// Anatomy of an attack

An attack is not an event. It is a chain.

Follow a real intrusion end to end —from the phishing email to log wiping— and see, at each phase, what trace it leaves and which tool catches it. Everything links to the arsenal.

7 phasesMITRE ATT&CK mapped12+ tools
01

Delivery — Phishing

ATT&CK · T1566

An email arrives with an attachment or a link. It looks like a known sender; the real path and the authentication tell another story.

Trace it leaves
Received headers SPF / DKIM / DMARC URL / attachment
02

Execution — Macro → PowerShell

ATT&CK · T1059.001

The user opens the attachment. A macro launches powershell -enc <base64> — obfuscated code running in memory.

Trace it leaves
Event 4688 Event 4104 UTF-16LE Base64
03

Command & Control

ATT&CK · T1071

The script downloads the next stage (a download cradle) and starts beaconing to a C2 server. The machine is no longer yours.

Trace it leaves
Sysmon 3 Beaconing IOCs (IP/URL)
04

Persistence

ATT&CK · T1543.003

To survive a reboot, the attacker installs a service or a scheduled task. PsExec, for instance, creates a temporary service.

Trace it leaves
Event 7045 Event 4698
05

Escalation — Credentials

ATT&CK · T1003.001

It dumps LSASS memory to steal hashes and tickets. With admin credentials, the whole domain is within reach.

Trace it leaves
Sysmon 10 Event 4672
06

Lateral movement

ATT&CK · T1021

It hops from machine to machine with PsExec, WMI or RDP, using the stolen credentials until it reaches what it wants.

Trace it leaves
Event 4624 (type 3/10) Event 4648
07

Impact — Exfiltration and anti-forensics

ATT&CK · T1070.001

It steals the data, maybe encrypts, and clears the event logs to cover its tracks. Here you no longer prevent: you respond.

Trace it leaves
Event 1102 (log cleared) Egress spikes

Every phase has its tool.

You have seen the whole chain. Now keep the arsenal at hand to cut it — at whichever phase, the sooner the better.

Explore the arsenal →