This thesis examines the detection of a multi-stage cyber attack in a Windows environment with a particular focus on the use of PowerShell one-liners as an attack mechanism. The objective of the research was to evaluate to what extent attacks executed through legitimate system tools can be effectively detected using a multi-layered security architecture and mapped to the standardized MITRE ATT&CK framework.
A controlled laboratory environment was established for the case study, consisting of a Kali Linux attacker machine, a Windows 10 workstation, a Windows Server 2019 system, and detection platforms Wazuh (SIEM) and Security Onion (NDR). A comprehensive attack scenario was simulated, including the phases of discovery, credential access, brute-force attack, lateral movement, and remote code execution. All major attack activities were performed using PowerShell one-liners, demonstrating that complex attack chains can be executed without deploying sophisticated malware or exploiting software vulnerabilities.
The results indicate that, with proper SIEM configuration, event correlation, and the integration of host-based and network-based detection mechanisms, individual attack phases can be successfully identified and correlated into a coherent attack chain. The study confirms that detecting attacks based on the abuse of legitimate administrative tools relies primarily on behavioral analysis, appropriate configuration of monitoring systems, and the application of standardized threat models. The findings emphasize that the one-liner approach represents a significant security risk due to its simplicity, portability, and potential for abuse through social engineering techniques.
|
