In House Cyber Range
🔧
1
Social Engineering Attack
Attacker sends convincing phishing email to target victim
What happens:
• Crafted phishing email sent
• Contains malicious PDF attachment
• Appears legitimate to victim
• Targets Windows 10 systems
PDF Exploit
📄
2
Malicious PDF Execution
Victim opens PDF, triggering the malicious payload
Attack sequence:
• PDF exploits system vulnerability
• Meterpreter reverse shell deployed
• Connection established to attacker
• System now compromised
🔍
3
Detection & Monitoring
Security systems detect suspicious activity
Detection tools:
• Wazuh SIEM alerts triggered
• ELK Stack logs anomalies
• Network traffic monitored
• Process execution tracked
🚨
4
Incident Response
Security team responds to contain the threat
Response actions:
• Isolate compromised system
• Terminate meterpreter sessions
• Block malicious PDF/site
• Collect forensic evidence
🛠️
5
Recovery & Prevention
System restored and security enhanced
Recovery steps:
• System cleaned and restored
• Security patches applied
• PDF security controls added
• Staff training conducted
🎮 Controls
Cybersecurity Attack Flow Analysis
Step 1 of 5: Social Engineering Phase
The attack begins when a cybercriminal crafts a convincing phishing email containing a malicious PDF. This PDF is specifically designed to exploit vulnerabilities in Windows 10 systems and establish a reverse meterpreter shell connection back to the attacker's machine.