ES0.2 Modern Attack Chains on Endpoints

How a modern attack chain flows through the endpoint

Understanding endpoint security controls requires understanding what they defend against. A modern targeted attack against an M365 E5 environment with default endpoint security settings follows a predictable chain, and each phase exploits a specific gap in the unconfigured stack.

Phase 1: Initial Access. The attack starts with a phishing email containing either a malicious attachment (macro-enabled document, HTML smuggling payload, ISO/IMG container with embedded LNK) or a link to an adversary-controlled credential harvesting page. At NE, CHAIN-HARVEST used an AiTM phishing page. CHAIN-ENDPOINT used an HTML smuggling payload that delivered an ISO file. The endpoint security controls that interrupt initial access include: ASR rules (blocking Office applications from creating child processes, blocking JavaScript/VBScript from launching downloaded content), network protection (blocking connections to known malicious domains), and SmartScreen (blocking downloads from untrusted sources). At NE, none of these were in block mode. The phishing payload executed without prevention-layer interference.

Phase 2: Execution. The payload runs on the endpoint. For CHAIN-ENDPOINT, the user mounted the ISO file (bypassing Mark of the Web, since files inside ISO containers do not inherit the Zone.Identifier ADS), double-clicked the LNK file inside, which launched mshta.exe to execute an HTA payload, which in turn launched PowerShell with an encoded command that downloaded and executed the Cobalt Strike stager in memory. Four LOLBins in sequence (explorer → mshta → PowerShell → rundll32), zero standalone executables on disk. The controls that interrupt execution include: ASR rules (blocking Win32 API calls from Office macros, blocking execution of potentially obfuscated scripts), AMSI (scanning script content before execution), AV cloud protection (cloud-side analysis of the PowerShell behavior), and WDAC (blocking unsigned or untrusted executables). At NE, AMSI was enabled (default) and caught the simplest obfuscation — but the stager used a reflection-based AMSI bypass that patched amsi.dll in memory before loading the actual payload.

The defense-in-depth reality

The attack chain illustrates a principle that is foundational to this course: no single control prevents a complete attack. Each defensive layer interrupts one or two phases of the chain. If that layer is missing or misconfigured, the attack proceeds to the next phase. The endpoint security architecture must provide coverage across all phases — and the coverage must be validated, not assumed.

ASR rules are the most impactful prevention control because they interrupt the earliest phases (initial access, execution, credential access). But ASR rules that sit in audit mode provide zero prevention — they generate log entries that nobody reads while the attack chain completes. EDR provides the broadest detection coverage across all phases, but only if someone writes the custom detection rules that catch the specific patterns. Default MDE alerts cover known commodity malware patterns. The custom detections that catch targeted attacks using organisation-specific patterns must be engineered.

The engineering question for each control is not “does this control exist?” but three questions: what does it actually block (not what the documentation claims), what breaks when you enable it (the blast radius), and how do you validate it is working (the test)? These three questions are the framework this course applies to every endpoint security control across all 16 modules.

Real-world attack chain examples mapped to endpoint controls

Commodity ransomware (Emotet → Cobalt Strike → Conti). Initial access: phishing email with macro-enabled document. Execution: Word launches PowerShell via macro. Persistence: scheduled task created by PowerShell. Lateral movement: Cobalt Strike uses PsExec to deploy Conti to additional endpoints. Objective: Conti encrypts files on all reached systems. Interception points: ASR “Block Office from creating child processes” prevents the Word→PowerShell chain. If that fails, ASR “Block credential stealing from LSASS” prevents the credential dump that enables lateral movement. If that fails, Controlled Folder Access prevents the ransomware from encrypting protected directories. Three independent interception opportunities — but only if all three controls are in block mode.

Business email compromise via AiTM. Initial access: AiTM phishing page captures session token. This phase occurs entirely in the cloud — endpoint controls do not intercept token theft at the authentication layer. The endpoint becomes relevant when the attacker uses the stolen session to access mailbox content from a new device. Interception points: device compliance policies requiring compliant devices for mailbox access (the attacker’s device is not enrolled in Intune, so conditional access blocks mailbox access from non-compliant devices). If compliance is not enforced, EDR detects the anomalous logon event from a new device accessing the mailbox.

Supply chain compromise (SolarWinds-style). Initial access: trusted vendor software update contains backdoor. Execution: the backdoor executes as part of the legitimate update process. The AV cannot block it — the binary is signed by the vendor and delivered through the legitimate update mechanism. Interception points: EDR behavioral analysis detects the updated software making unusual network connections or executing unusual child processes. Custom detection rules that baseline normal behavior for the software and alert on deviations. This is where EDR and custom detections provide value that AV never can — the detection is behavioral, not signature-based.

Troubleshooting

“Our attack chain looks different — we’re not targeted by Cobalt Strike operators.” The specific tools change. The phases do not. Whether the attacker uses Cobalt Strike, Sliver, Brute Ratel, or a custom implant, they still need to execute code, establish persistence, escalate privileges, access credentials, and move laterally. The endpoint security controls that interrupt each phase work regardless of the attacker’s tooling. This course teaches you to defend against the chain, not specific tools.

“We can’t map our environment to ATT&CK — it’s too complex.” You do not need to map every technique. Start with the 10 techniques that appear most frequently in the incidents your industry experiences. MITRE publishes ATT&CK Navigator layers from vendors like CrowdStrike and Mandiant that show the most commonly observed techniques per year. Map those 10 techniques to your current endpoint security controls. The gaps are your engineering priorities. Module ES8 covers this mapping in depth.

“Our red team bypassed all of our endpoint security controls — should we replace MDE?” Red teams bypass controls because the controls are unconfigured, not because the product is inadequate. A red team that bypasses ASR rules in audit mode has proven that audit mode does not prevent attacks — which you already knew. The question is: which ASR rules can move to block mode after audit data analysis? A red team that bypasses EDR has proven that your custom detection rules have gaps — which is valuable feedback for the detection engineering cycle in Module ES8. The red team finding is not “replace the product” — it is “configure the product.”