[Handling and Responding to Malware Incidents] Malicious Micky has moved from the delivery stage to the exploitation stage of the kill chain. This…

When malware moves from the delivery stage to the exploitation stage in the cyber kill chain, its

objective often shifts to identifying exploitable vulnerabilities within the targeted system. A port scan

is a technique used to discover services that are listening on ports within a system. By scanning the

system's ports, the malware can identify open ports and the services running on them, providing

valuable information about potential entry points for further exploitation. This type of

reconnaissance attack is aimed at gathering intelligence on the target system's network services,

which can then be reported back to a command and control center for further malicious activity

planning.

Port scanning is more relevant than IP range sweeps, packet sniffing, or session hijacking for

identifying useful services on a system because it directly targets the discovery of accessible network

services and their corresponding ports. While the other methods can also be part of the

reconnaissance phase, they serve different purposes: IP range sweeps aim to identify active IP

addresses, packet sniffing intercepts data packets to gather information, and session hijacking

involves taking over a valid user session. In contrast, port scanning is specifically designed to

enumerate services that could be exploited.

Reference:The ECIH v3 certification materials discuss various reconnaissance techniques used by

attackers, including port scanning, as part of the exploitation stage of the kill chain. Understanding

these techniques is crucial for incident handlers in identifying how attackers gather information and

plan their attacks.