10
Técnicas válidas
8
Fases kill-chain
2
Choke points
3
Riesgos críticos
3
Crown jewels
0
Violaciones scope
Crown Jewels — Objetivos de alto valor
Domain Controller
AD DS on-prem · 3 servidores · NTDS.dit
RDS PostgreSQL
BD transacciones de pago · PCI-DSS scope
S3 finlayer-payments-prod
Tokens de tarjeta · Cifrado KMS · AWS
Kill-Chain — Fases de ejecución
01
Initial Access
T1566
T1190
T1078
02
Execution
T1059
03
Persistence
T1053
04
Priv. Escalation
T1068
05
Cred. Access
T1003
06
Lateral Movement
T1021
07
Collection
T1530
08
Exfiltration
T1048
Plan de ataque detallado — Técnicas MITRE ATT&CK
10 técnicas / 8 fases
1
Initial Access
TA0001
| ID | Técnica | Riesgo detección | Effort score | Prerrequisitos |
|---|---|---|---|---|
| T1190 | Exploit Public-Facing Application | 0.500 | ||
| T1566 | Phishing | 0.400 | ||
| T1078 | Valid Accounts | 0.300 |
2
Execution
TA0002
| ID | Técnica | Riesgo detección | Effort score | Prerrequisitos |
|---|---|---|---|---|
| T1059 | Command and Scripting Interpreter | 1.400 |
3
Persistence
TA0003
| ID | Técnica | Riesgo detección | Effort score | Prerrequisitos |
|---|---|---|---|---|
| T1053 | Scheduled Task / Job | 1.200 |
4
Privilege Escalation — CHOKE POINT
TA0004
| ID | Técnica | Riesgo detección | Effort score | Prerrequisitos |
|---|---|---|---|---|
| T1068 | Exploitation for Privilege Escalation ⚡ CHOKE | 1.600 |
5
Credential Access — CHOKE POINT CRÍTICO
TA0006
| ID | Técnica | Riesgo detección | Effort score | Prerrequisitos |
|---|---|---|---|---|
| T1003 | OS Credential Dumping ⚡ CHOKE | 2.700 |
6
Lateral Movement
TA0008
| ID | Técnica | Riesgo detección | Effort score | Prerrequisitos |
|---|---|---|---|---|
| T1021 | Remote Services | 1.800 |
7
Collection
TA0009
| ID | Técnica | Riesgo detección | Effort score | Prerrequisitos |
|---|---|---|---|---|
| T1530 | Data from Cloud Storage (S3) | 0.800 |
8
Exfiltration
TA0010
| ID | Técnica | Riesgo detección | Effort score | Prerrequisitos |
|---|---|---|---|---|
| T1048 | Exfiltration Over Alternative Protocol | 1.500 |
Ruta de ataque principal — Path of least resistance
External → Crown Jewels (Domain Controller + S3)
external
└─ T1566 (Phishing) → initial_access
└─ T1059 (Command Interpreter) → execution
└─ T1053 (Scheduled Task) → persistence
└─ T1068 (Priv. Escalation) → privilege_escalation ⚡ CHOKE POINT
└─ T1003 (Credential Dump) → credential_access ⚡ CHOKE POINT
└─ T1021 (Remote Services) → lateral_movement
├─ T1530 (S3 Data) → collection → T1048 exfiltration
└─ → Crown Jewel: Domain Controller + S3 finlayer-payments-prod
Choke Points — Prioridades de detección
2 identificados
T1068
Exploitation for Privilege Escalation
Privilege Escalation · TA0004
Bloquear esta técnica interrumpe la kill-chain descendente. Objetivo prioritario de hardening.
→ T1003
T1003
OS Credential Dumping
Credential Access · TA0006
Bloquear esta técnica interrumpe la kill-chain descendente. Objetivo prioritario de hardening.
→ T1021
Riesgos OPSEC
6 ítems
Critical
Infrastructure reuse across engagements
Provision fresh C2 infrastructure per engagement; never reuse domains or IPs
Critical
Credential dumping without EDR bypass
Assess EDR coverage before credential dumping; use protected-mode aware approaches
Critical
Operating outside authorized time window
Confirm maintenance and testing windows with client before operational phases
High
Known tool signatures in memory or on disk
Use custom-compiled tools or obfuscated variants; avoid default Cobalt Strike profiles
High
Large data transfer without staging
Stage data locally, compress and encrypt before exfil; avoid single large transfers
Medium
Leaving artifacts in temp directories
Clean up all dropped files and created accounts before disengaging
Autorizaciones requeridas — Checklist pre-engagement
✓
Signed Rules of Engagement (RoE) document — firmado 01 Jun 2026
✓
Written executive/CISO authorization — María González, FinLayer CISO
✓
Defined scope and out-of-scope assets list — excluidos sistemas de clientes finales
✓
Emergency stop contact and escalation path — SOC FinLayer: +34 91 xxx xxxx
✓
Deconfliction process with SOC/Blue Team — notificación 15 min antes de T1003 y T1068
✓
Written authorization for credential capture and handling procedures — PCI-DSS data handling agreement adjunto