Learn cyber attacks, stage by stage
Seven lessons follow the stages of an attack, from the first reconnaissance to the attacker achieving their objective. Each lesson explains one stage, shows how it appears in an attack graph and in MITRE ATT&CK, and then gives you real scenarios to model yourself, with feedback on your graph.
How each lesson works
- Learn the stage: what the attacker is doing, and how defenders respond.
- Study a worked example: a small attack graph you can open and change.
- Task A, what happened: a scenario with all the facts. Model it accurately.
- Task B, what are the options: an open scenario. Map out the routes an attacker could take.
- Check your graph for feedback, compare with a model answer, and email your work to your tutor if asked.
Before you start, it helps to read the attack graph notation guide.
Lessons
| # | Stage | ATT&CK tactics | |
|---|---|---|---|
| 1 | Reconnaissance Learning about the target | Reconnaissance | Start |
| 2 | Weaponisation Preparing the tools and infrastructure | Resource Development | Start |
| 3 | Delivery Getting the attack to the target | Initial Access | Start |
| 4 | Exploitation Making the attack run | Execution, Initial Access | Start |
| 5 | Installation Staying in and gaining control | Persistence, Privilege Escalation, Defense Evasion | Start |
| 6 | Command and control Directing the compromised system | Command and Control | Start |
| 7 | Actions on objectives Achieving the goal | Collection, Exfiltration, Impact | Start |
The stages follow the Lockheed Martin Cyber Kill Chain; the tactics are from MITRE ATT&CK.