Two very different endings
Model both incidents' objectives on one graph, and see which control stopped Incident 2.
Course › Lesson 7 of 7
Actions on Objectives
Actions on objectives is what the attacker was actually after. It's defined by motive, not just capability, so the same foothold means very different things to different actors. In the Westfield case study, the same stolen credentials led to a completed dark-web sale and a blocked attempt to steal research data.
The case study. This lesson uses the University of Westfield master case study from Cyber Security Fundamentals. If you've followed the earlier lessons you'll recognise the attack; each lesson looks at one stage of it.
What actions on objectives is
This final stage is the attacker achieving their goal: stealing or selling data, encrypting systems for ransom, disrupting a service, or reaching a specific target. It spans ATT&CK's Collection, Exfiltration and Impact tactics. What the attacker does here depends entirely on who they are and what they want.
In the Westfield attack
The two incidents began from the same stolen credentials but ended completely differently. LedgerWraith listed the credentials on a dark-web marketplace and sold the batch for Monero: a completed objective the university could do little about after the fact. QUIETPIVOT used its elevated access to move through the Joint Learning Portal and try to reach the Anonymised Research Data Store, but the attempt failed because that store required MFA, and the repeated failures were logged and flagged.
This stage in ATT&CK
| Code | Technique | In this case study |
|---|---|---|
T1657 | Financial Theft | LedgerWraith selling the credentials |
T1550.001 | Use Alternate Authentication Material: App Access Token | Moving via the federated identity |
T1021 | Remote Services | Reaching for the research data store |
T1213 | Data from Information Repositories | (Task B) copying research data |
T1486 | Data Encrypted for Impact | (Task B) ransomware |
Hover over any code in the builder to see ATT&CK's own description.
Defending against this stage
Defence at this stage depends on the objective. The blocked data theft shows controls working: M1032 Multi-factor Authentication and M1030 Network Segmentation kept the research data store out of reach even after the attacker had admin rights elsewhere. The completed sale shows the opposite: once credentials are on a dark-web market, only password resets and monitoring remain, so prevention had to happen earlier in the chain. This is why the whole kill chain matters: some objectives can only be stopped at the objective, and others only long before it.
Worked example
Your tasks
Each task opens in the builder with the scenario beside your graph. Build your graph, press Check my graph for feedback as often as you like, then compare with the model answer. Your work on each task is saved in your browser.
What would they want?
Map the different objectives different actors might pursue from the same stolen credentials.
When you've finished, you can send your graph and its activity log to your tutor with Email to tutor in the builder.