LedgerWraith prepares
Model the five things the attacker set up before the phishing wave.
Course › Lesson 2 of 7
Weaponisation
Before an attacker sends a single email, they build what they need: domains, certificates, tools and accounts. This is weaponisation, and in MITRE ATT&CK it's the Resource Development tactic. In the Westfield case study, it's everything LedgerWraith set up before the phishing wave.
The case study. This lesson uses the University of Westfield master case study from Cyber Security Fundamentals. If you've followed the earlier lessons you'll recognise the attack; each lesson looks at one stage of it.
What weaponisation is
Weaponisation is the attacker assembling capability. It's the second stage of the Cyber Kill Chain, and it maps to ATT&CK's Resource Development tactic. The attacker registers domains, obtains certificates and tools, and sets up accounts and infrastructure, all on their own equipment.
Like reconnaissance, almost none of it touches the target, so the target usually can't see it happening. The difference is that reconnaissance gathers information, while weaponisation builds things.
In the Westfield attack
LedgerWraith registered the look-alike domain westfielduniv.ac.me on a bulletproof host, bought a genuine TLS certificate so the fake site would show a padlock, acquired an off-the-shelf phishing kit, stood up a fake SAP ERP login page, and set up sender accounts. None of it was visible to the university until the emails arrived.
This stage in ATT&CK
| Code | Technique | In this case study |
|---|---|---|
T1583.001 | Acquire Infrastructure: Domains | Registering westfielduniv.ac.me |
T1588.004 | Obtain Capabilities: Digital Certificates | Buying a TLS certificate for the fake site |
T1588.002 | Obtain Capabilities: Tool | Acquiring the commodity phishing kit |
T1608.005 | Stage Capabilities: Link Target | Standing up the fake SAP login page |
T1585.002 | Establish Accounts: Email Accounts | Setting up the sender accounts |
T1586.002 | Compromise Accounts: Email Accounts | (Task B) taking over a partner's mailbox |
Hover over any code in the builder to see ATT&CK's own description.
Defending against this stage
Like reconnaissance, most Resource Development techniques list only M1056 Pre-compromise in ATT&CK, because the activity happens on the attacker's own infrastructure. But defenders aren't blind: newly registered look-alike domains can be monitored (certificate-transparency logs help), and takedown requests can be prepared in advance. Where the attacker compromises a real account to send from, M1017 User Training genuinely helps.
Worked example
Your tasks
Each task opens in the builder with the scenario beside your graph. Build your graph, press Check my graph for feedback as often as you like, then compare with the model answer. Your work on each task is saved in your browser.
A convincing sender
Map the different ways to make a message staff will trust, including compromising a partner's mailbox.
When you've finished, you can send your graph and its activity log to your tutor with Email to tutor in the builder.