HackBlue

Course · Malware · 09 / 18

Advanced persistent threats: using threat intelligence and ATT&CK to defend

APT groups run long, goal-driven campaigns. How to use public reporting and MITRE ATT&CK to understand the techniques likely to target you, build a coverage map of your detections, and hunt for the behaviors that matter.

12 min read · practice only with authorization

Diagram

From a threat report to a hunt

Follow the path. One example at a time.
Report

A government advisory describes a group targeting your sector.

Illustration: Report
CISA AA-advisory excerpt:
  T1190 Exploit Public-Facing Application (edge VPN appliances)
  T1078 Valid Accounts
  T1003.001 LSASS Memory
  T1567.002 Exfiltration to Cloud Storage

The example on the open step is one illustration, or the fix you can paste into an application you own.

What this page is made of

A short map of the pieces. Each piece says what fails, who is affected, what you would notice, and what you change.

  1. 01Intelligence you can use
  2. 02Behaviors over indicators
  3. 03Dwell time

Intelligence you can use

What fails
Public advisories list techniques and indicators.
Who is affected
Sectors being targeted.
What you would notice
Advisories naming your sector or technology.
What you change
Turn each advisory into a coverage review.

Behaviors over indicators

What fails
IPs and hashes change quickly; techniques change slowly.
Who is affected
Detection programs.
What you would notice
Rules based only on IOCs.
What you change
Write behavior-based detections.

Dwell time

What fails
Long campaigns stay unnoticed for months.
Who is affected
Data and systems.
What you would notice
Discovery by third parties.
What you change
Hunt regularly and keep logs long enough.

Check yourself

Recognition and the fix. Nothing here is a procedure.

1 / 3

Why prefer behavior-based detections over IP indicators?

Sibling techniques

Pages at the same depth, plus a lab and a glossary card for this one.

  1. MapMalware fundamentals: families, delivery, persistence, and the responseWhat malware categories describe, how infections usually start, where persistence hides on Windows, Linux, and macOS, and why rebuilding usually beats cleaning.

Practice

  1. LabTerminal labRead the files on a scoped host and name the failure in a finding.