Mnemosyne: An Effective and Efficient Postmortem Watering Hole Attack Investigation System

Advanced Persistent Threats based on Supply Chain Vulnerabilities: Challenges, Solutions and Future Directions

“…The work in [10] extracted causal dependencies within alerts generated by EDR systems to reconstruct attacks. The authors of [32] collected causality logs from browsers' execution history to detect watering hole attacks. Additionally, the study [9] correlated provenance from individual hosts to create an enterprise-wide causal graph for locating APTs at the enterprise level.…”

“…To detect complex watering hole attacks, which are common in the initial stage of APT attacks, the authors developed MNEMOSYNE [32], a postmortem forensic analysis engine. MNEMOSYNE accurately reconstructs, investigates, and assesses the ramifications of watering hole attacks with little modification to the browser.…”

“…Watering Hole (WH) This method bears semblance to a trap wherein frequently visited websites or platforms by targets are compromised [32]. The objective of attackers utilizing this technique is to exploit the trust relationship between visitors and these compromised websites.…”

“…For the C2, it provides traffic encryption or obfuscation and can perplex defenders by communicating with compromised legitimate web services. Additionally, it serves as a crucial component for launching watering hole attacks [32]. The HB technique, previously detailed in part III of section II, is utilized in communication scenarios for maintaining persistent access to the target's website by the adversary.…”

An Exploratory Study of Cognitive Sciences Applied to Cybersecurity

“…[44][45][46] Cybercrime Criminal activity either targets or uses a computer, a computer network, or a networked device. [47,48] Malware Malicious software designed to infiltrate a device without knowledge [49,50] DDoS Denial of service attack on a computer system or network that causes a service or resource tobe inaccessible to legitimate users [51][52][53][54][55] Ransomware A type of malicious program that restricts access to certain parts of files of the infected operating system and demands a ransom in exchange for removing this restriction [56][57][58][59][60] Mobile malware Its name suggests malicious software that targets explicitly the operating systems on mobile phones [61][62][63][64] Watering hole Refers to a tactic used during targeted attack campaigns where the APT is distributed through a trusted website that is usually visited by employees of the target company or entity [65,66] We contrasted this result with an international organization related to cybersecurity. We found that some of them were considered the most relevant cyberattacks in the year 2020, according to The European Union Agency for Cybersecurity (ENISA) [34].…”