Anatomy of an attack

A cyber attack is rarely the one dramatic movie moment — it is a chain of small steps, each of which could be stopped on its own. Here a typical compromise is explained in plain language, no jargon required: scroll through and see, at every stage, where the defence takes hold.

Stage 01 · Initial access

The mail that gets through

It does not start with a hack, but with a message. An accounts clerk receives a convincing invoice from a known supplier — same look, plausible subject, only the sender domain is off by one letter. She opens the attachment.

Where it shows

The mail gateway flags a newly registered sender domain and an attachment with macros — a signal that often drowns in the daily flood.

What would have stopped it

Block internet macros by default, detonate attachments in a sandbox, and a team that has learned to pick up the phone when in doubt.

Stage 02 · Execution

The first foothold

The macro quietly pulls in a small loader. No blue screen, no warning — just an inconspicuous process disguising itself as a system service and opening a connection outward. The attacker now has a foot in the door.

Where it shows

The EDR sees an Office program suddenly launch PowerShell and open network connections — behaviour a word processor should never show.

What would have stopped it

Application control that only lets known programs run, and an EDR that automatically isolates the suspicious process chain instead of merely logging it.

Stage 03 · Persistence & privilege escalation

Digging in and climbing up

The loader secures a restart with an autostart entry and hunts for the biggest prize: administrator rights. An unpatched service and some cached credentials are enough — the ordinary user account becomes local, then domain administrator.

Where it shows

Unusual sign-in patterns and access to the memory of the authentication service surface in the logs — if someone correlates and reads them.

What would have stopped it

Consistent patching, separate administrative accounts, and memory protection for credentials (Credential Guard). Fewer rights day to day means less to steal.

Stage 04 · Lateral movement

From one machine to the whole network

With administrator rights the attacker moves sideways: machine to machine, always with valid credentials, always looking like a legitimate admin. He maps the network, finds the file servers, and hides in the normal traffic.

Where it shows

An internal machine suddenly talking to dozens of others stands out against the normal baseline — provided one exists.

What would have stopped it

Network segmentation that stops one device from reaching every other, multi-factor internally too, and a baseline against which deviations become visible.

Stage 05 · Exfiltration & impact

When the data leaves the building

In the end comes the goal: data. The attacker collects, compresses and smuggles it out in small portions through an inconspicuous cloud service — often weeks before anyone notices. Only then follows what makes headlines: encryption, extortion, standstill.

Where it shows

Large outbound transfers to a rarely used destination are the last, clearest signal — the point at which many attacks are finally discovered.

What would have stopped it

Monitor and limit outbound traffic, log access to sensitive data, and keep tested, offline backups — so extortion loses its leverage.

The common thread

No single step was unstoppable on its own. That is the good news: defence does not have to break every attack at the first wall — it only needs enough hurdles that the chain snaps before the data leaves the building. That is all “defence in depth” means.