🎯 APT Tracker

Campaign Analysis Report
═══════════════════════
Campaign Name:     [Name / Operation codename]
Attribution:       [APT group / Confidence level (low/medium/high)]
Timeframe:         [First observed — Last observed]
Motivation:        [Espionage / Destruction / Financial / Hacktivism]
Target Profile:    [Sectors, geographies, specific orgs]

Kill Chain Mapping:
  Recon:           [Methods: OSINT, scanning, social media]
  Weaponization:   [Malware used, exploits leveraged]
  Delivery:        [Spearphish, watering hole, supply chain]
  Exploitation:    [CVEs, zero-days, social engineering]
  Installation:    [Persistence mechanisms]
  C2:              [Infrastructure, protocols, evasion]
  Actions:         [Data exfil, destruction, lateral movement]

Diamond Model:
  Adversary:       [Group, sub-group, operators]
  Capability:      [Tools, malware, exploits]
  Infrastructure:  [Domains, IPs, certificates]
  Victim:          [Target characterization]

IOCs:              [Hashes, domains, IPs, YARA rules]
MITRE Mapping:     [Technique IDs with context]
Detection:         [Sigma rules, KQL queries, behavioral indicators]
Recommendations:  [Defensive actions, hunting queries]

Activity Thread:
  A sequence of events linked by at least one shared Diamond vertex.
  Thread = Event₁ → Event₂ → Event₃ ... (shared adversary, infra, or capability)

Activity Group:
  Cluster of activity threads with shared features.
  Used for campaign-level analysis and actor tracking.

Clustering Approaches:

Adversary-Centric Grouping:
  Group all activities attributed to same actor
  Risk: Attribution errors cascade across entire group
  Use: When attribution confidence is high

Capability-Centric Grouping:
  Group by shared tools/malware/techniques
  Risk: Tools can be shared, sold, or false-flagged
  Use: When unique custom tooling is observed

Infrastructure-Centric Grouping:
  Group by shared C2, hosting, domains
  Risk: Shared hosting, bulletproof hosts used by multiple actors
  Use: When infrastructure is unique/custom

Victim-Centric Grouping:
  Group by common targeting patterns
  Risk: Multiple actors target same sectors
  Use: When defending specific sector/org

# Automated IOC enrichment pipeline

1. Ingest: Receive IOC (hash, IP, domain, URL)
    │
2. Validate: Format check, defang, dedup
    │  └── Strip [.] → ., hxxp → http, etc.
    │
3. Classify: Determine IOC type
    │  └── Hash (MD5/SHA1/SHA256), IPv4/v6, FQDN, URL, Email
    │
4. Enrich: Query multiple sources
    │  ├── VirusTotal (detections, relationships, behavior)
    │  ├── Passive DNS (domain ↔ IP history)
    │  ├── WHOIS (registration, registrant)
    │  ├── Shodan/Censys (open ports, services, certs)
    │  ├── Threat intel feeds (known bad, campaigns)
    │  ├── GeoIP (location, ASN, ISP)
    │  └── Internal telemetry (seen in our environment?)
    │
5. Correlate: Link related IOCs
    │  ├── Same infrastructure cluster?
    │  ├── Same malware family?
    │  ├── Same campaign / threat actor?
    │  └── Diamond Model vertex alignment
    │
6. Score: Confidence + Severity
    │  ├── How many sources confirm?
    │  ├── How fresh is the IOC?
    │  ├── Context (targeted vs commodity)?
    │  └── Relevance to our environment?
    │
7. Action: Block, Alert, Hunt, or Monitor
    └── Deploy to detection systems (SIEM, EDR, firewall)

Code-Level Indicators:
  • PDB paths        → Developer environment, username, project names
  • Compiler         → MSVC version, GCC, Clang, Delphi, Go, Rust
  • Build timestamps → Timezone inference (if not zeroed/faked)
  • String artifacts → Language, debug messages, error handling
  • Code reuse       → Shared libraries, copy-paste between families
  • Crypto constants → Custom vs standard implementations
  • Mutex names      → Campaign identifiers, versioning

Behavioral Indicators:
  • C2 protocol      → Custom vs standard, beacon patterns
  • Sleep patterns   → Jitter, business hours awareness
  • Anti-analysis    → Specific VM/sandbox checks
  • Persistence      → Registry keys, services, scheduled tasks
  • Collection       → What data is targeted, staging methods
  • Exfil methods    → Encrypted, steganography, legitimate services

1. Direction / Requirements
   └── What APT groups target our sector?
       What TTPs are trending? What's our coverage gap?

2. Collection
   └── Monitor feeds, vendor reports, OSINT sources
       Track infrastructure changes, new malware samples
       Internal telemetry (EDR, SIEM, network sensors)

3. Processing
   └── Normalize IOCs, extract metadata
       Map to MITRE ATT&CK, enrich indicators
       Dedup, validate, timestamp

4. Analysis
   └── Cluster activities → campaigns → actors
       Diamond Model analysis for each intrusion set
       Identify trends, predict future operations

5. Dissemination
   └── Strategic intel → leadership (threat landscape)
       Operational intel → security teams (campaigns)
       Tactical intel → SOC/IR (IOCs, detection rules)

6. Feedback
   └── Were detections effective?
       Did hunting queries find anything?
       Adjust collection priorities

# Query a threat intelligence API for indicator enrichment
# Example: Graph Security threat intelligence endpoints

# Get threat intelligence article
GET https://graph.microsoft.com/beta/security/threatIntelligence/articles/{articleId}

# Search indicators
GET https://graph.microsoft.com/beta/security/threatIntelligence/hosts/{hostName}

# Passive DNS for a host
GET https://graph.microsoft.com/beta/security/threatIntelligence/hosts/{hostName}/passivedns

# WHOIS record
GET https://graph.microsoft.com/beta/security/threatIntelligence/hosts/{hostName}/whois

# Reputation
GET https://graph.microsoft.com/beta/security/threatIntelligence/hosts/{hostName}/reputation

# Components (web technologies)
GET https://graph.microsoft.com/beta/security/threatIntelligence/hosts/{hostName}/components

# SSL Certificates
GET https://graph.microsoft.com/beta/security/threatIntelligence/hosts/{hostName}/sslCertificates

// Detect Volt Typhoon LOTL techniques
DeviceProcessEvents
| where FileName in~ ("ntdsutil.exe", "netsh.exe", "certutil.exe")
| where ProcessCommandLine has_any ("ifconfig", "portproxy", "urlcache", "activate instance ntds")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine

// Detect token forging / Golden SAML patterns
AADSignInEventsBeta
| where ErrorCode == 0
| where isnotempty(TokenIssuerName) and TokenIssuerType != "AzureAD"
| where TokenIssuerName !startswith "https://sts.windows.net"
| project Timestamp, AccountUpn, IPAddress, TokenIssuerName

// Detect suspicious OAuth app activity (Storm-0558 style)
CloudAppEvents
| where ActionType == "Add OAuth2PermissionGrant"
   or ActionType == "Consent to application"
| where RawEventData has "ReadWrite.All" or RawEventData has "full_access_as_app"
| project Timestamp, AccountDisplayName, ActionType, Application

// Detect SOHO router C2 beaconing (ORB detection)
DeviceNetworkEvents
| where RemoteIPType == "Public"
| summarize ConnectionCount=count(), DistinctPorts=dcount(RemotePort) by RemoteIP, bin(Timestamp, 1h)
| where ConnectionCount > 20 and DistinctPorts == 1  // Regular beaconing pattern
| join kind=inner (
    DeviceNetworkEvents | summarize by RemoteIP
    | where RemoteIP matches regex @"^(10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.)" == false
) on RemoteIP