APT31· China

Kill-chain playbook11

1. 01

   reconnaissance

   T1598T1598.003

   Monitor email and network traffic to detect Spearphishing Link operations and block suspicious links.

2. 02

   resource-development

   T1583.006T1584.008

   Analyze network inventory and web traffic to identify suspicious web services and network devices.

3. 03

   initial-access

   T1566.002

   Implement user education and email filtering to mitigate Spearphishing Link attacks and block suspicious links.

4. 04

   execution

   T1059.003T1059.006

   Implement endpoint logging and process monitoring to detect suspicious Windows Command Shell and Python activity.

5. 05

   persistence

   T1547.001

   Monitor Registry Run Keys and Startup Folder changes and remove suspicious entries.

6. 06

   privilege-escalation

   T1068

   Update systems and implement vulnerability management to mitigate Exploitation for Privilege Escalation attacks.

7. 07

   stealth

   T1140

   Monitor file system and network traffic to detect suspicious file deobfuscation.

8. 08

   credential-access

   T1555.003

   Implement browser security measures to protect credentials from web browsers and monitor for suspicious activity.

9. 09

   discovery

   T1012T1082

   Implement endpoint logging and process monitoring to detect suspicious registry queries and system information discovery.

10. 10

    command-and-control

    T1573.001T1665

    Analyze network traffic to detect suspicious C2 traffic and block suspicious traffic using Symmetric Cryptography.

11. 11

    exfiltration

    T1041

    Monitor network traffic to detect exfiltration over C2 channel and block suspicious traffic.

FAQ2