2022 Attack Path Analysis Report: 94% of Corporate Critical Assets Can Be Compromised in 4 Steps or Less!

The XM Cyber research team analysed 2 million endpoints, files, folders and cloud resources in on-premises, multi-cloud and hybrid environments, carefully studying attack path methods and revealing how attackers leverage them to launch attacks against victims' critical assets.

Key Findings ● Attackers can compromise 94% of critical assets from the initial point of attack in just 4 hops

● Organizations could have 75% of their critical assets compromised in their security posture at the time

● 73% of top attack techniques involve mismanaged or stolen credentials

● 95% of users in an organization have long-term access keys that could be exposed, putting critical assets at risk

● 78% of businesses are potentially compromised whenever a new RCE (Remote Code Execution) technique emerges

● 75% of organizations have externally-facing EC2 machines, posing a risk to critical assets

● Fixing problems can be reduced by 80% if you know where to interrupt the attack path

▌Attack Path Methodology

XM Cyber determines the likelihood of critical asset compromise through two main factors: attack complexity and how many hops an attacker needs to reach a critical asset.

▶ Attack Complexity

Attack path complexity is determined by many factors, including the required prerequisites, duration, access privileges, and the number of steps required for an attacker to get from a vulnerability to a critical asset. At each step in the attack path, the attacker uses a technique to compromise the entity being attacked and leverages that entity to hop to the next entity in the path on the way to the target.

Based on the complexity of the attack path, it is possible to determine how many critical assets in an organization in its current security posture are likely to be compromised:

Before the advent of attack path management, there was no effective way to identify and break key points in the attack chain, and most assets could be compromised. Therefore, enterprises need a clear understanding of the entire environment from an attacker's perspective. Simply monitoring threats and alerts is not enough; it is more important to understand the ins and outs of vulnerabilities in the environment and the attack paths those vulnerabilities provide to attackers. This is achieved through an in-depth analysis of the environment, which is the only way we can identify the steps needed to eliminate or reduce organizational risk.

▶ Number of Hops Required for Asset Compromise

Definition of a Hop — The number of steps an attacker takes from the point of attack to compromising a critical asset. Each hop uses one attack technique.

94% of critical assets are compromised within 4 hops from the initial point of attack.

The vast majority of attacks are not satisfied with reaching just the critical assets of an organization that can be accessed in a single hop. Attackers attempt to chain vulnerabilities together during the network propagation phase to compromise critical assets, and we can leverage attack path management to see their connection techniques and cut them off at critical moments. In just 4 hops, an attacker can compromise 94% of critical assets, and with another hop or two, they can compromise 100%. Remarkably, traditional breach and attack simulation solutions only check a single hop in an isolated attack path, whereas attack path management platforms can simulate all attack paths across the entire environment.

▌What is an Attack Path

To protect assets effectively, organizations must first understand what a critical asset is, which includes virtual servers, data, capabilities, or other categories of technology assets owned by the enterprise. Attack path management technology allows organizations to easily and accurately see how attackers assemble chains of vulnerabilities from an initial attack point to form attack paths that threaten critical assets.

▶ Attack Vectors

An attack vector is a method used by cyber attackers to compromise a system. Although terms are sometimes used interchangeably, an attack vector should not be confused with an attack surface, which is generally defined as every possible point where an attacker can attempt to enter a network or system.

An attack path is a visual representation of the chain of events that occurs when an attack vector is exploited. In this sense, the attack vector acts as the gateway, while the attack path is the map showing how the attacker got through the door and where they went once inside.

Malware, ransomware, or phishing are common attack vectors. Although cloud attack vectors can be used to target security vulnerabilities in networks or systems, vectors can also be used to exploit human error.

Attackers often exploit multiple vectors when conducting an attack. Combining multiple attack techniques creates an attack vector; combining multiple attack vectors creates an attack path. Importantly, even if the threat of an attack vector has been mitigated, it must be recognized that it exists. For example, if you are not aware that passwords are available on the dark web, even the strongest password won't help, and it will eventually be exploited by an attacker against you. The uniqueness of an attack path management platform lies in its ability to generate combinations of many different attack techniques to create a single attack stream, so the actual number of attack techniques is much larger.

Example: How attack techniques are combined to form attack vectors

1. Select and use one of a variety of credential harvesting techniques

2. Infect Office files using file infection techniques

3. Use Office exploit techniques to obtain NTLM SSP

4. Relay this credential and compromise the asset using relay techniques (such as NTLM)

Example of an attack vector

Each of the above steps can be replaced with other techniques. Many attack techniques have been mapped and aligned with MITRE's Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) framework.

▌Top Attack Techniques of 2021

Each cloud provider has its own distinct and often complex configuration for granting access and authorization to services and resources. Mapping out exact roles and appropriate permission levels for each user can be difficult and time-consuming. Permissions within cloud providers are granular and complex, often discouraging a least-privilege approach when developers or operators seek shortcuts or are under time constraints. For example, when creating a custom policy with EC2 instance privileges, authorizing every user who might need access can be time-consuming, whereas granting permissions to an entire group is much faster.

▶ TOP 12 Attack Techniques

• 23.7% Domain Credentials (exploiting compromised credentials, Pass-the-Hash, etc.)

• 14.2% Poison Shared Content (file sharing issues, permissions)

• 10.1% Group Policy Modification (Domain Controller compromise, abusing Group Policy)

• 9.5% Local Credentials

• 8.1% PrintNightmare Vulnerability

• 7.2% Credential Relaying (Relaying Attack Family)

• 6% Exe Share Hooking (permissions of executable files)

• 5.6% Microsoft SQL Credentials

• 4.7% WPAD Spoofing (Man-in-the-Middle technique)

• 4.2% Accessibility (network segmentation issues)

• 3.9% Credential Dumping

• 2.8% Azure Run Command on Virtual Machines

73% of top techniques involve mismanaged or stolen credentials, and 27% of top techniques involve vulnerabilities or misconfigurations. Strong patch management reduces attack vectors and prevents exploitation. Furthermore, by using security features built into the operating system itself, such as user authentication, a large number of attack vectors exploiting various credential issues can be prevented. Organizations should not focus solely on vulnerabilities; it is a mistake to think that patching CVEs will solve everything and stop lateral movement. Research shows that nearly 30% of attackers exploit misconfigurations and credentials to compromise and threaten organizations. Vulnerabilities come and go and are easy to patch; credentials stay, but are harder to resolve. The main attack vectors in the cloud are misconfigurations and excessive access authorizations, which attackers can exploit to gain access to critical assets. Attack path management can help identify risks that combine to authorize attacker access to the cloud.

▌How to Eliminate Risk at Critical Moments

A key way to prioritize security team efforts is to identify where attack paths converge on critical assets and focus remediation efforts there. Cyber attack path management platforms help organizations cut them off at critical moments by discovering hidden attack paths to critical assets in cloud and on-premises environments, eliminating risk with minimal effort. Security teams can avoid the severe disconnect of receiving endless alerts without being able to see which exposures pose the greatest risk, how they can be combined and leveraged by attackers, or how to eliminate the risk effectively.

Across nearly 2 million researched entities, an average of only 5 entities pose a risk to nearly 58% of critical assets.

By directing different resources to resolve individual pain points, organizations can quickly reduce overall risk and the number of potential attack paths. Securin validation can help enterprises take the most streamlined investment measures to achieve optimal defense against risks.

▌New Attack Techniques Used in 2021

The new attack techniques used in 2021 reveal the scope of the attack surface and how Advanced Persistent Threats (APTs) are used. APT attacks often combine multiple techniques to compromise a target.

The XM Cyber research team took all attack techniques and grouped them into three categories: Cloud techniques, Remote Code Execution (RCE), and techniques that combine Cloud and RCE attacks, to understand the impact on victim organizations.

32% of organizations are threatened by new cloud techniques, 78% by new RCE techniques, and 90% by a combination of new cloud and RCE attacks.

These are the techniques that organizations need to focus on and work to eliminate in their environments. When a new RCE technique emerges, nearly 80% of organizations are potentially compromised, and when combined with cloud techniques in an attack path, 90% of organizations could be compromised due to their current security posture. If so many vulnerabilities can be easily exploited, an organization's patch management must be substandard and ineffective.

Despite such high success rates, attack paths are not unstoppable. In the face of these issues, Securin validation can help you simulate these top attack techniques to verify if your security products can detect or block these attacks.

▶ Example of Validation Process

Select the attack technique you want to simulate in the Securin validation console, then click "Run", select the target agent for execution, and click "Execute Now" — simple, safe, and easily completes the first step.

Soon you will see its execution results in the "Task Status":

Click on the task name to view detailed information. If it is detected or blocked by your security product, it will be displayed; otherwise, it will prompt you that there are no security events.

You can choose to run a series of scenarios related to credential passing, stealing, bypassing, etc., to verify whether your security defenses are effective against all of them.

By understanding where to interrupt the attack path, the problems that need to be fixed can be reduced by 80%.

80% of enterprises have security issues to some extent, but they may not actually be at risk or under attack. Yet security teams still focus time and resources on fixing these issues, resulting in a lot of waste and failing to focus the security team's energy on what really matters.

Understanding attack paths, attack vectors, and minimizing risk through attack path management is a top priority for security teams. What cannot be seen is difficult to defend against, so visualization of the attack path is of great significance. It helps enterprises discover risk paths and security resource utilization, enabling effective reallocation of resources to protect the enterprise's critical assets. The Securin Security Metric Validation Platform runs simulation scenarios continuously and safely around the clock against the latest threats, helping customers identify weak spots in defense along the attack path, saving analyst costs, and achieving maximized defense results at the lowest cost.

Reference Source:

https://info.xmcyber.com/hubfs/Attack%20Path%20Management%20Impact%20Report%202022%20_XM%20Cyber.pdf