After cramming all the suitcases and vacation accoutrements into the trunk, you sit in the driver’s seat, buckle up, and type your destination into your phone’s map app. Your app tells you the different highways and roads to travel, as well as the distances between turns. When faced with unexpected traffic, the map finds you a new route so that you can still arrive at your desired end point.
Similarly, attackers typically move across an organization’s attack surface, using technical vulnerabilities, compromised credentials, misconfigurations, and trust relationships as the start of their journey. Then, they find ways to evade the organization’s security alerts before engaging in reconnaissance to understand the broader environment.
Attack path mapping connects the individual activities to show how an attacker travels through the environment, similar to how a GPS app shows how to get from a starting location to a destination. By visualizing each attack path starting with the initial foothold to an organization’s critical assets, security teams can investigate incidents faster and reduce impact more efficiently.
What Is Attack Path Mapping?
Attack path mapping is the process of identifying and visualizing the routes that attackers can use to move from an initial point of access through an IT environment to critical systems or data. An attack path shows how a malicious user can progress from an initial entry point by exploiting security weaknesses then reach sensitive systems or data using attacker activities.
While some approaches independently evaluate security findings, attack path analysis correlates interactions across:
- Vulnerabilities and misconfigurations
- User and service account permissions
- Network connections
- Trust relationships
- Identity activity
By connecting these relationships into attack graphs, security teams can understand how one compromised asset or account might provide access to another and identify the paths that pose the greatest business risk.
What Is an Attack Path?
An attack path is the sequence of interconnected steps that an attacker takes or can take from the initial point of access to the target. Each step represents a relationship or weakness that enables further access, like:
- Compromised credentials
- Excessive permissions
- Vulnerable systems
- Insecure network connections
How Does Attack Path Mapping Work?
Attack path mapping combines asset, identity and access management (IAM), vulnerability, permission, and network relationship data to identify the routes that attackers can use to move through an environment. When security teams can add context to these relationships, they can engage in an attack path analysis that enables them to understand how malicious actors can connect the individual weaknesses to form the attack path, also called an adversary chain, to travel from the initial access point to the final destination.
Identify Assets, Identities, and Relationships
Attack path mapping starts by identifying the resources and relationships that make up the attack surface. These can include:
- Systems
- Applications
- Cloud services
- Vulnerabilities
- Exposed services
- User accounts
- Services accounts
- Non-human identities
- IAM roles
For example, if attackers obtain the credentials for an account with excessive permissions, they might be able to access a cloud workload, assume another role, or reach resources that would otherwise be inaccessible.
Correlate Security Activity Across the Attack Path
Mapping possible routes only provides hypotheses about where attackers could go. When security teams correlate these possibilities against security telemetry they can determine what actually happens.
Some examples of the evidence of attacker behavior include:
- Authentication events
- Network activity
- Application and system logs
- Security alerts
- Threat intelligence
By connecting these signals, analysts build the context necessary for identifying activities like credential theft, privilege escalation, and lateral movement.
Visualize Attack Paths and Adversary Chains
When security teams represent these relationships as attack graphs, the assets and identities are nodes while their relationships to one another show the routes an attacker could follow. An attack path might show a malicious actor gaining access from an exposed system using a compromised identity then elevating privileges to move laterally before reaching the target, sensitive data and critical systems.
Security teams can use frameworks like MITRE ATT&CK to add context by associating activity along the adversary chain with known attacker tactics and techniques. By combining visualization and security telemetry, analysts can understand both the potential attack path and the activity occurring along it.
Why Is Attack Path Mapping Important?
When security teams use attack path mapping, they gain context that helps them better their environment’s risk level. For example, a critical vulnerability may not pose a high risk if attackers are unable to reach it from the public internet. Meanwhile, a low-severity vulnerability can be a high business risk if attackers can use it as an initial access point to reach critical assets.
Add Context to Security Alerts
Attack path mapping correlates security alerts based on individual events or behaviors so analysts can identify the relationships between them. This context helps teams distinguish between isolated suspicious activity and events that fit within the broader adversary chain that might indicate an attacker progressing towards sensitive systems.
Identify Lateral Movement and Privilege Escalation
Typically, attackers gain initial access through accounts with standard access by using stolen credentials or compromising unmonitored service accounts. Once they have a foothold, they exploit privilege gaps and abuse trust relationships to gain additional access.
Security teams can use attack path mapping to identify where privilege escalation and lateral movement are likely, including paths that cross on-premises infrastructure, cloud services, and hybrid cloud environments.
Prioritize Investigation and Incident Response
Vulnerabilities and alerts have different levels of risk. Attack path mapping enables security teams to prioritize incident response by identifying the events and exposures that provide attackers the most viable routes toward critical assets.
By using attack path maps to focus investigations on high-risk activities, analysts can focus investigations on the steps that are most likely to give malicious actors a viable path to critical assets.
Attack Path Mapping Best Practices
To accurately represent how attackers can move through an environment, security teams need current, contextualized security data when designing their attack path maps. By implementing some best practices, security teams can build useful maps that support threat detection, investigation, and response.
Centralize and Normalize Security Telemetry
By collecting and normalizing security telemetry across identities, endpoints, applications, networks, and cloud services, analysts can correlate activity across the environment. Centralized, consistent data reduces visibility gaps that can prevent teams from recognizing relationships between events along an attack path.
When building attack path maps, security teams should consider implementing:
- Cross-source data normalization that maps common information such as usernames, IP addresses, and event types to a consistent schema.
- Centralized search across security telemetry that enables analysts to investigate activity across different systems and historical time periods.
- Flexible data enrichment that adds internal and external context to security events without requiring analysts to manually correlate information across tools.
Add Asset and Vulnerability Context
Security teams can enrich events with information about the users, machines, vulnerabilities, and other assets involved in an attack path. Asset and vulnerability context helps analysts determine whether suspicious activity creates a viable route toward high-value systems and prioritize findings according to business risk.
When building attack path maps, security teams should consider implementing:
- Centralized asset inventories that associate users and machines with security activity so analysts can understand what resources are involved.
- Vulnerability data integrations that enrich assets with known vulnerability information and connect exposure data with observed security activity.
- Asset-based risk scoring that combines asset context, vulnerabilities, and network topology to prioritize activity involving higher-risk resources.
Detect Changes and Anomalies Along Attack Paths
Continuously monitoring activity for behavioral changes can help identify attackers moving through the environment in unexpected ways. Getting alerts for deviations from established behavior enables analysts to improve threat detection by revealing suspicious activity that may not match known indicators or predetermined attack patterns.
When building attack path maps, security teams should consider implementing:
- Baseline-driven anomaly detection that establishes normal behavior from historical activity and identifies meaningful deviations.
- Machine Learning-based detection that continuously analyzes incoming telemetry for unusual behavior and emerging patterns.
- Context-aware anomaly analysis that combines behavioral deviations with information about affected assets and users to help analysts evaluate their significance within the attack path.
Investigate and Respond Across the Complete Attack Path
Security teams should try investigating related activity as a connected adversary chain rather than responding to each security alert independently. By consolidating evidence from across the attack path, incident response teams can establish scope, reconstruct attacker movement, and determine which identities, systems, or vulnerabilities require remediation.
When building attack path maps, security teams should consider implementing:
- Centralized investigation timelines that organize messages, events, anomalies, and other evidence from initial detection through resolution.
- Automated evidence collection that brings related security events and asset information into an investigation as new activity is identified.
- Integrated historical search that enables analysts to pivot from a detected event into earlier and subsequent activity to reconstruct the complete adversary chain.
Graylog: Attack Path Capabilities for Security Teams
Graylog enables security teams to identify and investigate attack paths without adding tools, headcount, or unnecessary complexity. By centralizing and normalizing security telemetry, enriching events with asset and vulnerability context, and applying asset-based risk scoring and anomaly detection, Graylog helps analysts connect individual security events to the broader adversary chain and focus their attention on the activity that poses the greatest risk.
Graylog’s context-rich investigation workflows bring related events, asset information, anomalies, and historical log data together so analysts can follow attacker activity from initial detection across the attack path without manually piecing evidence together across disconnected tools. For security teams, this means less time chasing isolated alerts and more time understanding attacker movement, prioritizing response, and taking action before attackers reach critical assets.
