APT28· Russia

Kill-chain playbook15

1. 01

   reconnaissance

   T1589.001

   Monitor for suspicious Credential gathering activities using Credential gathering tools.

2. 02

   resource-development

   T1583.003

   Monitor for suspicious VPS creations and unusual network traffic.

3. 03

   initial-access

   T1566.001

   Monitor email attachments and educate users against Spearphishing attacks.

4. 04

   execution

   T1059.001

   Restrict PowerShell execution policies and monitor for suspicious scripts.

5. 05

   persistence

   T1547.001

   Monitor Registry Run Keys and Startup Folder modifications.

6. 06

   privilege-escalation

   T1546.015

   Monitor for suspicious modifications to Component Object Model (COM) components.

7. 07

   stealth

   T1564.001

   Use file system monitoring to detect Hidden Files and Directories.

8. 08

   credential-access

   T1003.003T1110.001

   Monitor for NTDS dumping attempts and suspicious password guessing activities.

9. 09

   discovery

   T1083

   Monitor for suspicious File and Directory Discovery activities.

10. 10

    lateral-movement

    T1550.002

    Monitor authentication events to detect suspicious Pass the Hash attacks.

11. 11

    collection

    T1114.002

    Monitor for suspicious Remote Email Collection activities.

12. 12

    command-and-control

    T1090.002

    Monitor network traffic to detect suspicious External Proxy usage.

13. 13

    exfiltration

    T1048.002

    Monitor for suspicious data exfiltration over encrypted non-C2 protocols.

14. 14

    defense-impairment

    T1685.005

    Monitor for suspicious clearing of Windows Event Logs activities.

15. 15

    impact

    T1498

    Harden network services against Network Denial of Service (DoS) attacks.

FAQ2