CEH Domains 1 & 2: Threats, Attack Vectors & Defense

CEH Domains 1 & 2: Threats, Attack Vectors & Defense

Domain 1 covers who attacks, how they get in, and what they use. Domain 2 covers how defenders stop them.

---

Domain 1 - Information Security Threats & Attack Vectors

1.1 Threat Actors

Actors are classified by motivation, resources, and position (overlap is the rule: state actors proxy through criminal crews).

• Nation-state / APT - APT28, APT29, Lazarus, Equation. Long dwell, custom tooling, zero-days, supply-chain reach.
• Organized cybercrime - RaaS affiliates, access brokers, launderers. Highest attack volume.
• Hacktivists - Ideologically driven; defacement, DDoS, leaks.
• Insiders - Malicious, Negligent, Compromised. Pre-authorized access makes them hardest to detect.
• Script kiddies - Downloaded tools, opportunistic, high volume / low success.
• White / gray / black hats - Ethical, ambiguous, and malicious hackers.

Key takeaway: CEH often tests whether you can infer the actor from the technique. Ransomware + double extortion = organized crime. Multi-year stealth in a government = APT. Defacement with a manifesto = hacktivist.

Source: https://www.sophos.com/en-us/cybersecurity-explained/threat-actors Source: https://attack.mitre.org/

1.2 Attack Vectors

A vector is the path an attack travels. CEH lists nine:

Vector	Typical use
Network	Scanning, lateral movement, MitM
Web	XSS, SQLi, SSRF, drive-by downloads
Email	Phishing, spear-phishing, malicious attachments
Physical	Tailgating, USB drops, badge cloning
Social engineering	Pretexting, vishing, baiting
Supply chain	Compromise of trusted software/hardware (see §1.6)
Cloud	Misconfigured S3, IAM abuse, token theft
IoT/OT	Default credentials, unpatched firmware, ICS protocols
Wireless	Rogue AP, evil twin, deauth

Key takeaway: A single intrusion usually chains vectors - e.g., spear-phish → malicious attachment → reverse shell → lateral network movement → cloud credential theft.

Source: https://www.crowdstrike.com/cybersecurity-101/attack-vectors/

1.3 Malware Taxonomy

The CEH expects you to distinguish spread mechanism from payload. The same payload can ride multiple vectors.

• Virus - Attaches to a host file; needs user execution.
• Worm - Self-replicating across a network; no user action (e.g., Stuxnet).
• Trojan - Disguised as legitimate software; user installs it.
• Ransomware - Encrypts or threatens to leak data; modern variants use double extortion.
• Spyware / Keylogger - Silently collects user activity.
• Rootkit - Hides at kernel/hypervisor/firmware; reimage is safer than in-place removal.
• Bootkit - Rootkit variant in the boot sector or UEFI.
• Fileless malware - Lives in memory, abuses PowerShell/WMI; bypasses signature AV (~10× success rate).
• Logic bomb - Triggers on a condition (date, event, account deletion).
• RAT - Persistent remote control; the long-term APT foothold.
• Backdoor - Bypasses normal auth; can be vendor-built or attacker-installed.
• Wiper - Destroys data without recovery (WhisperGate, NotPetya).

Key takeaway: A single sample often combines categories - Stuxnet was worm, virus, and rootkit. On the exam, name the primary category and call out secondary behaviors.

Source: https://www.crowdstrike.com/en-us/cybersecurity-101/malware/types-of-malware/ Source: https://www.cybok.org/wp-content/uploads/Malware__Attack_Technology_issue_1.0.pdf

1.4 Attack Lifecycle - Three Complementary Models

Lockheed Martin Cyber Kill Chain (7 phases) - sequential, intrusion-centric; breaking any phase breaks the attack.

1. Reconnaissance - OSINT on target, employees, tech stack.
2. Weaponization - Pair exploit with payload in a deliverable file.
3. Delivery - Email, web, USB, watering hole.
4. Exploitation - Trigger the vulnerability (zero-day or human).
5. Installation - Implant backdoor/RAT for persistence.
6. Command and Control (C2) - Beacon to attacker infrastructure.
7. Actions on Objectives - Exfiltrate, encrypt, sabotage, pivot.

Key takeaway: Kill Chain is left-of-breach; you may not detect until C2. Push detection as far left as possible.

Source: https://www.lockheedmartin.com/content/dam/lockheed-martin/rms/documents/cyber/LM-White-Paper-Intel-Driven-Defense.pdf

MITRE ATT&CK - post-compromise, behavior-focused. Enterprise has 14 tactics (the “why”), each with techniques (the “how”). In order: Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact. SUNBURST mapped to ~18 techniques including T1195.002 and T1071.001.

Key takeaway: “What is the tactic?” always wants one of these 14 names verbatim. Memorize the order.

Source: https://attack.mitre.org/tactics/enterprise/ Source: https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-352a

Diamond Model - every event has four vertices: Adversary, Capability, Infrastructure, Victim, with Sociopolitical and Technology meta-features. Used for pivoting and campaign clustering.

Key takeaway: Kill Chain = time/sequence. ATT&CK = behavior catalog. Diamond = relationship graph.

Source: https://www.activeresponse.org/wp-content/uploads/2013/07/diamond.pdf

1.5 Emerging Threats (2023-2026)

• AI/ML-powered attacks - Automated recon, polymorphic malware, credential guessing at scale.
• Deepfakes - Voice/video impersonation for vishing and authorization fraud.
• Supply-chain at the maintainer level - see xz-utils below.
• Ransomware as a Service (RaaS) - Affiliate model with dev/operator splits; ALPHV exit-scammed after Change Healthcare.
• Living-off-the-land (LOTL) - PowerShell, WMI, signed Microsoft binaries abused to evade detection.

1.6 Real-World Incidents (2020-2024)

• SolarWinds / SUNBURST (2020) - Russian SVR (APT29) backdoored Orion updates; ~18,000 orgs received the trojanized DLL, signed with SolarWinds’ real cert. 12-14 day dormancy, FNV-1a hash blocklist, DGA-based C2.
• 3CX Desktop App (March 2023) - North Korean UNC4736 chained two supply-chain attacks: trojanized X_TRADER → 3CX employee → trojanized 3CX build → customers. First cascading supply-chain compromise Mandiant documented.
• xz-utils / CVE-2024-3094 (March 2024) - “Jia Tan” spent ~2 years gaining maintainer trust, then injected a CVSS 10.0 backdoor into liblzma for sshd pre-auth RCE. Caught by Andres Freund before reaching stable releases.
• Change Healthcare (Feb 2024) - ALPHV affiliate used stolen credentials on a Citrix portal with no MFA; 9 days of dwell, $22M ransom paid, operator exit-scammed, 190 million people affected (largest U.S. medical breach).

Key takeaway: Three of these are textbook initial-access failures: a trojanized update, a stolen credential, and an MFA-less portal. Defense is not exotic - it’s the basics, done consistently.

Source: https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-352a Source: https://cloud.google.com/blog/topics/threat-intelligence/3cx-software-supply-chain-compromise Source: https://nvd.nist.gov/vuln/detail/CVE-2024-3094 Source: https://www.bleepingcomputer.com/news/security/unitedhealth-says-data-of-100-million-stolen-in-change-healthcare-breach/

---

Domain 2 - Attack Detection, Prevention & Defense Fundamentals

2.1 Foundational Principles

• Defense in depth (DiD) - Layered controls so a single failure is not catastrophic.
• Least privilege - Minimum access needed (NIST AC-6).
• Zero Trust (NIST SP 800-207) - “Never trust, always verify.” Every request authenticated/authorized/logged regardless of network location. Core: Policy Engine (PE), Policy Administrator (PA), Policy Enforcement Point (PEP).
• CIA triad - Confidentiality, Integrity, Availability.

Key takeaway: Zero Trust ≠ VPN replacement. ZT is a per-request access decision based on identity + device posture + context.

Source: https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-207.pdf Source: https://csrc.nist.gov/glossary/term/defense_in_depth

2.2 Defense-in-Depth Layers

1. Perimeter - Firewalls, WAF, DDoS scrubbing, email gateways.
2. Network - Segmentation, NAC, IDS/IPS, jump servers.
3. Host - NGAV, EDR, hardening, CIS baselines.
4. Application - Secure SDLC, WAF, RASP, SAST/DAST.
5. Data - Encryption at rest/in transit, DLP, classification, HSM/KMS.

2.3 Firewalls

• Stateless (packet-filter) - Headers only, no state. Fast, cheap, weak.
• Stateful - Tracks connection state; modern default.
• WAF - Layer 7, inspects HTTP/SQL/XML against OWASP Top 10.
• NGFW - Stateful + DPI + IPS + app awareness + identity. Current enterprise standard.

Source: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-41.pdf

2.4 IDS / IPS

Aspect	NIDS/NIPS (Network)	HIDS/HIPS (Host)
Position	Inline (IPS) or span/tap (IDS)	On the endpoint
Detects	Lateral movement, scans, exfil	File integrity, privesc, local LOTL
Misses	Encrypted payloads (pre-decrypt)	Cross-host correlation
Method	Signature / anomaly / stateful	Same + file/process telemetry

Detection methodologies (NIST SP 800-94):

• Signature-based - Match known IOCs; low FP, blind to novel.
• Anomaly-based - Baseline + deviation; catches zero-day, higher FP.
• Stateful protocol analysis - Validates state machine against vendor profile.

Key takeaway: FP and FN are inversely related - tuning to reduce one raises the other. Tuning is continuous.

Source: https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-94.pdf

2.5 Endpoint Security: NGAV → EDR → XDR

• NGAV - Signature + ML + behavioral + exploit mitigation. Preventive, cloud-managed.
• EDR - Continuous telemetry, behavioral detection, hunting, remote response. NIST SP 800-137 governs.
• XDR - EDR plus email, identity, cloud, network correlated into one incident. Reduces alert fatigue.
• MDR - A service wrapping EDR/XDR with a 24×7 SOC. Not a product.

Key takeaway: NGAV ⊂ EDR ⊂ XDR. Layers, not alternatives. CMMC L2/L3 and NIST 800-171 essentially require EDR-class telemetry.

Source: https://www.crowdstrike.com/en-us/cybersecurity-101/endpoint-security/edr-vs-ngav/ Source: https://www.microsoft.com/en-us/security/business/security-101/edr-vs-xdr

2.6 SIEM and SOAR

• SIEM - Centralizes logs, correlates events, generates alerts. Detection-focused.
• SOAR - Acts on SIEM alerts via playbooks (enrich, isolate host, disable account). Response-focused.

Key takeaway: Per ASD guidance, implement SIEM before SOAR. A SOAR acting on bad SIEM rules is worse than no SOAR.

Source: https://media.defense.gov/2025/May/27/2003722068/-1/-1/0/Implementing-SIEM-and-SOAR-platforms-Executive-guidance.PDF Source: https://www.splunk.com/en_us/blog/learn/siem-vs-soar.html

2.7 Honeypots and Honeynets

• Honeypot - Decoy with no production value; any interaction is suspicious. Generates high-fidelity IOCs.
• Honeynet - A network of honeypots simulating a realistic environment.

Key takeaway: Honeypot data is high-signal because legitimate users never touch it.

2.8 Threat Intelligence & IOC Sharing

• IOC - Atomic: IP, domain, hash, mutex, registry key.
• STIX - OASIS standard, JSON, 18 Domain Objects.
• TAXII - HTTPS RESTful transport for STIX. Collections (pull) + Channels (pub/sub).
• Threat feeds - Commercial (Mandiant, CrowdStrike), governmental (CISA AIS), ISACs (FS-ISAC, H-ISAC).

Source: https://docs.oasis-open.org/cti/stix/v2.1/stix-v2.1.html Source: https://www.gov.uk/government/publications/open-standards-for-government/exchanging-cyber-threat-intelligence

2.9 Segmentation, NAC, Jump Servers

• Segmentation / microsegmentation - Limits lateral movement; aligns with ZT.
• NAC (802.1X) - Posture-checks devices before access.
• Jump server / bastion - Mediated, audited entry to sensitive zones.

2.10 Vulnerability & Patch Management

Standard loop: Identify → Assess → Prioritize → Remediate → Verify → Report. Drive priorities from CISA’s KEV catalog and NIST NVD. Change Healthcare is a textbook Identify failure - an internet-facing portal with no MFA.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

---

Cheat Table

Term	Definition	Exam Tip
APT	Advanced Persistent Threat - long-dwell, state-funded	Multi-year dwell, custom malware, supply-chain reach
Ransomware	Encrypts data + extorts payment	Modern = encryption + leak threat (double extortion)
RAT	Remote Access Trojan - persistent backdoor	Long-term foothold, not one-shot
Fileless malware	Lives in memory, abuses PowerShell/WMI	~10× success of file-based
Kill Chain	7-phase sequential model (Lockheed)	Stop at any phase
ATT&CK Tactic	“Why” - one of 14 in Enterprise	Memorize all 14 names in order
Diamond Model	Adversary × Capability × Infrastructure × Victim	For pivoting, not sequencing
Defense in depth	Layered people/process/tech controls	Single failure ≠ compromise
Zero Trust	Per-request verification, no implicit trust	NIST SP 800-207
Least privilege	Minimum access needed	NIST AC-6
NGFW	Stateful + DPI + IPS + app awareness	Modern enterprise default
WAF	Layer-7 HTTP/SQL protection	OWASP Top 10
NIDS vs HIDS	Network (segment) vs Host (endpoint)	Complementary, not substitutes
Signature detection	Pattern match known IOCs	Blind to zero-day
Anomaly detection	Deviation from statistical baseline	Higher false-positive
Stateful protocol analysis	Validates protocol state machine	Catches evasion/fragmentation
NGAV	ML/behavioral AV (preventive)	First line of defense
EDR	Continuous endpoint telemetry + response	Detective + responsive
XDR	Cross-domain correlation (email, identity, cloud)	Reduces alert fatigue
MDR	24×7 SOC service wrapping EDR/XDR	Service, not product
SIEM	Log centralization + correlation + alerting	Detection layer
SOAR	Playbook-driven response automation	Acts on SIEM alerts
Honeypot	Decoy; interaction is by definition malicious	High-fidelity IOCs
STIX	OASIS standard for CTI objects (JSON)	18 Domain Objects in v2.1
TAXII	HTTPS RESTful transport for STIX	Collections (pull) + Channels (pub/sub)
NAC	Posture-check devices before access (802.1X)	Pre-admission gate
Jump server	Mediated, audited entry to sensitive zones	Reduces direct admin exposure
Patch mgmt	Identify → Assess → Prioritize → Remediate → Verify	CISA KEV + NVD drive priority

---

Sources

1. Lockheed Martin - Intelligence-Driven Computer Network Defense (Kill Chain white paper): https://www.lockheedmartin.com/content/dam/lockheed-martin/rms/documents/cyber/LM-White-Paper-Intel-Driven-Defense.pdf
2. MITRE ATT&CK - Enterprise Tactics: https://attack.mitre.org/tactics/enterprise/
3. Caltagirone, Pendergast, Betz - Diamond Model of Intrusion Analysis (2013): https://www.activeresponse.org/wp-content/uploads/2013/07/diamond.pdf
4. Sophos - Types of Cyber Threat Actors: https://www.sophos.com/en-us/cybersecurity-explained/threat-actors
5. CrowdStrike - 12 Types of Malware: https://www.crowdstrike.com/en-us/cybersecurity-101/malware/types-of-malware/
6. CyBOK - Malware & Attack Technologies KA: https://www.cybok.org/wp-content/uploads/Malware__Attack_Technology_issue_1.0.pdf
7. NIST SP 800-207 - Zero Trust Architecture: https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-207.pdf
8. NIST SP 800-94 - Guide to IDPS: https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-94.pdf
9. NIST CSF 2.0: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
10. CISA - SolarWinds/SUNBURST Advisory AA20-352A: https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-352a
11. Mandiant - 3CX Software Supply Chain Compromise: https://cloud.google.com/blog/topics/threat-intelligence/3cx-software-supply-chain-compromise
12. NIST NVD - CVE-2024-3094 (xz-utils): https://nvd.nist.gov/vuln/detail/CVE-2024-3094
13. BleepingComputer - Change Healthcare / 100M affected: https://www.bleepingcomputer.com/news/security/unitedhealth-says-data-of-100-million-stolen-in-change-healthcare-breach/
14. OASIS - STIX 2.1: https://docs.oasis-open.org/cti/stix/v2.1/stix-v2.1.html
15. UK GOV.UK - STIX/TAXII open standard: https://www.gov.uk/government/publications/open-standards-for-government/exchanging-cyber-threat-intelligence
16. CrowdStrike - EDR vs NGAV: https://www.crowdstrike.com/en-us/cybersecurity-101/endpoint-security/edr-vs-ngav/
17. Microsoft - EDR vs XDR: https://www.microsoft.com/en-us/security/business/security-101/edr-vs-xdr
18. Australian Signals Directorate - SIEM/SOAR Executive Guidance: https://media.defense.gov/2025/May/27/2003722068/-1/-1/0/Implementing-SIEM-and-SOAR-platforms-Executive-guidance.PDF
19. Splunk - SIEM vs SOAR: https://www.splunk.com/en_us/blog/learn/siem-vs-soar.html
20. NIST CSRC - Defense-in-Depth glossary: https://csrc.nist.gov/glossary/term/defense_in_depth