attacker gets a first way in. | 16:40. Kael opens the fake maintenance schedule from an outside sender. |
| Execution | Attacker-controlled code runs. | 16:40. The macro downloads and runs a program on the workstation. |
| Persistence and command and control | The code arranges to survive a restart and contacts the attacker for instructions. | 16:41. A scheduled task restarts the program at each sign-in. The workstation starts calling an outside server every few minutes. |
| Credential access and privilege escalation | The attacker collects passwords or tokens and gains more rights. | 22:10. The attacker finds the local administrator password. Every ground-station workstation and server uses the same one. |
| Discovery and lateral movement | The attacker learns the network and moves to other systems. | 01:30. The attacker signs in to the file server, then to the pass-planning server, with that password. |
| Exfiltration | Data is copied out. | 02:50. A contact-schedule export leaves the network. |
| Impact | The attacker changes, destroys, or withholds something the mission needs. | 04:05. Pass-planning files and the network share named Backups are encrypted. |
SORT IT OUT
Threat Hunter Nyx reviews four records from another ground station. Place each record at the stage it most directly shows.
Show the answers
- Persistence. The task exists so the program survives a restart. It also implies earlier stages: something already ran on this workstation.
- Lateral movement. One system is being used to reach another. The attacker must already hold a working credential.
- Initial access. This is an attempt to get a first way in. Nothing in the report shows that code ran or that the password was entered.
- Impact. The mission lost the use of its files. Impact is usually the last stage, so the earlier stages have already happened somewhere.
Every stage needs something you control
The attacker could not reach the next stage without help from Meridian's own setup. The macro ran because the workstation allowed macros in files from the internet. The stolen password worked on the servers because every machine shared it. The move to the pass-planning server succeeded because operator workstations could open administrative connections to servers. The Backups share was encrypted because the compromised account could write to it.
Each of those conditions is a decision a defender can make differently, and other lessons take them in turn. Blocking macros from the internet removes the execution step. Unique local administrator passwords and phishing-resistant sign-in weaken credential access. Separating operator workstations from server administration limits lateral movement. A copy the production account cannot delete limits the impact.
No single control has to be perfect. The attacker must succeed at every stage, and the defender needs to break the chain only once before impact.
Read one event as part of a chain
Each stage also left a record: the mail gateway log, the new scheduled task, the repeated calls to one outside server, the 01:30 administrator sign-in, the large outbound transfer. Any of them could have raised an alert hours before 04:05. Detection is the work of noticing a stage while there are still stages left.
When one of these events appears, place it on the timeline and reason in both directions. A lateral movement record means initial access, execution, and credential access have probably already happened, so the workstation needs attention as well as the server. It also means exfiltration and impact may be next, so the priority is to cut off the attacker's access before investigating every detail.
The record is still evidence, not a verdict. An administrator sign-in at 01:30 could be planned maintenance. Keep the observation, the hypothesis, and the missing fact apart while you check.
CHECK YOUR JUDGMENT