MuddyWater· Iran

Kill-chain playbook14

1. 01

   reconnaissance

   T1590.004

   Monitor network traffic to detect activities aimed at discovering Network Topology.

2. 02

   resource-development

   T1588.002

   Monitor unusual network activities to detect acquisition of malicious Tools.

3. 03

   initial-access

   T1566.001T1566.002

   Inspect email attachments and links to detect Spearphishing Attachment and Link.

4. 04

   execution

   T1204.004

   Monitor user activities to detect Malicious Copy and Paste operations.

5. 05

   persistence

   T1137.001T1547.001

   Monitor system configuration to detect changes to Office Template Macros and Registry Run Keys / Startup Folder.

6. 06

   privilege-escalation

   T1548.002

   Monitor User Account Control to detect Bypass User Account Control attempts.

7. 07

   stealth

   T1574.001

   Monitor process creation and modification to detect DLL injection attempts.

8. 08

   credential-access

   T1003.004

   Monitor authentication activities to detect access to LSA Secrets.

9. 09

   discovery

   T1087.002

   Monitor user and group activities to detect Domain Account discovery.

10. 10

    lateral-movement

    T1534

    Monitor internal email traffic to detect Internal Spearphishing attempts.

11. 11

    collection

    T1074.001

    Monitor file and folder activities to detect Local Data Staging activities.

12. 12

    command-and-control

    T1571

    Monitor network traffic to detect Non-Standard Port usage.

13. 13

    exfiltration

    T1567.002

    Monitor network traffic and file activities to detect Exfiltration to Cloud Storage attempts.

14. 14

    defense-impairment

    T1685

    Monitor security software to detect Disable or Modify Tools attempts.

FAQ2