Anatomy of a breach
There are a set of frameworks available that describe the typical progression of an adversary when compromising assets. There is, for instance, the Lockheed Martin Kill-Chain, which is quite popular (https://www.lockheedmartin.com/content/dam/lockheed-martin/rms/documents/cyber/LM-White-Paper-Intel-Driven-Defense.pdf).
Over the years, more refined and generic frameworks have also been established, such as the MITRE ATT&CK framework (https://attack.mitre.org), or the Unified Kill Chain (https://www.csacademy.nl/images/scripties/2018/Paul-Pols---The-Unified-Kill-Chain.pdf).
The kill chain as defined by Lockheed Martin does have some limitations and only models a subset of adversaries. Later in the book we will do a more in-depth analysis and see how these frameworks can help you build strategies for your operations and cyber defense.
Not following any of these frameworks in particular, let's discuss the anatomy of a possible breach that a red team...
