Volt Typhoon· China

Kill-chain playbook13

1. 01

   reconnaissance

   T1590T1591.004

   Implement logging and monitoring systems to detect network reconnaissance and role identification activities.

2. 02

   resource-development

   T1584.004

   Conduct network traffic monitoring to detect suspicious use of server resources.

3. 03

   initial-access

   T1190

   Implement web application firewall and access control to detect exploitation attempts on public-facing applications.

4. 04

   execution

   T1059.003

   Implement endpoint detection and response (EDR) solutions to monitor Windows Command Shell usage.

5. 05

   persistence

   T1133

   Strengthen authentication and access control to detect suspicious use of external remote services.

6. 06

   privilege-escalation

   T1068

   Monitor privileged account activities to detect privilege escalation attempts.

7. 07

   stealth

   T1078

   Monitor account activities and identify anomalous behavior to detect suspicious use of valid accounts.

8. 08

   credential-access

   T1555

   Monitor credential access to detect credential theft from password stores.

9. 09

   discovery

   T1046T1083

   Monitor network traffic and file system access to detect network service and file discovery activities.

10. 10

    lateral-movement

    T1021.001T1570

    Monitor Remote Desktop Protocol (RDP) and file transfer activities to detect lateral movement within the network.

11. 11

    collection

    T1056.001

    Implement endpoint monitoring to log user input and detect suspicious keylogging activities.

12. 12

    command-and-control

    T1090

    Conduct network traffic monitoring to detect suspicious proxy activities.

13. 13

    defense-impairment

    T1685.005

    Monitor logging systems to detect Windows Event Logs clearing activities and identify log deletion attempts.

FAQ2