A Taxonomy for Threat Actors' Persistence Techniques. Issue 121 (October 2022)

• Record Type: Journal Article
• Authors: Villalón-Huerta, Antonio; Marco-Gisbert, Hector; Ripoll-Ripoll, Ismael
• Is Part Of: Computers & security. Issue 121(2022)
• Publication Date: 2022-10
• Subjects: TTP -- Persistence -- Advanced Persistent Threat -- Malware -- MITRE ATT&CK; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2022.102855
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: The main contribution of this paper is to provide an accurate taxonomy for Persistence techniques, which allows the detection of novel techniques and the identification of appropriate countermeasures. Persistence is a key tactic for advanced offensive cyber operations. The techniques that achieve persistence have been largely analyzed in particular environments, but there is no suitable platform–agnostic model to structure persistence techniques. This lack causes a serious problem in the modeling of activities of advanced threat actors, hindering both their detection and the implementation of countermeasures against their activities. In this paper we analyze previous work in this field and propose a novel taxonomy for persistence techniques based on persistence points, a key concept we introduce in our work as the basis for the proposed taxonomy. Our work will help analysts to identify, classify and detect compromises, significantly reducing the amount of effort needed for these tasks. It follows a logical structure that can be easy to expand and adapt, and it can be directly used in commonly accepted industry standards such as MITRE ATT&CK.