Anatomy of a Cyber Attack

The anatomy of a cyber attack is more consistent than it looks: most intrusions follow a recognizable sequence, even though the specific techniques vary enormously, and the sequence is not rigid, attackers loop back, skip steps, and sometimes achieve their objective in the first hour, and it's still the most useful mental model available for understanding where defense fits.

• Reconnaissance: the attacker learns about the target, such as which services are exposed, who works there, and what technology is in use. Much of this uses public information and produces no signal on your side at all. In MITRE ATT&CK terms the stages below map to the tactics from Reconnaissance (TA0043) through Impact (TA0040).
• Initial access: the attacker gets a first foothold, most often through a stolen credential, a phishing message, or an exposed and unpatched service.
• Execution and persistence: something runs, and the attacker arranges to keep access even if the machine reboots or the password changes.
• Privilege escalation: the attacker acquires more authority than the initial account had.
• Discovery: the attacker maps the environment from inside, finding shares, systems, accounts, and where the valuable data lives.
• Lateral movement: the attacker moves from the first host to others, usually using valid credentials rather than exploits.
• Collection and staging: the data of interest is gathered and prepared, often compressed and moved to a single location first.
• Exfiltration or impact: the data leaves, or the destructive or extortionate action fires.

The time spent in each phase is wildly uneven. Initial access can take seconds. Discovery and lateral movement commonly take days or weeks, and this is where a defender has the most opportunity, because it is the longest phase and the noisiest.

Most attacks start with a valid credential or with a person, not with a technical exploit, that is the single most useful thing to know about attack origins, and it reorders where defensive effort is worth spending.

The common starting points, roughly in order of how often they appear:

• Stolen or purchased credentials: harvested by infostealer malware, reused from an unrelated breach, or bought from a broker who specializes in selling access.
• Phishing and social engineering: including help desk manipulation to reset multi-factor authentication on a targeted account.
• Exploitation of an exposed service: typically an internet-facing remote access appliance, file transfer product, or web application that is unpatched or misconfigured.
• A trusted third party: such as a service provider or a compromised software update.

The defensive implication is uncomfortable for programs organized around malware. An attacker who logs in with a real credential produces no malicious file, triggers no antivirus verdict, and looks like an employee working late. Malware detection does not help here. The controls that address this are identity controls and identity telemetry, meaning phishing-resistant authentication, conditional access, and the ability to detect that a legitimate account is behaving unlike itself.

Initial access is the point at which an attacker first obtains a foothold in an environment. It's the boundary between reconnaissance, which happens outside your systems, and everything else, which happens inside them.

The common initial access techniques are a short list:

• Valid accounts: logging in with credentials the attacker already has.
• Phishing: a message that delivers a payload or harvests credentials.
• Exploiting a public-facing application: attacking something internet-reachable directly.
• External remote services: abusing VPN, remote desktop, or similar access, usually with valid credentials.
• Supply chain compromise: arriving through trusted software or a trusted partner.
• Removable media and physical access: less common in most environments and still relevant in some.

Initial access is different from everything that follows because it is the only phase where the attacker is outside and the only phase where perimeter and identity controls can prevent rather than detect, and once initial access succeeds, the game changes from prevention to detection.

Lateral movement is how an attacker travels from the first system they compromised to the systems they actually want. It is rarely dramatic. Most lateral movement uses legitimate administrative mechanisms with credentials the attacker has stolen — which is precisely why it's hard to detect.

Common methods:

• Remote services with valid credentials: such as remote desktop, SSH, or administrative shares.
• Pass-the-hash and pass-the-ticket: using stolen NTLM hashes or Kerberos tickets from Active Directory without ever knowing the password.
• Remote execution tooling: including built-in administration frameworks that a systems administrator would legitimately use.
• Abusing management platforms: such as configuration management or software deployment systems, which offer reach to many hosts at once.
• Identity provider abuse in cloud environments: such as Microsoft Entra ID or Okta, where movement happens between roles and tenants rather than between hosts.

Lateral movement matters more than almost any other phase for defenders, for two reasons, it is where the attacker spends the most time, and it's where a single detection reveals the whole intrusion rather than one host. Network segmentation, restricting administrative account use, and monitoring authentication patterns between systems are the controls that bite here.

Privilege escalation is the process of gaining more authority than the account you started with. It comes in two forms that are often confused.

Vertical escalation means getting higher privileges on the same system or in the same domain, such as moving from a standard user to a local administrator, or from a domain user to a domain administrator. Horizontal escalation means moving sideways to a different account at a similar level, which is useful when the other account can reach something yours cannot.

The methods that matter most in practice are not usually kernel exploits, despite the attention those receive. They are:

• Credential harvesting from memory or disk: collecting the credentials of anyone who has logged into a compromised host.
• Misconfigured permissions: such as a service account with far more rights than it needs, or a group whose membership has grown for years without review.
• Unpatched local vulnerabilities: which are still common on systems that are patched for internet-facing risk but not for local risk.
• Abuse of legitimate delegation: particularly in cloud environments, where a chain of role assumptions can lead somewhere nobody intended.

The organizational lesson from escalation is that account hygiene is a detection problem as much as a prevention one, and an environment where administrative accounts log into ordinary workstations gives attackers exactly what they need, and that pattern is visible in the logs long before it is exploited.

Data exfiltration is the unauthorized transfer of data out of an environment. It is the objective of a large share of intrusions, and it's generally one of the last things to happen.

Exfiltration is difficult to detect because it looks like normal outbound traffic; that is the whole point of it, and attackers routinely use channels that are already permitted, such as cloud storage services, collaboration platforms, and encrypted web traffic, and they commonly compress and encrypt the data first so that content inspection sees nothing useful.

The signals that do work tend to be about shape rather than content:

• Volume anomalies: an account or host sending far more data than its own history suggests.
• Staging behavior: large archives appearing in unusual locations shortly before the transfer.
• Destination anomalies: traffic to a cloud tenant or service that this organization does not use.
• Access anomalies preceding the transfer: an account reading far more records than its role requires, which is often visible earlier and more clearly than the transfer itself.

Exfiltration is usually easier to catch at the collection stage than at the transfer stage, because collection touches data stores where access patterns are well defined, and transfer hides inside traffic that is permitted by design.

Defender visibility peaks in the middle of an intrusion and collapses at both ends, and that shape explains most of what is otherwise confusing about detection. The stages below are the MITRE ATT&CK tactics read from the defender's side rather than the attacker's.

The pattern is that visibility rises through the middle of the intrusion and falls at both ends. The two blind spots are not equivalent, though. Missing reconnaissance costs almost nothing, since there's little you could have done. Missing collection and exfiltration is expensive, because it is the phase where the harm is actually realized and it is the phase most organizations have the least telemetry for.

If a program's detection strength is concentrated on the endpoint, it is strongest exactly where it already had the best chance, it is weakest on the identity and data layers, which is where modern intrusions increasingly live.

Each stage produces characteristic evidence, and knowing which source carries it turns a coverage conversation from opinion into a checklist.

Read down the "where it lives" column and mark which of those sources you actually collect and retain, and the result is a more honest coverage picture than most maturity assessments produce, and then check retention, because several of these sources are only useful if they go back far enough to cover the beginning of an intrusion you have not found yet.

The source that most often turns out to be missing is data-layer logging. Endpoint and identity telemetry are widely collected. File, object storage, and database access logging frequently aren't, and those are exactly the sources that cover collection and exfiltration.