APT40· China

Kill-chain playbook13

1. 01

   reconnaissance

   T1589.001T1595.002

   Monitor for suspicious Credential harvesting and Vulnerability Scanning activities and implement measures to prevent information leakage.

2. 02

   resource-development

   T1586.001

   Monitor Social Media Accounts creation and usage and defend against potential Account Compromise cases.

3. 03

   initial-access

   T1566.002

   Implement user education and email security measures against Spearphishing Link and monitor for suspicious links.

4. 04

   execution

   T1047

   Monitor Windows Management Instrumentation (WMI) usage and detect suspicious WMI queries.

5. 05

   persistence

   T1547.001

   Monitor Registry Run Keys and Startup Folder changes and detect suspicious modifications.

6. 06

   privilege-escalation

   T1546.003

   Monitor Windows Management Instrumentation Event Subscription usage and detect suspicious Event Subscription cases.

7. 07

   stealth

   T1027.013

   Monitor Encrypted/Encoded Files and detect suspicious files.

8. 08

   credential-access

   T1003.001

   Monitor attempts to obtain Credentials from LSASS Memory and detect suspicious Credential Access cases.

9. 09

   lateral-movement

   T1021.004

   Monitor SSH connections and detect suspicious SSH activities.

10. 10

    collection

    T1074.001

    Monitor Local Data Staging activities and detect suspicious Data Staging cases.

11. 11

    command-and-control

    T1102.003T1105

    Monitor One-Way Communication and Ingress Tool Transfer activities and detect suspicious C2 activities.

12. 12

    exfiltration

    T1041T1567.002

    Monitor Exfiltration Over C2 Channel and Exfiltration to Cloud Storage activities and detect suspicious Exfiltration cases.

13. 13

    defense-impairment

    T1553.002

    Monitor Code Signing certificate usage and detect suspicious Code Signing cases.

FAQ2