CKC phase 5: Installation – legal and ethical considerations
In the Installation phase, the attacker solidifies their presence by installing malware on the compromised system – typically, a persistent backdoor or implant. After exploiting a vulnerability and gaining initial access, they want to ensure they don’t lose that access. This could involve installing a remote access trojan, adding new user accounts, or modifying startup scripts so their malware runs on reboot. Essentially, the attacker is establishing persistence. For example, malware might drop copies of itself in multiple directories or schedule tasks to reconnect to the attacker’s server. From a defender’s perspective, the Installation phase is where you might detect unusual changes on systems (new services, odd files, registry changes, etc.) and where endpoint detection and response (EDR) tools can flag suspicious activity.
Legal implications
Unauthorized installation of software...
