Kimsuky· North Korea

Kill-chain playbook15

1. 01

   reconnaissance

   T1598

   Monitor email content and sender information to detect and prevent suspicious phishing activities.

2. 02

   resource-development

   T1587.001

   Monitor network traffic and system changes related to malware development and distribution.

3. 03

   initial-access

   T1566

   Use email security solutions and educate users to detect and prevent phishing attacks.

4. 04

   execution

   T1204.002

   Use endpoint security solutions to detect and prevent execution of malicious files.

5. 05

   persistence

   T1176.001

   Monitor browser extension modifications and new extension installations.

6. 06

   privilege-escalation

   T1546.001

   Monitor system changes to detect and prevent file association modifications.

7. 07

   stealth

   T1078.003T1678

   Monitor system and network activities to detect suspicious local account activities and execution delay tactics.

8. 08

   credential-access

   T1040

   Monitor network traffic to detect unencrypted authentication data.

9. 09

   discovery

   T1217

   Monitor endpoint activities to detect suspicious activities related to browser information collection.

10. 10

    lateral-movement

    T1021.001

    Monitor RDP connections to detect suspicious lateral movements.

11. 11

    collection

    T1005

    Monitor endpoint activities to detect suspicious activities related to data collection from local system.

12. 12

    command-and-control

    T1105

    Monitor network traffic to detect suspicious ingress tool transfer activities.

13. 13

    exfiltration

    T1020

    Monitor network traffic and system activities to detect automated exfiltration activities.

14. 14

    defense-impairment

    T1685

    Monitor system activities to detect suspicious activities related to disabling or modifying security tools.

15. 15

    impact

    T1489

    Monitor system activities to detect suspicious activities related to service stop.

FAQ2