Investigation of Advanced Persistent Threats Network-based Tactics, Techniques and Procedures

TL;DR

It is found that APTs cannot continue their operations without C&C servers, which are mostly addressed by Domain Name System (DNS), and the most popular protocol to deploy evasion techniques is using HTTP(S) with 81% of APT campaigns.

Abstract

The scarcity of data and the high complexity of Advanced Persistent Threats (APTs) attacks have created challenges in comprehending their behavior and hindered the exploration of effective detection techniques. To create an effective APT detection strategy, it is important to examine the Tactics, Techniques, and Procedures (TTPs) that have been reported by the industry. These TTPs can be difficult to classify as either malicious or legitimate. When developing an approach for the next generation of network intrusion detection systems (NIDS), it is necessary to take into account the specific context of the attack explained in this paper. In this study, we select 33 APT campaigns based on the fair distribution over the past 22 years to observe the evolution of APTs over time. We focus on their evasion techniques and how they stay undetected for months or years. We found that APTs cannot continue their operations without C&C servers, which are mostly addressed by Domain Name System (DNS). We identify several TTPs used for DNS, such as Dynamic DNS, typosquatting, and TLD squatting. The next step for APT operators is to start communicating with a victim. We found that the most popular protocol to deploy evasion techniques is using HTTP(S) with 81% of APT campaigns. HTTP(S) can evade firewall filtering and pose as legitimate web-based traffic. DNS protocol is also widely used by 45% of APTs for DNS resolution and tunneling. We identify and analyze the TTPs associated with using HTTP(S) based on real artifacts.

Figures (14)

• Figure 1: Methodology.
• Figure 2: Lockheed Martin Cyber Kill Chain detective controls hutchins2011intelligence.
• Figure 3: Mandiant attack model apt1.
• Figure 4: MITRE ATT&CK techniques per stage.
• Figure 5: Network-based TTPs taxonomy.