Void Manticore· Iran

Kill-chain playbook14

1. 01

   reconnaissance

   T1589

   Monitor Identity Information gathering queries to detect suspicious Gather Victim Identity Information activities.

2. 02

   resource-development

   T1583.001

   Monitor DNS queries for newly registered domains and identify suspicious Domain registration.

3. 03

   initial-access

   T1566

   Detect Phishing attempts and implement user awareness to identify suspicious email activities.

4. 04

   execution

   T1059.001

   Monitor and restrict PowerShell script execution to detect suspicious PowerShell activities.

5. 05

   persistence

   T1133

   Monitor External Remote Service connections and identify suspicious External Remote Services usage.

6. 06

   stealth

   T1564.003

   Monitor creation of hidden windows to detect suspicious hidden processes.

7. 07

   credential-access

   T1003.001T1110.001

   Monitor LSASS Memory credential access attempts and suspicious Password Guessing activities.

8. 08

   discovery

   T1087.002

   Monitor Domain Account queries to detect suspicious Domain Account discovery.

9. 09

   lateral-movement

   T1021.001

   Monitor RDP connections to detect suspicious RDP activities.

10. 10

    collection

    T1113T1119

    Monitor screen and file collection activities to detect suspicious Screen Capture and Automated Collection activities.

11. 11

    command-and-control

    T1102

    Monitor unusual Web Service queries to detect suspicious Web Service usage.

12. 12

    exfiltration

    T1041

    Monitor data transfer over C2 channel to detect suspicious Exfiltration Over C2 Channel activities.

13. 13

    defense-impairment

    T1484.001

    Monitor Group Policy changes to detect suspicious Group Policy Modification activities.

14. 14

    impact

    T1561.001

    Monitor disk content wipe activities to detect suspicious Disk Content Wipe activities.

FAQ2