TeamTNT

Kill-chain playbook14

1. 01

   reconnaissance

   T1595.002

   Monitor for Vulnerability Scanning activities to detect system vulnerabilities and investigate suspicious scans.

2. 02

   resource-development

   T1608.001

   Monitor for malware upload attempts to detect and prevent suspicious file uploads.

3. 03

   execution

   T1569.003

   Monitor systemctl usage on the system to detect and prevent suspicious systemctl commands.

4. 04

   persistence

   T1133

   Restrict access to External Remote Services and monitor for suspicious connections.

5. 05

   privilege-escalation

   T1611

   Monitor for Escape to Host attempts in container environments to detect and prevent suspicious container escapes.

6. 06

   stealth

   T1036.005

   Monitor system resource names and locations to detect suspicious naming or placement.

7. 07

   credential-access

   T1552.005

   Restrict access to Cloud Instance Metadata API and monitor for suspicious requests.

8. 08

   discovery

   T1007T1680

   Monitor for System Service Discovery and Local Storage Discovery activities to detect system service and local storage reconnaissance.

9. 09

   lateral-movement

   T1021.004

   Monitor SSH traffic to detect and prevent suspicious SSH connections.

10. 10

    collection

    T1074.001

    Monitor for Local Data Staging activities to detect suspicious local data aggregation.

11. 11

    command-and-control

    T1219

    Monitor Remote Access Tools to detect and prevent suspicious remote access tool usage.

12. 12

    exfiltration

    T1048

    Monitor data transfer over alternative protocols to detect suspicious exfiltration activities.

13. 13

    defense-impairment

    T1222.002T1686

    Monitor system firewall configuration and permissions to detect and prevent system firewall modification or disablement.

14. 14

    impact

    T1496.001

    Monitor compute resource usage to detect and prevent Compute Hijacking activities.

FAQ2