Implementation of common attack techniques and detection of malicious binaries and executables using machine learning-based detector in Microsoft Windows environment

• Main Author: Ladrido, John Martin M.
• Format: text
• Language: English
• Published: Animo Repository 2021
• Subjects: Malware (Computer software); Computer crimes; Internet fraud; Machine learning; Computers—Access control—Passwords; Electrical and Computer Engineering
• Online Access: https://animorepository.dlsu.edu.ph/etdm_ece/10; https://animorepository.dlsu.edu.ph/context/etdm_ece/article/1006/viewcontent/ladrido2.pdf
• Institution: De La Salle University

In digital networks, the most common goal of cybercriminals is to steal high-privilege credentials or valuable data. By obtaining high-privilege credentials, cybercriminals can easily navigate, destroy, or steal an organization's data, such as bank details, personal data, and intellectual properties. With the advent of information technology and operational technology convergence like the Internet of things (IoT), it becomes more critical on protecting the high-privilege credentials as cybercriminals can have the power to control operational technologies such as industrial control systems (ICS) and supervisory control and data acquisition (SCADA). Unfortunately, even with this information, many organizations are easily susceptible to these attacks, especially manufacturing firms. This thesis presents how cybercriminals from the Internet can utilize malicious payloads and executables to compromise an organization. This thesis’ attack methods emphasize how cybercriminals perform initial compromise, establish a foothold, escalate privileges, and move laterally within the organizations using the compromised or stolen credentials. This thesis also shows how organizations can detect the malicious binaries and executables utilized in the attacks to protect their digital infrastructure from adversaries using (ML) machine learning-based detection. Doing so could help organizations be equipped with proper knowledge in understanding the underlying attack and, at the same time, implement their detection mechanism specific to the cybercriminals attacking their network.