ShinyHunters

Kill-chain playbook12

1. 01

   reconnaissance

   T1598.003

   Monitor suspicious email activity for Spearphishing Link and prevent users from clicking on suspicious links through user training.

2. 02

   resource-development

   T1585.002T1588.002

   Monitor for suspicious email accounts and procurement of tools, and control unusual account activity.

3. 03

   initial-access

   T1190

   Implement vulnerability management to detect and prevent exploitation of public-facing applications.

4. 04

   execution

   T1059.007

   Use endpoint detection and prevention systems to monitor and prevent suspicious JavaScript execution.

5. 05

   stealth

   T1078

   Monitor Valid Accounts to detect and prevent unusual account activity.

6. 06

   credential-access

   T1528

   Implement secure token storage and management practices to prevent theft of application access tokens.

7. 07

   discovery

   T1082

   Monitor unusual system queries and executed commands to detect System Information Discovery.

8. 08

   lateral-movement

   T1210T1550.001

   Implement lateral movement detection mechanisms to monitor and prevent suspicious remote service exploitation and application access token usage.

9. 09

   collection

   T1530T1560.002

   Monitor unusual data operations to detect data collection from Cloud Storage and archiving.

10. 10

    command-and-control

    T1105T1573.002

    Monitor network traffic to prevent suspicious tool transfer and use of asymmetric cryptography.

11. 11

    exfiltration

    T1567

    Monitor suspicious web traffic to detect exfiltration over web service.

12. 12

    impact

    T1491.001

    Monitor web applications to detect and prevent Internal Defacement.

FAQ2