incransom

Kill-chain playbook11

1. 01

   resource-development

   T1588.002

   Monitor suspicious downloads from third-party sources to detect and prevent acquiring tools for T1588.002.

2. 02

   initial-access

   T1190T1566

   Monitor and patch vulnerabilities in public-facing applications and suspicious email activity for T1190 and T1566.

3. 03

   execution

   T1047T1059.003

   Monitor suspicious Windows Management Instrumentation (WMI) queries and Windows Command Shell activity for T1047 and T1059.003.

4. 04

   stealth

   T1036.005

   Monitor suspicious process names and locations that overlap with legitimate resource names and locations for T1036.005.

5. 05

   discovery

   T1046T1087.002

   Monitor suspicious network service discovery and domain account queries for T1046 and T1087.002.

6. 06

   lateral-movement

   T1021.001T1570

   Monitor suspicious Remote Desktop Protocol (RDP) activity and lateral tool transfers for T1021.001 and T1570.

7. 07

   collection

   T1074

   Monitor suspicious file and folder activity to detect and prevent staged data for T1074.

8. 08

   command-and-control

   T1071

   Monitor suspicious Application Layer Protocol activity and perform encrypted traffic analysis for T1071.

9. 09

   exfiltration

   T1537

   Monitor egress network traffic to detect and prevent data transfer to cloud account for T1537.

10. 10

    defense-impairment

    T1685

    Monitor security tool configurations to detect and prevent disabling or modifying tools for T1685.

11. 11

    impact

    T1486T1657

    Monitor anomalous data activity to detect and prevent data encryption for impact and financial theft for T1486 and T1657.

FAQ2