.json
-└── README.md
-```
+
## Quick start
```bash
docker compose up -d
-# View logs
-docker compose logs -f
-
# Stop (volume data preserved)
docker compose down
```
Access at: **http://localhost:8080**
+## Active tool tabs
+
+The UI shows five query/tool tabs configured with `SIEM_TOOL_1` through
+`SIEM_TOOL_5` in `docker-compose.yml`. This project defaults to the priority
+SOC stack: Sysmon XML, OSQuery SQL, Velociraptor VQL, Elastic EQL, and Elastic
+Detection Rules. Other supported values include `splunk`, `kql`,
+`security_onion`, `qradar`, `sigma`, `carbon_black`, `chronicle`,
+`crowdstrike`, `defender`, `opensearch`, and `logrhythm`.
+
+## MITRE ATT&CK group playbooks
+
+Default threat-group playbooks are generated from the public MITRE ATT&CK
+Enterprise STIX dataset. To refresh missing group playbooks and append them to
+the default manifest, run:
+
+```bash
+python scripts/generate_mitre_group_playbooks.py
+```
+
+The generator creates one `Threat Groups` playbook per MITRE intrusion-set/group
+ID (`Gxxxx`) and does not duplicate entries that already exist in the manifest.
+
## Volume management
```bash
@@ -81,51 +66,13 @@ docker compose up -d --build
# The playbook-data volume is untouched — custom playbooks survive the rebuild
```
-## Nginx reverse proxy integration
-
-Add to your existing nginx config:
-
-```nginx
-location /playbooks/ {
- proxy_pass http://soc-playbooks:8080/;
- proxy_set_header Host $host;
- proxy_set_header X-Real-IP $remote_addr;
- proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-}
-```
-
-## Add to an existing Docker Compose stack (e.g. HOL stack)
-
-```yaml
- soc-playbooks:
- build: ./soc-playbooks
- image: soc-playbooks:latest
- container_name: soc-playbooks
- restart: unless-stopped
- volumes:
- - playbook-data:/playbooks
- networks:
- - your_existing_network # share with nginx proxy
-
-volumes:
- playbook-data:
- driver: local
-```
-
## Air-gapped deployment
```bash
# Export on internet-connected host
-docker save soc-playbooks:latest | gzip > soc-playbooks-v3.tar.gz
+docker save soc-playbooks:latest | gzip > soc-playbooks-v4.tar.gz
# On the air-gapped host
-docker load < soc-playbooks-v3.tar.gz
+docker load < soc-playbooks-v4.tar.gz
docker compose up -d
```
-
-## Migrating to Gitea (future)
-
-This container uses Apache CGI for persistence. If you move to a locally
-hosted Gitea instance, the three CGI functions in index.html are replaced
-with Gitea Contents API calls — see the project documentation for the
-migration guide.
diff --git a/app/app.js b/app/app.js
new file mode 100644
index 0000000..d27b1bf
--- /dev/null
+++ b/app/app.js
@@ -0,0 +1,1917 @@
+const API_LOAD = "cgi-bin/load_playbooks.py";
+const API_SAVE = "cgi-bin/save_playbook.py";
+const API_UPDATE = "cgi-bin/update_playbook.py";
+const API_DELETE = "cgi-bin/delete_playbook.py";
+const API_SOP_LOAD = "cgi-bin/load_sops.py?type=sop";
+const API_SOP_UPLOAD = "cgi-bin/upload_sop.py";
+const API_SOP_DELETE = "cgi-bin/delete_sop.py";
+const API_DOC_LOAD = "cgi-bin/load_sops.py?type=doc";
+const MITRE_TECHNIQUES_URL = "playbooks/mitre-techniques.json";
+const NAVIGATOR_APP_URL = "attack-navigator/index.html";
+const DEFAULT_TOOL_FALLBACK = "sysmon";
+let DEFAULT_TOOL = DEFAULT_TOOL_FALLBACK;
+
+// Full registry of all supported tools/SIEMs
+const ALL_TOOLS = {
+ splunk: { label: "Splunk SPL", lang: "language-bash" },
+ kql: { label: "Microsoft KQL", lang: "language-sql" },
+ security_onion: { label: "Security Onion", lang: "language-sql" },
+ qradar: { label: "IBM QRadar AQL", lang: "language-sql" },
+ sigma: { label: "Sigma Rule", lang: "language-yaml" },
+ sysmon: { label: "Sysmon XML", lang: "language-xml" },
+ velociraptor: { label: "Velociraptor VQL", lang: "language-sql" },
+ osquery: { label: "OSQuery SQL", lang: "language-sql" },
+ carbon_black: { label: "Carbon Black", lang: "language-sql" },
+ elastic: { label: "Elastic EQL", lang: "language-json" },
+ elastic_detection_rules: { label: "Elastic Detection Rules", lang: "language-sql" },
+ chronicle: { label: "Google Chronicle", lang: "language-yaml" },
+ crowdstrike: { label: "CrowdStrike FQL", lang: "language-bash" },
+ defender: { label: "Defender XDR KQL", lang: "language-sql" },
+ opensearch: { label: "OpenSearch DSL", lang: "language-json" },
+ logrhythm: { label: "LogRhythm Axiom", lang: "language-sql" },
+};
+const TOOL_ORDER = Object.keys(ALL_TOOLS);
+const TOOL_LABELS = Object.fromEntries(Object.entries(ALL_TOOLS).map(([k, v]) => [k, v.label]));
+const ATTACK_DOMAIN_LABELS = {
+ "enterprise-attack": "Enterprise ATT&CK",
+ "mobile-attack": "Mobile ATT&CK",
+ "ics-attack": "ICS ATT&CK"
+};
+
+const state = {
+ manifest: [],
+ libraryById: new Map(),
+ customById: new Map(),
+ allPlaybooks: [],
+ selectedId: null,
+ activeCardFilter: "all",
+ activeCardSearch: "",
+ activeCardView: "grid",
+ editingId: null,
+ mitreTags: [],
+ mitreLookup: new Map(),
+ mitreIndex: [],
+ navigatorLayerObjectUrl: null,
+ navigatorCustomLayerObjectUrl: null,
+ navigatorLastLayer: null,
+ navigatorScope: "all",
+ activeCardSevFilter: "all",
+ activeSourceFilter: "all",
+ checklistEnabled: false,
+ activeTools: ["sysmon", "osquery", "velociraptor", "elastic", "elastic_detection_rules"],
+ sops: [],
+ selectedSopId: null,
+ docs: [],
+ selectedDocId: null,
+};
+
+function toggleMobileNav() {
+ const open = document.body.classList.toggle("nav-open");
+ const btn = document.getElementById("mobile-nav-toggle");
+ if (btn) btn.setAttribute("aria-expanded", open ? "true" : "false");
+}
+
+function closeMobileNav() {
+ document.body.classList.remove("nav-open");
+ const btn = document.getElementById("mobile-nav-toggle");
+ if (btn) btn.setAttribute("aria-expanded", "false");
+}
+
+function isMobileViewport() {
+ return window.matchMedia("(max-width: 980px)").matches;
+}
+
+const esc = (value) => String(value ?? "")
+ .replaceAll("&", "&")
+ .replaceAll("<", "<")
+ .replaceAll(">", ">")
+ .replaceAll('"', """)
+ .replaceAll("'", "'");
+
+function toSlug(input) {
+ return String(input ?? "").toLowerCase().replace(/\s+/g, "-").replace(/[^a-z0-9-]/g, "");
+}
+
+function getPlaybookById(id) {
+ return state.libraryById.get(id) || state.customById.get(id);
+}
+
+const SEV_MAP = {
+ critical: { label: "Critical", badge: "b-red" },
+ high: { label: "High", badge: "b-amber" },
+ medium: { label: "Medium", badge: "b-blue" },
+ low: { label: "Low", badge: "b-green" },
+};
+const humanSev = sev => SEV_MAP[String(sev ?? "").toLowerCase()]?.label || "Unknown";
+const sevBadgeClass = sev => SEV_MAP[String(sev ?? "").toLowerCase()]?.badge || "b-green";
+
+function hasQueryValue(value) {
+ if (value == null) return false;
+ if (typeof value === "string") return value.trim().length > 0;
+ if (Array.isArray(value)) return value.some((v) => hasQueryValue(v));
+ return String(value).trim().length > 0;
+}
+
+function computeCompleteness(pb) {
+ const tools = state.activeTools;
+ const result = {};
+ const allSteps = [
+ ...(pb.investigation?.detectionAnalysis || []),
+ ...(pb.investigation?.containment || []),
+ ...(pb.investigation?.eradication || []),
+ ...(pb.investigation?.recovery || [])
+ ];
+ for (const tool of tools) {
+ result[tool] = allSteps.some((s) => hasQueryValue(s?.queries?.[tool]));
+ }
+ return result;
+}
+
+function splitMitre(value) {
+ if (Array.isArray(value)) {
+ return [...new Set(value.filter(Boolean).map((v) => normalizeMitreId(String(v))).filter(Boolean))];
+ }
+ if (!value) return [];
+ return [...new Set(String(value).split(",").map((v) => normalizeMitreId(v)).filter(Boolean))];
+}
+
+function normalizeMitreId(value) {
+ const id = String(value || "").trim().toUpperCase();
+ if (!id) return "";
+ const match = id.match(/^T\d{4}(?:\.\d{3})?$/);
+ return match ? match[0] : "";
+}
+
+function mitreFallbackUrl(id) {
+ const parts = id.split(".");
+ return parts.length === 2
+ ? `https://attack.mitre.org/techniques/${parts[0]}/${parts[1]}/`
+ : `https://attack.mitre.org/techniques/${parts[0]}/`;
+}
+
+function getMitreTechniqueInfo(rawId) {
+ const id = normalizeMitreId(rawId) || String(rawId || "").trim().toUpperCase();
+ if (!id) return null;
+ const found = state.mitreLookup.get(id);
+ return {
+ id,
+ name: found?.name || "",
+ url: found?.url || mitreFallbackUrl(id),
+ domains: Array.isArray(found?.domains) ? found.domains : []
+ };
+}
+
+function renderMitreLink(rawId, includeName = false) {
+ const info = getMitreTechniqueInfo(rawId);
+ if (!info) return "";
+ const label = includeName && info.name ? `${info.id} - ${info.name}` : info.id;
+ const title = info.name ? `${info.id}: ${info.name}` : info.id;
+ return `${esc(label)} `;
+}
+
+async function loadMitreTechniques() {
+ state.mitreLookup.clear();
+ state.mitreIndex = [];
+ const payload = await fetchJson(MITRE_TECHNIQUES_URL).catch(() => null);
+ if (!payload || !Array.isArray(payload.techniques)) return;
+
+ for (const item of payload.techniques) {
+ const id = normalizeMitreId(item?.id);
+ if (!id) continue;
+ const record = {
+ id,
+ name: String(item?.name || id),
+ url: String(item?.url || mitreFallbackUrl(id)),
+ domains: Array.isArray(item?.domains) ? item.domains.map((d) => String(d).toLowerCase()) : []
+ };
+ state.mitreLookup.set(id, record);
+ state.mitreIndex.push(record);
+ }
+}
+
+function collectTechniqueCoverage(playbooks) {
+ const coverage = new Map();
+ for (const pb of playbooks) {
+ const ids = splitMitre(pb?.mitre || []);
+ for (const id of ids) {
+ const entry = coverage.get(id) || { count: 0, playbooks: new Set() };
+ entry.count += 1;
+ entry.playbooks.add(pb.name || pb.id || "Unknown");
+ coverage.set(id, entry);
+ }
+ }
+ return coverage;
+}
+
+function buildNavigatorLayer(playbooks, attackDomain, scope = "all") {
+ const domainKey = attackDomain.split("-")[0];
+ const coverage = collectTechniqueCoverage(playbooks);
+ const techniques = [];
+
+ for (const [id, info] of coverage.entries()) {
+ const technique = getMitreTechniqueInfo(id);
+ const domains = technique?.domains?.length ? technique.domains : ["enterprise"];
+ if (!domains.includes(domainKey)) continue;
+
+ const names = Array.from(info.playbooks).sort((a, b) => a.localeCompare(b));
+ const preview = names.slice(0, 6).join(", ");
+ const extra = names.length > 6 ? ` (+${names.length - 6} more)` : "";
+
+ techniques.push({
+ techniqueID: id,
+ score: info.count,
+ comment: `Monitored in ${names.length} playbook(s): ${preview}${extra}`,
+ metadata: [
+ { name: "Playbook Count", value: String(info.count) },
+ { name: "Playbooks", value: names.join(", ") }
+ ]
+ });
+ }
+
+ techniques.sort((a, b) => a.techniqueID.localeCompare(b.techniqueID, undefined, { numeric: true }));
+ const maxScore = techniques.reduce((max, t) => Math.max(max, t.score || 0), 1);
+
+ const scopeLabel = scope === "custom" ? "Custom Coverage" : "Coverage";
+ return {
+ name: `SOC ${scopeLabel}`,
+ versions: {
+ attack: "17",
+ navigator: "5.3.2",
+ layer: "4.5"
+ },
+ domain: attackDomain,
+ description: scope === "custom"
+ ? "Techniques referenced by custom playbook MITRE selections (custom coverage view)."
+ : "Techniques referenced by all playbook MITRE selections (full coverage view).",
+ sorting: 0,
+ hideDisabled: false,
+ gradient: {
+ colors: ["#e6f1fb", "#185fa5"],
+ minValue: 1,
+ maxValue: maxScore
+ },
+ techniques
+ };
+}
+
+function revokeNavigatorLayerUrl() {
+ if (state.navigatorLayerObjectUrl) {
+ URL.revokeObjectURL(state.navigatorLayerObjectUrl);
+ state.navigatorLayerObjectUrl = null;
+ }
+ if (state.navigatorCustomLayerObjectUrl) {
+ URL.revokeObjectURL(state.navigatorCustomLayerObjectUrl);
+ state.navigatorCustomLayerObjectUrl = null;
+ }
+}
+
+function applyNavigatorLightTheme(frame) {
+ try {
+ const doc = frame?.contentDocument || frame?.contentWindow?.document;
+ if (!doc) return;
+
+ const themeHost = doc.querySelector(".theme-use-system, .theme-override-dark, .theme-override-light");
+ if (themeHost) {
+ themeHost.classList.remove("theme-use-system", "theme-override-dark", "theme-override-light");
+ themeHost.classList.add("theme-override-light");
+ }
+
+ let style = doc.getElementById("playbooks-nav-light-theme");
+ if (!style) {
+ style = doc.createElement("style");
+ style.id = "playbooks-nav-light-theme";
+ doc.head.appendChild(style);
+ }
+
+ // Re-apply styles on each load to keep contrast consistent after Navigator rerenders.
+ style.textContent = [
+ ".theme-override-light { color-scheme: light !important; }",
+ ".theme-override-light, .theme-override-light body, .theme-override-light .mat-app-background { background: #f3f5f8 !important; color: #1f2937 !important; }",
+ ".theme-override-light .mat-mdc-tab-nav-bar, .theme-override-light .controlsContainer, .theme-override-light .mat-toolbar, .theme-override-light .mat-mdc-menu-panel { box-shadow: none !important; background: #ffffff !important; color: #1f2937 !important; }",
+ ".theme-override-light .mdc-tab__text-label, .theme-override-light .mdc-button__label, .theme-override-light button, .theme-override-light .mat-icon, .theme-override-light .material-icons { color: #1f2937 !important; }",
+ ".theme-override-light .mdc-tab--active .mdc-tab__text-label { color: #185fa5 !important; font-weight: 700 !important; }",
+ ".theme-override-light button:hover, .theme-override-light .mat-mdc-menu-item:hover, .theme-override-light .controlsContainer .control-sections > li .control-row-item .control-row-button:hover { background-color: #e4effb !important; color: #0f4f8a !important; }",
+ ".theme-override-light .control-row-button, .theme-override-light .mat-mdc-menu-item { border-color: #cbd5e1 !important; }",
+ ".theme-override-light a { color: #185fa5 !important; }",
+ ".theme-override-light a:hover { color: #0f4f8a !important; }"
+ ].join("\n");
+ } catch (err) {
+ console.warn("Navigator light theme override failed:", err);
+ }
+}
+
+function updateNavigatorLayer() {
+ const playbookSelect = document.getElementById("navigator-playbook-select");
+ const domainSelect = document.getElementById("navigator-domain-select");
+ const summary = document.getElementById("navigator-summary");
+ const frame = document.getElementById("navigator-iframe");
+ if (!playbookSelect || !domainSelect || !summary || !frame) return;
+
+ const scopedPlaybooks = getNavigatorScopedPlaybooks();
+ const selectedId = playbookSelect.value;
+ const selectedPlaybooks = selectedId === "all"
+ ? [...scopedPlaybooks]
+ : scopedPlaybooks.filter((pb) => pb.id === selectedId);
+ const domain = domainSelect.value;
+ const scopeLabel = state.navigatorScope === "custom" ? "custom" : "all";
+
+ const layer = buildNavigatorLayer(selectedPlaybooks, domain, state.navigatorScope);
+ state.navigatorLastLayer = layer;
+
+ revokeNavigatorLayerUrl();
+ state.navigatorLayerObjectUrl = URL.createObjectURL(new Blob([JSON.stringify(layer, null, 2)], { type: "application/json" }));
+
+ // In All Coverage mode with "All playbooks" selected, also load a second Custom layer
+ // so ATT&CK Navigator shows two internal layer tabs.
+ let customLayerUrl = "";
+ if (state.navigatorScope === "all" && selectedId === "all") {
+ const customPlaybooks = state.allPlaybooks.filter((pb) => pb.source === "custom");
+ const customLayer = buildNavigatorLayer(customPlaybooks, domain, "custom");
+ state.navigatorCustomLayerObjectUrl = URL.createObjectURL(new Blob([JSON.stringify(customLayer, null, 2)], { type: "application/json" }));
+ customLayerUrl = state.navigatorCustomLayerObjectUrl;
+ }
+
+ frame.onload = () => {
+ applyNavigatorLightTheme(frame);
+ setTimeout(() => applyNavigatorLightTheme(frame), 120);
+ setTimeout(() => applyNavigatorLightTheme(frame), 500);
+ };
+ if (customLayerUrl) {
+ frame.src = `${NAVIGATOR_APP_URL}#layerURL=${encodeURIComponent(state.navigatorLayerObjectUrl)}&layerURL=${encodeURIComponent(customLayerUrl)}`;
+ } else {
+ frame.src = `${NAVIGATOR_APP_URL}#layerURL=${encodeURIComponent(state.navigatorLayerObjectUrl)}`;
+ }
+
+ summary.textContent = `${layer.techniques.length} technique(s) mapped from ${selectedPlaybooks.length} ${scopeLabel} playbook(s) in ${ATTACK_DOMAIN_LABELS[domain] || domain}.`;
+}
+
+function downloadNavigatorLayer() {
+ if (!state.navigatorLastLayer) return;
+ const domain = state.navigatorLastLayer.domain || "enterprise-attack";
+ const scope = state.navigatorScope === "custom" ? "custom" : "all";
+ const fileName = `mitre-monitored-${scope}-${domain}.json`;
+ const href = URL.createObjectURL(new Blob([JSON.stringify(state.navigatorLastLayer, null, 2)], { type: "application/json" }));
+ const a = document.createElement("a");
+ a.href = href;
+ a.download = fileName;
+ a.click();
+ URL.revokeObjectURL(href);
+}
+
+function openNavigatorInNewTab() {
+ if (!state.navigatorLayerObjectUrl) return;
+ window.open(`${NAVIGATOR_APP_URL}#layerURL=${encodeURIComponent(state.navigatorLayerObjectUrl)}`, "_blank", "noopener,noreferrer");
+}
+
+function renderNavigatorPanel() {
+ const root = document.getElementById("navigator-root");
+ if (!root) return;
+
+ const prevPlaybook = document.getElementById("navigator-playbook-select")?.value || "all";
+ const prevDomain = document.getElementById("navigator-domain-select")?.value || "enterprise-attack";
+ const scopedPlaybooks = getNavigatorScopedPlaybooks();
+ const allLabel = state.navigatorScope === "custom" ? "All custom playbooks" : "All playbooks";
+
+ const options = [`${allLabel} `]
+ .concat(scopedPlaybooks.map((pb) => `#${pb.num || "-"} ${esc(pb.name)} `))
+ .join("");
+
+ root.innerHTML = `
+
+
+ All Coverage
+ Custom Created
+
+
+
+ Coverage source
+ ${options}
+
+
+ ATT&CK domain
+
+ Enterprise ATT&CK
+ Mobile ATT&CK
+ ICS ATT&CK
+
+
+
Download layer
+
Open in new tab
+
+
+
+
+
+ `).join("");
+ return `
+
+ `;
+ }).join("");
+}
+
+function updateCardCount() {
+ const badge = document.getElementById("pb-count-badge");
+ if (badge) badge.textContent = `${state.allPlaybooks.length} playbooks`;
+}
+
+function renderCards() {
+ const host = document.getElementById("cards-grid");
+ if (!host) return;
+
+ const search = state.activeCardSearch.trim().toLowerCase();
+ const visible = state.allPlaybooks.filter((pb) => {
+ const haystack = [pb.name, pb.cat, pb.type, pb.mitre.join(" ")].join(" ").toLowerCase();
+ const catOk = state.activeCardFilter === "all" || pb.cat === state.activeCardFilter;
+ const sevOk = state.activeCardSevFilter === "all" || pb.sev === state.activeCardSevFilter;
+ const sourceOk = state.activeSourceFilter === "all" ||
+ (state.activeSourceFilter === "custom" && (pb.source === "custom" || pb.source === "library-override")) ||
+ (state.activeSourceFilter === "library" && pb.source === "library");
+ const searchOk = !search || haystack.includes(search);
+ return catOk && sevOk && sourceOk && searchOk;
+ });
+ const visibleIds = new Set(visible.map((pb) => pb.id));
+
+ if (state.activeCardView === "table") {
+ host.classList.add("cards-list-mode");
+ host.innerHTML = `
+
+
+
+
+ #
+ Playbook
+ Category
+ Severity
+ Source
+ MITRE
+ Tool coverage
+ Updated
+
+
+
+ ${visible.map((pb) => {
+ const mitreBadges = pb.mitre.slice(0, 4).map((m) => `${esc(m)} `).join("");
+ const comp = computeCompleteness(pb);
+ const pipsHtml = `${state.activeTools.map((t) =>
+ `
`;
+ const sourceLabel = pb.source === "custom" ? "Custom" : pb.source === "library-override" ? "Override" : "Library";
+ return `
+
+ #${pb.num || "-"}
+
+ ${esc(pb.name)}
+
+ ${esc(pb.cat)} ${humanSev(pb.sev)} ${sourceLabel} ${mitreBadges || '- '}
+ ${pipsHtml}
+ ${pb.updated ? `${esc(pb.updated)} ` : '- '}
+
+ `;
+ }).join("")}
+
+
+
${esc(m)} `).join("");
+ const comp = computeCompleteness(pb);
+ const pipsHtml = `${state.activeTools.map(t =>
+ `
`;
+ const updatedHtml = pb.updated ? `Updated ${pb.updated}
` : '';
+ return `
+
+
#${pb.num || "-"}
+
${esc(pb.name)}
+
+ ${humanSev(pb.sev)}
+ ${esc(pb.cat)}
+ ${pb.source === "custom" ? 'Custom ' : ""}
+ ${mitreBadges}
+
+ ${pipsHtml}
+ ${updatedHtml}
+
${sigmaState.ok ? "Valid Sigma" : sigmaState.reason} ` : "";
+
+ const checked = checklistEnabled && checklist && checklist[globalIdx];
+ const wrapOpen = checklistEnabled ? `' : '';
+
+ const stepContent = `
+
+
${idx + 1}
+
+
${esc(step.title || "Untitled step")}
+ ${step.detail ? `
${esc(step.detail)}
` : ""}
+
+
${esc(TOOL_LABELS[activeTool])}${sigmaBadge}
+ ${q ? `
${esc(q)}` : '
No query defined for this tool on this step.
'}
+
+
+
+
${esc(title)}
+
No steps defined.
+
+
${esc(title)}
+
${steps.map((s, i) => stepToHtml(s, i, activeTool, pbId, checklistEnabled, checklist, (offset || 0) + i)).join("")}
+
${esc(TOOL_LABELS[tool])} `).join("");
+ const mitre = playbook.mitre.map((m) => renderMitreLink(m, false)).join("");
+
+ const checklist = loadChecklist(playbook.id);
+ const detSteps = playbook.investigation?.detectionAnalysis || [];
+ const contSteps = playbook.investigation?.containment || [];
+ const eradSteps = playbook.investigation?.eradication || [];
+ const recSteps = playbook.investigation?.recovery || [];
+ const allSteps = [...detSteps, ...contSteps, ...eradSteps, ...recSteps];
+ const totalSteps = allSteps.length;
+ const doneSteps = Object.values(checklist).filter(Boolean).length;
+ const progressPct = totalSteps > 0 ? Math.round((doneSteps / totalSteps) * 100) : 0;
+
+ const checklistBarHtml = `
+
+
+ ${state.checklistEnabled ? '✓ Checklist On' : '▷ Start Incident'}
+
+ ${state.checklistEnabled ? `
+
+
${doneSteps}/${totalSteps} steps
+
Reset
+ ` : ''}
+
${esc(playbook.type || playbook.cat)}
+ ${esc(playbook.name)}
+
+ ${humanSev(playbook.sev)}
+ ${esc(playbook.cat)}
+ ${playbook.source === "custom" ? 'Custom ' : 'Library '}
+ ${mitre}
+
+
+ Edit
+ Delete / Revert
+ 🖨 Print
+ ⬇ Export SOAR
+
+ ${checklistBarHtml}
+ ${playbook.scenario ? `${esc(playbook.scenario)}
` : ""}
+ ${tabs}
+ ${sectionToHtml("Detection & analysis", detSteps, activeTool, playbook.id, state.checklistEnabled, checklist, detOffset)}
+ ${sectionToHtml("Containment", contSteps, activeTool, playbook.id, state.checklistEnabled, checklist, contOffset)}
+ ${sectionToHtml("Eradication", eradSteps, activeTool, playbook.id, state.checklistEnabled, checklist, eradOffset)}
+ ${sectionToHtml("Recovery & lessons learned", recSteps, activeTool, playbook.id, state.checklistEnabled, checklist, recOffset)}
+ ${relatedHtml}
+ `;
+
+ if (window.hljs) {
+ host.querySelectorAll("pre code").forEach((block) => window.hljs.highlightElement(block));
+ }
+}
+
+function setActiveNav(target) {
+ document.querySelectorAll(".nav-item").forEach((n) => n.classList.remove("active"));
+ document.querySelectorAll(".sb-create-btn").forEach((n) => n.classList.remove("active"));
+ if (target) target.classList.add("active");
+}
+
+function showPanel(name, navEl) {
+ document.querySelectorAll(".panel").forEach((p) => p.classList.remove("visible"));
+ const panel = document.getElementById(`panel-${name}`);
+ if (panel) panel.classList.add("visible");
+ if (navEl) {
+ setActiveNav(navEl);
+ }
+ if (isMobileViewport()) closeMobileNav();
+}
+
+function openPlaybook(id, navEl) {
+ const pb = state.allPlaybooks.find((p) => p.id === id);
+ if (!pb) return;
+ state.checklistEnabled = false;
+ state.selectedId = id;
+ renderDetail(pb, DEFAULT_TOOL);
+ showPanel("detail", navEl || document.getElementById(`nav-${id}`));
+ if (isMobileViewport()) closeMobileNav();
+}
+
+function switchToolTab(id, tool) {
+ const pb = state.allPlaybooks.find((p) => p.id === id);
+ if (!pb) return;
+ renderDetail(pb, tool);
+}
+
+function toggleGroup(groupId) {
+ const el = document.getElementById(groupId);
+ const arr = document.getElementById(`${groupId}-arr`);
+ if (!el || !arr) return;
+ const hidden = el.style.display === "none";
+ el.style.display = hidden ? "block" : "none";
+ arr.textContent = hidden ? "▾" : "▸";
+}
+
+function searchNav(input) {
+ const q = String(input || "").trim().toLowerCase();
+ const items = document.querySelectorAll("#sb-nav .nav-item");
+ items.forEach((item) => {
+ if (item.id === "nav-home" || item.id === "nav-base" || item.id === "nav-create") return;
+ const title = (item.dataset.title || item.textContent || "").toLowerCase();
+ const cat = (item.dataset.cat || "").toLowerCase();
+ item.classList.toggle("hidden", q && !(title.includes(q) || cat.includes(q)));
+ });
+}
+
+function filterCards(cat, btn) {
+ state.activeCardFilter = cat;
+ document.querySelectorAll(".filter-btn").forEach((b) => b.classList.remove("on"));
+ if (btn) btn.classList.add("on");
+ renderCards();
+}
+
+function filterSource(src, btn) {
+ state.activeSourceFilter = src;
+ document.querySelectorAll(".source-filter-btn").forEach(b => b.classList.remove("on"));
+ if (btn) btn.classList.add("on");
+ renderCards();
+}
+
+function filterSourceSelect(val) {
+ state.activeSourceFilter = val;
+ renderCards();
+}
+
+function filterSeveritySelect(val) {
+ state.activeCardSevFilter = val;
+ renderCards();
+}
+
+function filterSeverity(sev, btn) { state.activeCardSevFilter = sev;
+ document.querySelectorAll(".sev-filter-btn").forEach(b => b.classList.remove("on"));
+ if (btn) {
+ btn.classList.add("on");
+ } else {
+ const target = document.querySelector(`.sev-filter-btn.sev-${sev}`);
+ if (target) target.classList.add("on");
+ }
+ renderCards();
+}
+
+function loadChecklist(pbId) {
+ try {
+ return JSON.parse(localStorage.getItem(`checklist-${pbId}`) || '{}');
+ } catch { return {}; }
+}
+function saveChecklist(pbId, data) {
+ localStorage.setItem(`checklist-${pbId}`, JSON.stringify(data));
+}
+function toggleChecklist(pbId) {
+ const pb = getPlaybookById(pbId);
+ if (!pb) return;
+ state.checklistEnabled = !state.checklistEnabled;
+ renderDetail(pb);
+}
+function toggleChecklistStep(pbId, stepIdx, checked) {
+ const data = loadChecklist(pbId);
+ data[stepIdx] = checked;
+ saveChecklist(pbId, data);
+ const pb = getPlaybookById(pbId);
+ if (pb) renderDetail(pb);
+}
+function resetChecklist(pbId) {
+ localStorage.removeItem(`checklist-${pbId}`);
+ const pb = getPlaybookById(pbId);
+ if (pb) renderDetail(pb);
+}
+function readStepRows(containerId) {
+ const rows = document.querySelectorAll(`#${containerId} .step-row`);
+ return Array.from(rows).map((row, idx) => {
+ const title = row.querySelector(".step-row-title")?.value?.trim() || "";
+ const detail = row.querySelector(".step-row-detail")?.value?.trim() || "";
+ const queries = {};
+ for (const tool of TOOL_ORDER) {
+ const v = row.querySelector(`.step-query-input[data-tool='${tool}']`)?.value?.trim();
+ if (v) queries[tool] = v;
+ }
+ return { n: idx + 1, title, detail, queries };
+ }).filter((s) => s.title || s.detail || Object.keys(s.queries).length > 0);
+}
+
+function stepRowTemplate(index, step = {}) {
+ return `
+
+
${index + 1}
+
+
+
+
+ Tool queries (optional)
+
+ ${TOOL_ORDER.map((tool) => `
+
+ ${esc(TOOL_LABELS[tool])}
+
+
+ `).join("")}
+
+
+
×
+
${esc(info.name)} ` : "";
+ const link = renderMitreLink(tag, false);
+ return `${link}${name}× `;
+ }).join("");
+}
+
+function updateMitreInputHint(value) {
+ const hint = document.getElementById("mitre-input-help");
+ if (!hint) return;
+
+ const query = String(value || "").trim().toUpperCase();
+ if (!query) {
+ hint.textContent = "Enter ATT&CK ID (e.g. T1059.001). Click an added tag to open the ATT&CK page.";
+ return;
+ }
+
+ const exact = state.mitreLookup.get(query);
+ if (exact) {
+ hint.innerHTML = `Matched: ${esc(exact.id)} - ${esc(exact.name)} `;
+ return;
+ }
+
+ const fuzzy = state.mitreIndex.find((t) => t.id.startsWith(query));
+ if (fuzzy) {
+ hint.innerHTML = `Suggestion: ${esc(fuzzy.id)} - ${esc(fuzzy.name)} `;
+ return;
+ }
+
+ hint.textContent = "No known ATT&CK technique ID match yet.";
+}
+
+function populateMitreDatalist() {
+ const list = document.getElementById("mitre-id-suggestions");
+ if (!list) return;
+ list.innerHTML = state.mitreIndex.map((t) => `${esc(t.name)} `).join("");
+}
+
+function setEditMode(editing, playbook) {
+ const eye = document.getElementById("create-eyebrow");
+ const title = document.getElementById("create-title");
+ const meta = document.getElementById("create-meta");
+ const save = document.getElementById("save-playbook-btn");
+ const cancel = document.getElementById("cancel-edit-btn");
+
+ if (editing) {
+ if (eye) eye.textContent = "Analyst tool";
+ if (title) title.textContent = "Edit playbook";
+ if (meta) {
+ meta.innerHTML = `${playbook?.source === "custom" ? "Custom" : "Library override"} `;
+ }
+ if (save) save.textContent = "Update playbook";
+ if (cancel) cancel.style.display = "inline-block";
+ } else {
+ if (eye) eye.textContent = "Analyst tool";
+ if (title) title.textContent = "Create a playbook";
+ if (meta) meta.innerHTML = 'Custom ';
+ if (save) save.textContent = "Save playbook";
+ if (cancel) cancel.style.display = "none";
+ }
+}
+
+function fillFormFromPlaybook(pb) {
+ document.getElementById("f-name").value = pb.name || "";
+ document.getElementById("f-scenario").value = pb.scenario || "";
+ document.getElementById("f-cat").value = pb.cat || "";
+ document.getElementById("f-sev").value = pb.sev || "medium";
+ document.getElementById("f-detection").value = pb.detection || "";
+ document.getElementById("f-primary-query").value = pb.primaryQuery || pb.splunk || "";
+
+ state.mitreTags = [...pb.mitre];
+ renderMitreTags();
+
+ const sections = [
+ ["det-steps", pb.investigation.detectionAnalysis],
+ ["cont-steps", pb.investigation.containment],
+ ["erad-steps", pb.investigation.eradication],
+ ["rec-steps", pb.investigation.recovery]
+ ];
+ for (const [id, steps] of sections) {
+ const body = document.getElementById(id);
+ if (!body) continue;
+ body.innerHTML = "";
+ if (!steps.length) {
+ addStep(id);
+ continue;
+ }
+ steps.forEach((s) => addStep(id, s));
+ }
+}
+
+function collectFormPayload() {
+ const name = document.getElementById("f-name").value.trim();
+ const scenario = document.getElementById("f-scenario").value.trim();
+ const cat = document.getElementById("f-cat").value;
+ const sev = document.getElementById("f-sev").value;
+ const isLibraryEdit = !!state.editingId && state.libraryById.has(state.editingId);
+
+ if (!name || !scenario || !cat) {
+ throw new Error("Please complete title, scenario, and category.");
+ }
+
+ return {
+ name,
+ scenario,
+ cat,
+ sev,
+ type: cat,
+ source: isLibraryEdit ? "library-override" : "custom",
+ detection: document.getElementById("f-detection").value.trim(),
+ mitre: [...state.mitreTags],
+ primaryQuery: document.getElementById("f-primary-query").value.trim(),
+ investigation: {
+ detectionAnalysis: readStepRows("det-steps"),
+ containment: readStepRows("cont-steps"),
+ eradication: readStepRows("erad-steps"),
+ recovery: readStepRows("rec-steps")
+ }
+ };
+}
+
+async function savePlaybook() {
+ try {
+ const payload = collectFormPayload();
+ if (state.editingId) payload.id = state.editingId;
+
+ const endpoint = state.editingId ? API_UPDATE : API_SAVE;
+ const res = await fetch(endpoint, {
+ method: "POST",
+ headers: { "Content-Type": "application/json" },
+ body: JSON.stringify(payload)
+ });
+ const body = await res.json();
+ if (!res.ok || body.error) {
+ throw new Error(body.error || "Failed to save playbook");
+ }
+
+ const banner = document.getElementById("create-success");
+ if (banner) {
+ banner.textContent = state.editingId ? "Playbook updated successfully." : "Playbook saved successfully and added to the library.";
+ banner.style.display = "block";
+ setTimeout(() => { banner.style.display = "none"; }, 2600);
+ }
+
+ state.editingId = null;
+ setEditMode(false);
+ resetForm(false);
+ await refreshData();
+ showPanel("home", document.getElementById("nav-home"));
+ } catch (err) {
+ alert(err.message || "Unable to save playbook.");
+ }
+}
+
+function startEdit(id) {
+ const pb = state.allPlaybooks.find((p) => p.id === id);
+ if (!pb) return;
+ state.editingId = id;
+ setEditMode(true, pb);
+ fillFormFromPlaybook(pb);
+ showPanel("create", document.getElementById("nav-create"));
+}
+
+function cancelEdit() {
+ state.editingId = null;
+ setEditMode(false);
+ resetForm(false);
+}
+
+async function deletePlaybook(id) {
+ const sure = confirm("Delete this playbook? For library playbooks, this reverts your override.");
+ if (!sure) return;
+
+ const res = await fetch(`${API_DELETE}?id=${encodeURIComponent(id)}`, { method: "DELETE" });
+ const body = await res.json().catch(() => ({}));
+ if (!res.ok || body.error) {
+ alert(body.error || "Delete failed.");
+ return;
+ }
+ await refreshData();
+ showPanel("home", document.getElementById("nav-home"));
+}
+
+function resetForm(rebuild = true) {
+ ["f-name", "f-scenario", "f-detection", "f-primary-query"].forEach((id) => {
+ const el = document.getElementById(id);
+ if (el) el.value = "";
+ });
+ const cat = document.getElementById("f-cat");
+ const sev = document.getElementById("f-sev");
+ if (cat) cat.value = "";
+ if (sev) sev.value = "high";
+
+ state.mitreTags = [];
+ renderMitreTags();
+ if (rebuild) resetBuilder();
+}
+
+function validateSigma(ruleText) {
+ if (!ruleText || !String(ruleText).trim()) return null;
+ if (!window.jsyaml) return { ok: false, reason: "YAML parser unavailable" };
+ try {
+ const parsed = window.jsyaml.load(ruleText);
+ const required = ["title", "status", "logsource", "detection"];
+ const missing = required.filter((k) => !parsed?.[k]);
+ if (missing.length) return { ok: false, reason: `Missing: ${missing.join(", ")}` };
+ if (!parsed.detection?.condition) return { ok: false, reason: "Missing: detection.condition" };
+ return { ok: true, reason: "OK" };
+ } catch (err) {
+ return { ok: false, reason: "Invalid YAML" };
+ }
+}
+
+function printPlaybook() {
+ window.print();
+}
+
+function exportSoar(pbId) {
+ const pb = getPlaybookById(pbId);
+ if (!pb) return;
+ const payload = {
+ format: "soc-playbook-soar-v1",
+ exportedAt: new Date().toISOString(),
+ id: pb.id, name: pb.name, type: pb.type,
+ severity: pb.severity || pb.sev, category: pb.cat,
+ mitre: pb.mitre, scenario: pb.scenario,
+ investigation: pb.investigation
+ };
+ const blob = new Blob([JSON.stringify(payload, null, 2)], { type: "application/json" });
+ const url = URL.createObjectURL(blob);
+ const a = document.createElement("a");
+ a.href = url;
+ a.download = `soar-${pb.id}-${(pb.name || '').replace(/[^a-z0-9]/gi,'_').toLowerCase()}.json`;
+ a.click();
+ setTimeout(() => URL.revokeObjectURL(url), 5000);
+}
+
+async function refreshData() {
+ await loadPlaybooks();
+ renderSidebar();
+ renderCards();
+ updateCardCount();
+ renderNavigatorPanel();
+}
+
+function updatePrimaryQueryLabel() {
+ const tool = state.activeTools[0] || "splunk";
+ const toolLabel = ALL_TOOLS[tool]?.label || tool;
+ const lbl = document.getElementById("f-primary-query-label");
+ const ta = document.getElementById("f-primary-query");
+ if (lbl) lbl.innerHTML = `Primary ${toolLabel} query (optional) `;
+ if (ta) ta.placeholder = `Enter an initial triage query for ${toolLabel}…`;
+}
+
+async function loadToolConfig() {
+ try {
+ const r = await fetch("cgi-bin/get_config.sh");
+ if (!r.ok) return;
+ const cfg = await r.json();
+ if (Array.isArray(cfg.tools) && cfg.tools.length > 0) {
+ const valid = cfg.tools.filter(t => ALL_TOOLS[t]).slice(0, 5);
+ if (valid.length > 0) state.activeTools = valid;
+ }
+ } catch (_) { /* network error or CGI unavailable — use defaults */ }
+ DEFAULT_TOOL = state.activeTools.includes(DEFAULT_TOOL_FALLBACK)
+ ? DEFAULT_TOOL_FALLBACK
+ : state.activeTools[0];
+ updatePrimaryQueryLabel();
+}
+
+async function init() {
+ try {
+ await loadToolConfig();
+ await loadMitreTechniques();
+ await refreshData();
+ await loadSops();
+ await loadDocs();
+
+ const savedCardView = localStorage.getItem("pb-card-view");
+ if (savedCardView === "table") {
+ state.activeCardView = "table";
+ document.querySelectorAll(".view-toggle-btn").forEach((b) => b.classList.remove("on"));
+ const tableBtn = document.querySelector(".view-toggle-btn[data-view='table']");
+ if (tableBtn) tableBtn.classList.add("on");
+ renderCards();
+ }
+
+ const cardSearch = document.getElementById("card-search");
+ if (cardSearch) {
+ cardSearch.addEventListener("input", (e) => {
+ state.activeCardSearch = e.target.value || "";
+ renderCards();
+ });
+ }
+
+ populateMitreDatalist();
+ const mitreInput = document.querySelector(".mitre-tag-input");
+ if (mitreInput) {
+ mitreInput.addEventListener("input", (e) => updateMitreInputHint(e.target.value || ""));
+ }
+ updateMitreInputHint("");
+
+ setEditMode(false);
+ resetBuilder();
+ showPanel("home", document.getElementById("nav-home"));
+
+ document.addEventListener("keydown", (e) => {
+ if (e.key === "Escape") closeMobileNav();
+ });
+
+ window.addEventListener("resize", () => {
+ if (!isMobileViewport()) closeMobileNav();
+ });
+ } catch (err) {
+ console.error(err);
+ alert("Failed to initialize playbooks. Check manifest/data files and CGI endpoints.");
+ }
+}
+
+// ── SOP MANAGEMENT ──────────────────────────────────────────────────────────
+
+async function loadSops() {
+ const data = await fetchJson(API_SOP_LOAD).catch(() => []);
+ state.sops = Array.isArray(data) ? data : [];
+ renderSopPanel();
+}
+
+function renderSopPanel() {
+ const panel = document.getElementById("panel-sops");
+ if (!panel) return;
+
+ const categories = [...new Set(state.sops.map(s => s.category))].sort();
+
+ const list = state.sops.length === 0
+ ? `No SOPs uploaded yet.
`
+ : state.sops.map(s => `
+
+
${esc(s.name)}
+
+ ${esc(s.category)}
+ ${formatBytes(s.size)}
+ ${formatDate(s.uploaded_at)}
+
+
✕
+
No documents uploaded yet.
`
+ : state.docs.map(d => `
+
+
${esc(d.name)}
+
+ ${esc(d.category)}
+ ${formatBytes(d.size)}
+ ${formatDate(d.uploaded_at)}
+
+
✕
+
+ ${i < wizardStep ? "✓" : i + 1}
+ ${esc(s.title)}
+
`;
+ }).join("");
+}
+
+function renderWizardStep() {
+ renderWizardProgress();
+ const numEl = document.getElementById("wiz-step-num");
+ if (numEl) numEl.textContent = wizardStep + 1;
+ const labelEl = document.getElementById("wiz-step-label");
+ if (labelEl) labelEl.textContent = WIZARD_STEPS[wizardStep].title;
+
+ const body = document.getElementById("wiz-body");
+ if (body) {
+ body.innerHTML = wizardStepContent();
+ body.scrollTop = 0;
+ }
+
+ const prev = document.getElementById("wiz-prev");
+ const next = document.getElementById("wiz-next");
+ if (prev) prev.style.visibility = wizardStep === 0 ? "hidden" : "visible";
+ if (next) {
+ const isLast = wizardStep === WIZARD_STEPS.length - 1;
+ next.style.display = isLast ? "none" : "";
+ next.textContent = wizardStep === WIZARD_STEPS.length - 2 ? "Review →" : "Next →";
+ }
+
+ // Populate step builders after DOM is ready
+ if (wizardStep === 3) populateWizardStepBuilder("wiz-det-steps", wizardData.detSteps);
+ if (wizardStep === 4) populateWizardStepBuilder("wiz-cont-steps", wizardData.contSteps);
+ if (wizardStep === 5) populateWizardStepBuilder("wiz-erad-steps", wizardData.eradSteps);
+ if (wizardStep === 6) populateWizardStepBuilder("wiz-rec-steps", wizardData.recSteps);
+
+ // Re-render MITRE tags on context step
+ if (wizardStep === 1) setTimeout(() => renderWizardMitreTags(), 0);
+
+ // Update primary query label
+ if (wizardStep === 2) {
+ const first = state.activeTools[0];
+ const lbl = first ? (ALL_TOOLS[first]?.label || first) : "Primary";
+ const el = document.getElementById("wiz-primary-query-label");
+ if (el) el.innerHTML = `${esc(lbl)} query (optional) `;
+ }
+}
+
+function wizardStepContent() {
+ const d = wizardData;
+ const cats = ["Malware","Insider Threat","Cloud","Identity","Application","Network","Supply Chain","Data","Other"];
+ const sevs = [["critical","Critical"],["high","High"],["medium","Medium"],["low","Low"]];
+
+ switch (wizardStep) {
+ case 0:
+ return `
+ Enter the basic identifying details for your new playbook.
+ `;
+
+ case 1:
+ return `
+ Describe what this playbook covers and map it to MITRE ATT&CK techniques.
+ `;
+
+ case 2:
+ return `
+ Specify detection data sources and provide an initial triage query.
+ `;
+
+ case 3:
+ case 4:
+ case 5:
+ case 6: {
+ const phaseLabels = ["Detection & Analysis", "Containment", "Eradication", "Recovery & Lessons Learned"];
+ const phaseDescs = [
+ "Add investigation and analysis steps for this incident type.",
+ "Add steps to contain the threat and limit further damage.",
+ "Add steps to remove the threat and harden the environment.",
+ "Add steps to restore systems and capture lessons learned.",
+ ];
+ const containerIds = ["wiz-det-steps","wiz-cont-steps","wiz-erad-steps","wiz-rec-steps"];
+ const idx = wizardStep - 3;
+ return `
+ ${phaseDescs[idx]}
+
+
${phaseLabels[idx]}
+ + Step
+
+
+
+ Add step
+
Review your playbook. Click Save Playbook to publish it to the library.
+
+
Title ${esc(d.name || "(not set)")}
+
Category ${esc(d.cat || "(not set)")}
+
Severity ${esc(d.sev)}
+
Scenario ${esc(d.scenario ? d.scenario.substring(0,200)+(d.scenario.length>200?"…":"") : "(not set)")}
+
MITRE Tags ${d.mitreTags.length ? d.mitreTags.map(t=>`${esc(t)} `).join(" ") : "(none)"}
+
Detection Sources ${esc(d.detection || "(not set)")}
+
Primary Query ${d.primaryQuery ? '✓ provided ' : "(not set)"}
+ ${stepCounts.map(([lbl,cnt]) => `
${lbl} Steps ${cnt} step${cnt!==1?"s":""}
`).join("")}
+
+ 💾 Save Playbook
+ ← Edit from Start
+
`;
+ }
+
+ default: return "";
+ }
+}
+
+function renderWizardMitreTags() {
+ const host = document.getElementById("wiz-mitre-display");
+ if (!host) return;
+ host.innerHTML = wizardData.mitreTags.map(tag => {
+ const info = getMitreTechniqueInfo(tag);
+ const name = info?.name ? `${esc(info.name)} ` : "";
+ return `${renderMitreLink(tag, false)}${name}× `;
+ }).join("");
+}
+
+function addWizardMitreTag() {
+ const input = document.getElementById("wiz-mitre-input");
+ if (!input) return;
+ const value = normalizeMitreId(input.value);
+ if (!value) return;
+ if (!wizardData.mitreTags.includes(value)) wizardData.mitreTags.push(value);
+ input.value = "";
+ renderWizardMitreTags();
+}
+
+function removeWizardMitreTag(tag) {
+ wizardData.mitreTags = wizardData.mitreTags.filter(t => t !== tag);
+ renderWizardMitreTags();
+}
+
+function addWizardStep(containerId) {
+ const body = document.getElementById(containerId);
+ if (!body) return;
+ const index = body.querySelectorAll(".step-row").length;
+ body.insertAdjacentHTML("beforeend", stepRowTemplate(index, {}));
+}
+
+function populateWizardStepBuilder(containerId, steps) {
+ const body = document.getElementById(containerId);
+ if (!body) return;
+ body.innerHTML = "";
+ if (!steps.length) {
+ addWizardStep(containerId);
+ } else {
+ steps.forEach((s, i) => body.insertAdjacentHTML("beforeend", stepRowTemplate(i, s)));
+ }
+}
+
+function wizardSaveCurrentStep() {
+ switch (wizardStep) {
+ case 0:
+ wizardData.name = document.getElementById("wiz-name")?.value.trim() || "";
+ wizardData.cat = document.getElementById("wiz-cat")?.value || "";
+ wizardData.sev = document.getElementById("wiz-sev")?.value || "high";
+ break;
+ case 1:
+ wizardData.scenario = document.getElementById("wiz-scenario")?.value.trim() || "";
+ break;
+ case 2:
+ wizardData.detection = document.getElementById("wiz-detection")?.value.trim() || "";
+ wizardData.primaryQuery = document.getElementById("wiz-primary-query")?.value.trim() || "";
+ break;
+ case 3: wizardData.detSteps = readStepRows("wiz-det-steps"); break;
+ case 4: wizardData.contSteps = readStepRows("wiz-cont-steps"); break;
+ case 5: wizardData.eradSteps = readStepRows("wiz-erad-steps"); break;
+ case 6: wizardData.recSteps = readStepRows("wiz-rec-steps"); break;
+ }
+}
+
+function wizardValidateStep() {
+ switch (wizardStep) {
+ case 0:
+ if (!document.getElementById("wiz-name")?.value.trim()) {
+ alert("Please enter a playbook title.");
+ return false;
+ }
+ if (!document.getElementById("wiz-cat")?.value) {
+ alert("Please select a category.");
+ return false;
+ }
+ break;
+ case 1:
+ if (!document.getElementById("wiz-scenario")?.value.trim()) {
+ alert("Please enter a scenario description.");
+ return false;
+ }
+ break;
+ }
+ return true;
+}
+
+function wizardNext() {
+ if (!wizardValidateStep()) return;
+ wizardSaveCurrentStep();
+ wizardStep = Math.min(wizardStep + 1, WIZARD_STEPS.length - 1);
+ renderWizardStep();
+}
+
+function wizardPrev() {
+ wizardSaveCurrentStep();
+ wizardStep = Math.max(wizardStep - 1, 0);
+ renderWizardStep();
+}
+
+async function wizardSave() {
+ const { name, scenario, cat, sev, detection, mitreTags, primaryQuery,
+ detSteps, contSteps, eradSteps, recSteps } = wizardData;
+
+ if (!name || !scenario || !cat) {
+ alert("Please complete the title, scenario, and category (steps 1 & 2).");
+ return;
+ }
+
+ const payload = {
+ name, scenario, cat, sev, type: cat, source: "custom",
+ detection, mitre: [...mitreTags], primaryQuery,
+ investigation: {
+ detectionAnalysis: detSteps,
+ containment: contSteps,
+ eradication: eradSteps,
+ recovery: recSteps,
+ }
+ };
+
+ try {
+ const res = await fetch(API_SAVE, {
+ method: "POST",
+ headers: { "Content-Type": "application/json" },
+ body: JSON.stringify(payload),
+ });
+ const body = await res.json();
+ if (!res.ok || body.error) throw new Error(body.error || "Failed to save playbook");
+ closeWizard();
+ await refreshData();
+ showPanel("home", document.getElementById("nav-home"));
+ } catch (err) {
+ alert(err.message || "Unable to save playbook.");
+ }
+}
+
+function initTheme() {
+ const stored = localStorage.getItem('pb-theme') || 'dark';
+ applyTheme(stored, false);
+}
+
+function applyTheme(theme, save = true) {
+ document.documentElement.setAttribute('data-theme', theme);
+ if (save) localStorage.setItem('pb-theme', theme);
+ const btn = document.getElementById('theme-toggle-btn');
+ if (btn) btn.textContent = theme === 'dark' ? '☀' : '🌙';
+ const lightLink = document.getElementById('hljs-light');
+ const darkLink = document.getElementById('hljs-dark');
+ if (lightLink) lightLink.disabled = (theme === 'dark');
+ if (darkLink) darkLink.disabled = (theme === 'light');
+ if (window.hljs) {
+ document.querySelectorAll('pre code').forEach(b => hljs.highlightElement(b));
+ }
+}
+
+function toggleTheme() {
+ const current = document.documentElement.getAttribute('data-theme') || 'dark';
+ applyTheme(current === 'dark' ? 'light' : 'dark');
+}
+
+document.addEventListener("DOMContentLoaded", () => { initTheme(); init(); });
diff --git a/app/cgi-bin/delete_playbook.py b/app/cgi-bin/delete_playbook.py
new file mode 100644
index 0000000..4e3a082
--- /dev/null
+++ b/app/cgi-bin/delete_playbook.py
@@ -0,0 +1,69 @@
+#!/usr/bin/env python3
+import sys, os, json, sqlite3, glob
+
+DB = "/data/playbooks.db"
+SEED_DIR = "/var/www/localhost/htdocs/playbooks"
+
+print("Content-Type: application/json")
+print("Access-Control-Allow-Origin: *")
+print()
+
+def err(msg):
+ print(json.dumps({"error": msg}))
+ sys.exit(0)
+
+method = os.environ.get("REQUEST_METHOD","")
+if method not in ("DELETE", "POST"):
+ err("Method not allowed")
+
+if method == "POST":
+ length = int(os.environ.get("CONTENT_LENGTH", 0) or 0)
+ body = sys.stdin.buffer.read(length) if length > 0 else b""
+ try:
+ pb_id = json.loads(body).get("id","")
+ except Exception:
+ pb_id = ""
+else:
+ qs = os.environ.get("QUERY_STRING","")
+ pb_id = next((p.split("=",1)[1] for p in qs.split("&") if p.startswith("id=")), "")
+
+pb_id = "".join(c for c in pb_id if c.isalnum() or c in "._-")
+if not pb_id:
+ err("Missing id")
+
+try:
+ conn = sqlite3.connect(DB)
+ row = conn.execute("SELECT source FROM playbooks WHERE id=?", (pb_id,)).fetchone()
+ if not row:
+ err("Playbook not found")
+
+ source = row[0]
+ conn.execute("DELETE FROM playbooks WHERE id=?", (pb_id,))
+
+ reverted = False
+ if source in ("custom", "library-override"):
+ # Try to restore the original library version
+ for f in glob.glob(os.path.join(SEED_DIR,"**","*.json"), recursive=True):
+ if os.path.basename(f) in ("manifest.json","mitre-techniques.json"):
+ continue
+ try:
+ with open(f, encoding="utf-8") as fh:
+ data = json.load(fh)
+ if data.get("id") == pb_id:
+ content = json.dumps(data, ensure_ascii=False, separators=(",",":"))
+ conn.execute(
+ "INSERT OR REPLACE INTO playbooks (id,num,name,cat,sev,source,content,updated_at) "
+ "VALUES (?,?,?,?,?,'library',?,datetime('now'))",
+ (pb_id, data.get("num",0), data.get("name",""),
+ data.get("cat","Other"), data.get("sev","medium"), content)
+ )
+ reverted = True
+ break
+ except Exception:
+ pass
+
+ conn.commit()
+ conn.close()
+ print(json.dumps({"ok": True, "deleted": pb_id, "reverted": reverted}))
+except Exception as e:
+ err(str(e))
diff --git a/app/cgi-bin/delete_playbook.sh b/app/cgi-bin/delete_playbook.sh
new file mode 100644
index 0000000..4b3d610
--- /dev/null
+++ b/app/cgi-bin/delete_playbook.sh
@@ -0,0 +1,58 @@
+#!/bin/sh
+# CGI: delete_playbook.sh
+# Expects DELETE request with ?id= query string.
+# Removes the matching /playbooks/.json file.
+
+PLAYBOOKS_DIR="/playbooks"
+OVERRIDE_DIR="${PLAYBOOKS_DIR}/library-overrides"
+
+echo "Content-Type: application/json"
+echo "Access-Control-Allow-Origin: *"
+echo ""
+
+if [ "$REQUEST_METHOD" != "DELETE" ] && [ "$REQUEST_METHOD" != "POST" ]; then
+ echo '{"error":"Method not allowed"}'
+ exit 0
+fi
+
+# Parse id from query string or POST body
+if [ "$REQUEST_METHOD" = "POST" ]; then
+ BODY=$(dd bs=1 count="${CONTENT_LENGTH:-0}" 2>/dev/null)
+ ID=$(echo "$BODY" | grep -o '"id":"[^"]*"' | head -1 | sed 's/"id":"//;s/"//')
+else
+ ID=$(echo "$QUERY_STRING" | grep -o 'id=[^&]*' | sed 's/id=//')
+fi
+
+# Sanitise - allow alphanumeric IDs used by both custom and library playbooks.
+ID=$(echo "$ID" | tr -cd 'a-zA-Z0-9._-')
+
+if [ -z "$ID" ]; then
+ echo '{"error":"Missing id parameter"}'
+ exit 0
+fi
+
+TARGET_CUSTOM="${PLAYBOOKS_DIR}/${ID}.json"
+TARGET_OVERRIDE="${OVERRIDE_DIR}/${ID}.json"
+
+if [ -f "$TARGET_CUSTOM" ]; then
+ rm "$TARGET_CUSTOM"
+ if [ $? -eq 0 ]; then
+ echo "{\"ok\":true,\"deleted\":\"${ID}\",\"source\":\"custom\"}"
+ else
+ echo '{"error":"Failed to delete custom playbook"}'
+ fi
+ exit 0
+fi
+
+if [ -f "$TARGET_OVERRIDE" ]; then
+ rm "$TARGET_OVERRIDE"
+ if [ $? -eq 0 ]; then
+ echo "{\"ok\":true,\"deleted\":\"${ID}\",\"source\":\"library-override\",\"reverted\":true}"
+ else
+ echo '{"error":"Failed to remove library override"}'
+ fi
+ exit 0
+fi
+
+echo '{"error":"Playbook not found"}'
+exit 0
diff --git a/app/cgi-bin/delete_sop.py b/app/cgi-bin/delete_sop.py
new file mode 100644
index 0000000..3917568
--- /dev/null
+++ b/app/cgi-bin/delete_sop.py
@@ -0,0 +1,38 @@
+#!/usr/bin/env python3
+import sys, os, json, sqlite3
+
+DB = "/data/playbooks.db"
+DOCS_DIR = "/data/docs"
+
+print("Content-Type: application/json")
+print("Access-Control-Allow-Origin: *")
+print()
+
+def err(msg):
+ print(json.dumps({"error": msg}))
+ sys.exit(0)
+
+method = os.environ.get("REQUEST_METHOD","")
+if method not in ("DELETE","POST"):
+ err("Method not allowed")
+
+qs = os.environ.get("QUERY_STRING","")
+doc_id = next((p.split("=",1)[1] for p in qs.split("&") if p.startswith("id=")), "")
+doc_id = "".join(c for c in doc_id if c.isalnum() or c in "._-")
+if not doc_id:
+ err("Missing id")
+
+try:
+ conn = sqlite3.connect(DB)
+ row = conn.execute("SELECT filename FROM documents WHERE id=?", (doc_id,)).fetchone()
+ if not row:
+ err("Document not found")
+ filename = row[0]
+ conn.execute("DELETE FROM documents WHERE id=?", (doc_id,))
+ conn.commit()
+ conn.close()
+ try: os.remove(os.path.join(DOCS_DIR, filename))
+ except FileNotFoundError: pass
+ print(json.dumps({"ok":True,"deleted":doc_id}))
+except Exception as e:
+ err(str(e))
diff --git a/app/cgi-bin/get_config.sh b/app/cgi-bin/get_config.sh
new file mode 100644
index 0000000..c4ac866
--- /dev/null
+++ b/app/cgi-bin/get_config.sh
@@ -0,0 +1,16 @@
+#!/bin/sh
+# CGI: get_config.sh
+# Returns the active tool/SIEM selection as JSON, driven by SIEM_TOOL_1..5 env vars.
+# Defaults: sysmon, osquery, velociraptor, elastic, elastic_detection_rules
+
+echo "Content-Type: application/json"
+echo "Access-Control-Allow-Origin: *"
+echo ""
+
+T1="${SIEM_TOOL_1:-sysmon}"
+T2="${SIEM_TOOL_2:-osquery}"
+T3="${SIEM_TOOL_3:-velociraptor}"
+T4="${SIEM_TOOL_4:-elastic}"
+T5="${SIEM_TOOL_5:-elastic_detection_rules}"
+
+printf '{"tools":["%s","%s","%s","%s","%s"]}' "$T1" "$T2" "$T3" "$T4" "$T5"
diff --git a/app/cgi-bin/init_db.py b/app/cgi-bin/init_db.py
new file mode 100644
index 0000000..5d65786
--- /dev/null
+++ b/app/cgi-bin/init_db.py
@@ -0,0 +1,105 @@
+#!/usr/bin/env python3
+"""
+init_db.py — run from entrypoint.sh (not a CGI script).
+Creates the SQLite schema and seeds library playbooks on first boot.
+"""
+import os, sys, json, sqlite3, glob
+
+DB_PATH = "/data/playbooks.db"
+SEED_DIR = "/var/www/localhost/htdocs/playbooks"
+DOCS_DIR = "/data/docs"
+
+SCHEMA = """
+CREATE TABLE IF NOT EXISTS playbooks (
+ id TEXT PRIMARY KEY,
+ num INTEGER DEFAULT 0,
+ name TEXT NOT NULL,
+ cat TEXT DEFAULT 'Other',
+ sev TEXT DEFAULT 'medium',
+ source TEXT DEFAULT 'library',
+ content TEXT NOT NULL,
+ updated_at TEXT DEFAULT (datetime('now'))
+);
+CREATE TABLE IF NOT EXISTS documents (
+ id TEXT PRIMARY KEY,
+ name TEXT NOT NULL,
+ category TEXT DEFAULT 'General',
+ type TEXT DEFAULT 'sop',
+ filename TEXT NOT NULL,
+ size INTEGER DEFAULT 0,
+ uploaded_at TEXT DEFAULT (datetime('now'))
+);
+"""
+
+MIGRATION = """
+-- migrate legacy sops table if it exists (no-op if already done)
+CREATE TABLE IF NOT EXISTS documents (
+ id TEXT PRIMARY KEY, name TEXT NOT NULL, category TEXT DEFAULT 'General',
+ type TEXT DEFAULT 'sop', filename TEXT NOT NULL,
+ size INTEGER DEFAULT 0, uploaded_at TEXT DEFAULT (datetime('now'))
+);
+"""
+
+def main():
+ os.makedirs("/data", exist_ok=True)
+ os.makedirs(DOCS_DIR, exist_ok=True)
+
+ first_run = not os.path.exists(DB_PATH)
+ conn = sqlite3.connect(DB_PATH)
+ conn.executescript(SCHEMA)
+
+ # Migrate from legacy sops table if present
+ tables = {r[0] for r in conn.execute("SELECT name FROM sqlite_master WHERE type='table'")}
+ if "sops" in tables and "documents" in tables:
+ conn.execute(
+ "INSERT OR IGNORE INTO documents (id,name,category,type,filename,size,uploaded_at) "
+ "SELECT id,name,category,'sop',filename,size,uploaded_at FROM sops"
+ )
+ conn.execute("DROP TABLE sops")
+ elif "sops" in tables:
+ conn.execute("ALTER TABLE sops RENAME TO documents")
+ try:
+ conn.execute("ALTER TABLE documents ADD COLUMN type TEXT DEFAULT 'sop'")
+ except Exception:
+ pass
+
+ conn.commit()
+
+ if not first_run:
+ count = conn.execute("SELECT COUNT(*) FROM playbooks").fetchone()[0]
+ if count > 0:
+ print(f"[init_db] DB already seeded ({count} playbooks). Skipping.", flush=True)
+ conn.close()
+ return
+
+ print("[init_db] Seeding playbooks from JSON files...", flush=True)
+ files = glob.glob(os.path.join(SEED_DIR, "**", "*.json"), recursive=True)
+ seeded = 0
+ for f in sorted(files):
+ base = os.path.basename(f)
+ if base in ("manifest.json", "mitre-techniques.json"):
+ continue
+ try:
+ with open(f, encoding="utf-8") as fh:
+ data = json.load(fh)
+ except Exception as e:
+ print(f"[init_db] Skipping {f}: {e}", flush=True)
+ continue
+ pb_id = data.get("id")
+ if not pb_id:
+ continue
+ content = json.dumps(data, ensure_ascii=False, separators=(",", ":"))
+ conn.execute(
+ "INSERT OR IGNORE INTO playbooks (id,num,name,cat,sev,source,content,updated_at) "
+ "VALUES (?,?,?,?,?,'library',?,datetime('now'))",
+ (pb_id, data.get("num", 0), data.get("name",""), data.get("cat","Other"),
+ data.get("sev","medium"), content)
+ )
+ seeded += 1
+
+ conn.commit()
+ conn.close()
+ print(f"[init_db] Done. Seeded {seeded} playbooks.", flush=True)
+
+if __name__ == "__main__":
+ main()
diff --git a/app/cgi-bin/load_playbooks.py b/app/cgi-bin/load_playbooks.py
new file mode 100644
index 0000000..8633301
--- /dev/null
+++ b/app/cgi-bin/load_playbooks.py
@@ -0,0 +1,19 @@
+#!/usr/bin/env python3
+import sys, sqlite3
+
+DB = "/data/playbooks.db"
+
+print("Content-Type: application/json")
+print("Access-Control-Allow-Origin: *")
+print()
+
+try:
+ conn = sqlite3.connect(DB)
+ rows = conn.execute(
+ "SELECT content FROM playbooks ORDER BY num ASC, id ASC"
+ ).fetchall()
+ conn.close()
+ sys.stdout.write("[" + ",".join(r[0] for r in rows) + "]")
+except Exception as e:
+ import json
+ sys.stdout.write(json.dumps({"error": str(e)}))
diff --git a/cgi-bin/load_playbooks.sh b/app/cgi-bin/load_playbooks.sh
similarity index 72%
rename from cgi-bin/load_playbooks.sh
rename to app/cgi-bin/load_playbooks.sh
index e58d4cf..9c848bf 100644
--- a/cgi-bin/load_playbooks.sh
+++ b/app/cgi-bin/load_playbooks.sh
@@ -9,7 +9,7 @@ echo "Access-Control-Allow-Origin: *"
echo ""
# If no files exist, return empty array
-if [ ! -d "$PLAYBOOKS_DIR" ] || [ -z "$(ls "$PLAYBOOKS_DIR"/*.json 2>/dev/null)" ]; then
+if [ ! -d "$PLAYBOOKS_DIR" ] || [ -z "$(find "$PLAYBOOKS_DIR" -maxdepth 2 -name '*.json' 2>/dev/null | head -1)" ]; then
echo "[]"
exit 0
fi
@@ -17,7 +17,7 @@ fi
# Concatenate all JSON files into a valid array
echo "["
FIRST=1
-for FILE in "$PLAYBOOKS_DIR"/*.json; do
+for FILE in $(find "$PLAYBOOKS_DIR" -maxdepth 2 -name '*.json' | sort); do
[ -f "$FILE" ] || continue
if [ $FIRST -eq 1 ]; then
FIRST=0
diff --git a/app/cgi-bin/load_sops.py b/app/cgi-bin/load_sops.py
new file mode 100644
index 0000000..4685f87
--- /dev/null
+++ b/app/cgi-bin/load_sops.py
@@ -0,0 +1,29 @@
+#!/usr/bin/env python3
+import sys, os, json, sqlite3
+
+DB = "/data/playbooks.db"
+
+print("Content-Type: application/json")
+print("Access-Control-Allow-Origin: *")
+print()
+
+qs = os.environ.get("QUERY_STRING","")
+dtype = next((p.split("=",1)[1] for p in qs.split("&") if p.startswith("type=")), "sop")
+dtype = dtype if dtype in ("sop","doc") else "sop"
+
+try:
+ conn = sqlite3.connect(DB)
+ rows = conn.execute(
+ "SELECT id,name,category,type,filename,size,uploaded_at "
+ "FROM documents WHERE type=? ORDER BY uploaded_at DESC",
+ (dtype,)
+ ).fetchall()
+ conn.close()
+ result = [
+ {"id":r[0],"name":r[1],"category":r[2],"type":r[3],
+ "filename":r[4],"size":r[5],"uploaded_at":r[6]}
+ for r in rows
+ ]
+ print(json.dumps(result))
+except Exception as e:
+ print(json.dumps({"error": str(e)}))
diff --git a/app/cgi-bin/save_playbook.py b/app/cgi-bin/save_playbook.py
new file mode 100644
index 0000000..35802c6
--- /dev/null
+++ b/app/cgi-bin/save_playbook.py
@@ -0,0 +1,55 @@
+#!/usr/bin/env python3
+import sys, os, json, sqlite3, time, secrets
+
+DB = "/data/playbooks.db"
+
+print("Content-Type: application/json")
+print("Access-Control-Allow-Origin: *")
+print()
+
+def err(msg):
+ print(json.dumps({"error": msg}))
+ sys.exit(0)
+
+if os.environ.get("REQUEST_METHOD") != "POST":
+ err("Method not allowed")
+
+length = int(os.environ.get("CONTENT_LENGTH", 0) or 0)
+if length <= 0:
+ err("Empty body")
+
+try:
+ body = sys.stdin.buffer.read(length)
+ data = json.loads(body)
+except Exception as e:
+ err(f"Invalid JSON: {e}")
+
+if not data.get("name"):
+ err("Missing required field: name")
+
+pb_id = f"custom-{int(time.time()*1000):x}-{secrets.token_hex(4)}"
+
+try:
+ conn = sqlite3.connect(DB)
+ max_num = conn.execute(
+ "SELECT COALESCE(MAX(num),0) FROM playbooks WHERE source='custom'"
+ ).fetchone()[0]
+ num = max_num + 1
+
+ data["id"] = pb_id
+ data["num"] = num
+ data["source"] = "custom"
+ data["createdAt"] = __import__("datetime").datetime.utcnow().strftime("%Y-%m-%dT%H:%M:%SZ")
+
+ content = json.dumps(data, ensure_ascii=False, separators=(",", ":"))
+ conn.execute(
+ "INSERT INTO playbooks (id,num,name,cat,sev,source,content,updated_at) "
+ "VALUES (?,?,?,?,?,'custom',?,datetime('now'))",
+ (pb_id, num, data.get("name",""), data.get("cat","Other"),
+ data.get("sev","medium"), content)
+ )
+ conn.commit()
+ conn.close()
+ print(json.dumps({"ok": True, "id": pb_id, "num": num}))
+except Exception as e:
+ err(str(e))
diff --git a/cgi-bin/save_playbook.sh b/app/cgi-bin/save_playbook.sh
similarity index 100%
rename from cgi-bin/save_playbook.sh
rename to app/cgi-bin/save_playbook.sh
diff --git a/app/cgi-bin/update_playbook.py b/app/cgi-bin/update_playbook.py
new file mode 100644
index 0000000..a1417ee
--- /dev/null
+++ b/app/cgi-bin/update_playbook.py
@@ -0,0 +1,56 @@
+#!/usr/bin/env python3
+import sys, os, json, sqlite3
+
+DB = "/data/playbooks.db"
+
+print("Content-Type: application/json")
+print("Access-Control-Allow-Origin: *")
+print()
+
+def err(msg):
+ print(json.dumps({"error": msg}))
+ sys.exit(0)
+
+if os.environ.get("REQUEST_METHOD") != "POST":
+ err("Method not allowed")
+
+length = int(os.environ.get("CONTENT_LENGTH", 0) or 0)
+if length <= 0:
+ err("Empty body")
+
+try:
+ body = sys.stdin.buffer.read(length)
+ data = json.loads(body)
+except Exception as e:
+ err(f"Invalid JSON: {e}")
+
+pb_id = str(data.get("id", "")).strip()
+if not pb_id:
+ err("Missing required field: id")
+
+try:
+ conn = sqlite3.connect(DB)
+ row = conn.execute("SELECT source FROM playbooks WHERE id=?", (pb_id,)).fetchone()
+ if row:
+ old_source = row[0]
+ new_source = "library-override" if old_source == "library" else old_source
+ else:
+ new_source = "library-override"
+
+ data["source"] = new_source
+ content = json.dumps(data, ensure_ascii=False, separators=(",", ":"))
+
+ conn.execute(
+ "INSERT INTO playbooks (id,num,name,cat,sev,source,content,updated_at) "
+ "VALUES (?,?,?,?,?,?,?,datetime('now')) "
+ "ON CONFLICT(id) DO UPDATE SET "
+ "name=excluded.name, cat=excluded.cat, sev=excluded.sev, "
+ "source=excluded.source, content=excluded.content, updated_at=excluded.updated_at",
+ (pb_id, data.get("num",0), data.get("name",""), data.get("cat","Other"),
+ data.get("sev","medium"), new_source, content)
+ )
+ conn.commit()
+ conn.close()
+ print(json.dumps({"ok": True, "id": pb_id, "source": new_source}))
+except Exception as e:
+ err(str(e))
diff --git a/app/cgi-bin/update_playbook.sh b/app/cgi-bin/update_playbook.sh
new file mode 100644
index 0000000..b07a4d5
--- /dev/null
+++ b/app/cgi-bin/update_playbook.sh
@@ -0,0 +1,56 @@
+#!/bin/sh
+# CGI: update_playbook.sh
+# Updates an existing playbook.
+# - If custom exists (/playbooks/.json), overwrite it.
+# - Else write library override to /playbooks/library-overrides/.json.
+
+PLAYBOOKS_DIR="/playbooks"
+OVERRIDE_DIR="${PLAYBOOKS_DIR}/library-overrides"
+
+echo "Content-Type: application/json"
+echo "Access-Control-Allow-Origin: *"
+echo ""
+
+if [ "$REQUEST_METHOD" != "POST" ]; then
+ echo '{"error":"Method not allowed"}'
+ exit 0
+fi
+
+BODY=""
+if [ -n "$CONTENT_LENGTH" ] && [ "$CONTENT_LENGTH" -gt 0 ]; then
+ BODY=$(dd bs=1 count="$CONTENT_LENGTH" 2>/dev/null)
+fi
+
+if [ -z "$BODY" ]; then
+ echo '{"error":"Empty body"}'
+ exit 0
+fi
+
+ID=$(echo "$BODY" | grep -o '"id":"[^"]*"' | head -1 | sed 's/"id":"//;s/"//')
+ID=$(echo "$ID" | tr -cd 'a-zA-Z0-9._-')
+
+if [ -z "$ID" ]; then
+ echo '{"error":"Missing required field: id"}'
+ exit 0
+fi
+
+mkdir -p "$PLAYBOOKS_DIR"
+mkdir -p "$OVERRIDE_DIR"
+
+CUSTOM_TARGET="${PLAYBOOKS_DIR}/${ID}.json"
+OVERRIDE_TARGET="${OVERRIDE_DIR}/${ID}.json"
+
+TARGET="$OVERRIDE_TARGET"
+SOURCE="library-override"
+if [ -f "$CUSTOM_TARGET" ]; then
+ TARGET="$CUSTOM_TARGET"
+ SOURCE="custom"
+fi
+
+echo "$BODY" > "$TARGET"
+if [ $? -ne 0 ]; then
+ echo '{"error":"Failed to update playbook"}'
+ exit 0
+fi
+
+echo "{\"ok\":true,\"id\":\"${ID}\",\"source\":\"${SOURCE}\"}"
diff --git a/app/cgi-bin/upload_sop.py b/app/cgi-bin/upload_sop.py
new file mode 100644
index 0000000..7f595f7
--- /dev/null
+++ b/app/cgi-bin/upload_sop.py
@@ -0,0 +1,67 @@
+#!/usr/bin/env python3
+import sys, os, json, sqlite3, time, secrets, cgi
+
+DB = "/data/playbooks.db"
+DOCS_DIR = "/data/docs"
+
+print("Content-Type: application/json")
+print("Access-Control-Allow-Origin: *")
+print()
+
+def err(msg):
+ print(json.dumps({"error": msg}))
+ sys.exit(0)
+
+if os.environ.get("REQUEST_METHOD") != "POST":
+ err("Method not allowed")
+
+os.makedirs(DOCS_DIR, exist_ok=True)
+
+try:
+ form = cgi.FieldStorage(fp=sys.stdin.buffer, environ=os.environ, keep_blank_values=True)
+except Exception as e:
+ err(f"Failed to parse upload: {e}")
+
+file_item = form["file"] if "file" in form else None
+if file_item is None or (hasattr(file_item,"filename") and not file_item.filename):
+ err("No file provided")
+
+if hasattr(file_item,"file"):
+ raw = file_item.file.read()
+ original_filename = file_item.filename or "upload.pdf"
+else:
+ raw = file_item if isinstance(file_item,bytes) else str(file_item).encode()
+ original_filename = "upload.pdf"
+
+if not raw:
+ err("Empty file")
+
+name = (form.getvalue("name") or os.path.splitext(original_filename)[0]).strip()
+category = (form.getvalue("category") or "General").strip()
+dtype = form.getvalue("type") or "sop"
+dtype = dtype if dtype in ("sop","doc") else "sop"
+
+doc_id = f"{dtype}-{int(time.time()*1000):x}-{secrets.token_hex(4)}"
+filename = f"{doc_id}.pdf"
+filepath = os.path.join(DOCS_DIR, filename)
+
+try:
+ with open(filepath,"wb") as fh:
+ fh.write(raw)
+except Exception as e:
+ err(f"Failed to save file: {e}")
+
+try:
+ conn = sqlite3.connect(DB)
+ conn.execute(
+ "INSERT INTO documents (id,name,category,type,filename,size,uploaded_at) "
+ "VALUES (?,?,?,?,?,?,datetime('now'))",
+ (doc_id, name, category, dtype, filename, len(raw))
+ )
+ conn.commit()
+ conn.close()
+ print(json.dumps({"ok":True,"id":doc_id,"name":name,"filename":filename,"type":dtype}))
+except Exception as e:
+ try: os.remove(filepath)
+ except Exception: pass
+ err(str(e))
diff --git a/app/index.html b/app/index.html
new file mode 100644
index 0000000..39cc8b0
--- /dev/null
+++ b/app/index.html
@@ -0,0 +1,369 @@
+
+
+
+SOC IR Playbook Library
+☰
+
+
+
+
+
+
+
+
+
+
+
SOC Incident Response
+
Playbook Library
+
Sysmon · OSQuery · Velociraptor · Elastic · MITRE ATT&CK mapped
+
+ 0 playbooks
+ Sysmon XML
+ OSQuery SQL
+ Velociraptor VQL
+ Elastic EQL
+ Elastic Detection Rules
+ MITRE mapped
+
+
+
+
+
+ Filter:
+ All
+ Malware
+ Cloud
+ Identity
+ Insider
+ Application
+ Supply Chain
+ Data
+ Network
+ Threat Groups
+ Custom
+
+
+
+
+
+ Severity
+
+ All severities
+ Critical
+ High
+ Medium
+ Low
+
+
+
+ Source
+
+ All sources
+ 📚 Default
+ ✏️ Custom / Edited
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Base procedure — all alerts
+
Alert intake, triage, escalation & documentation
+
Universal SIEM + EDR Last updated 2026-05-18
+
+
1 Intake
+
2 Triage
+
3 Decision
+
4 Document
+
+
Phase 1 — Alert intake
+
1
Open and validate the alert context
Capture: alert name, rule/correlation ID, severity, detection source, first/last seen, triggering entities (host, user, IP, process), and affected environment (prod/dev/test).
+
2
Pull raw telemetry for the full event window
Review raw events before making a verdict. Use at least a 30-minute lookback around the trigger.index=* earliest=-30m latest=now | search [correlation_filter] | table _time, host, user, src_ip, dest_ip, process, action
+
3
Classify criticality and exposure
Determine asset criticality, data sensitivity, external exposure, and blast radius. Mark as isolated, host-scoped, user-scoped, or environment-wide.
+
+
Phase 2 — Triage checklist
+
Check Action Source
+ False positive candidate? Compare to baseline behavior, suppression history, and known tuning notes SIEM Threat intel Look up all IPs, domains, hashes against IOC feeds TI / OSINT Scope Determine if activity is single-entity, multi-host, or lateral movement. Pivot on host, user, process, and network indicators. SIEM + EDR Volume and timing Check if this is bursty, periodic, or sustained activity. Compare 24h and 7d trends. SIEM Historical context Review prior related incidents, previous verdicts, and recurrence patterns. Case Mgmt Business impact Assess potential impact to operations, data confidentiality, integrity, and availability. CMDB / owner
+
Phase 3 — Decision & escalation
+
Verdict Action Priority
+ False positive Close with evidence, root-cause the trigger, and raise tuning request. Informational Benign true positive Document expected behavior and implement suppression with expiry/review date. Low Suspicious / inconclusive Escalate to Tier 2 with timeline, key observables, and hypothesis. Medium Confirmed malicious Trigger incident response workflow, contain immediately, notify stakeholders, preserve forensic evidence. High / P1
+
Phase 4 — Documentation
+
A
Maintain an investigation timeline
Log each action with timestamp, analyst, source consulted, and rationale. Keep notes audit-ready.
+
B
Attach supporting evidence
Include key queries, event excerpts, indicator list, impacted entities, and containment actions performed.
+
C
Close or hand off with a clear summary
State verdict, confidence, impact, and follow-up tasks. If escalated, provide a concise handoff package for the next team.
+
+
+
+
+
+
+
+
+
Coverage visualization
+
MITRE ATT&CK Navigator
+
+ Monitored techniques
+ Playbook mapped
+
+
+
+
+
+
+
Analyst tool
+
Create a playbook
+
Custom
+
Playbook saved successfully and added to the library.
+
+
+
+
+
Investigation steps
+
+
Detection & analysis + Step
+
+
+ Add detection step
+
+
+
Containment + Step
+
+
+ Add containment step
+
+
+
Eradication + Step
+
+
+ Add eradication step
+
+
+
Recovery & lessons learned + Step
+
+
+ Add recovery step
+
+
+
+ Save playbook
+ Cancel edit
+ Clear form
+
+
+
+
+
+
+
+
+
+
+
📄
+
Select an SOP to view
+
Click any SOP from the list to open it here
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
🔍
+
Select a document to view
+
Elastic EQL · Elasticsearch detections · Velociraptor VQL
+
+
+
+
+
+
+
+
+
kernel32.dll;ntdll.dll kernel32.dll;ntdll.dll powershell.exe 135;139;445;3389 powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe .locked;.encrypted;.crypt;README lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe 135;139;445;3389 \\\\.[a-z]+)$\" | stats count by ext | sort -count",
+ "kql": null,
+ "qradar": null,
+ "sigma": null,
+ "velociraptor": "SELECT Pid, Name, CommandLine, Exe, CreateTime FROM pslist() ORDER BY CreateTime DESC LIMIT 150",
+ "carbon_black": "(process_name:cmd.exe OR process_name:powershell.exe OR process_name:wscript.exe OR process_name:cscript.exe OR process_name:mshta.exe) AND (parent_name:w3wp.exe OR parent_name:httpd.exe OR parent_name:nginx.exe OR parent_name:php-cgi.exe)",
+ "sysmon": "powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe .locked;.encrypted;.crypt;README powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe 135;139;445;3389 powershell.exe . .locked;.encrypted;.crypt;README powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe 135;139;445;3389 powershell.exe;cmd.exe;wscript.exe;cscript.exe kernel32.dll;ntdll.dll lsass.exe 0x1fffff;0x1010 powershell.exe . kernel32.dll;ntdll.dll powershell.exe . lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe \\\\Run\\\\;\\\\RunOnce\\\\;\\\\Policies\\\\Explorer\\\\Run powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe lsass.exe 0x1fffff;0x1010 kernel32.dll;ntdll.dll powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe '\n| project TimeGenerated, UserPrincipalName, IPAddress, AppDisplayName, ResultType, LocationDetails\n| order by TimeGenerated desc",
+ "qradar": "SELECT username, sourceip, QIDNAME(qid) as event, starttime FROM events WHERE sourceip = '' ORDER BY starttime DESC LAST 24 HOURS",
+ "sigma": null,
+ "velociraptor": null,
+ "carbon_black": null,
+ "sysmon": "lsass.exe 0x1fffff;0x1010 '\n| project TimeGenerated, OperationName, TargetResources, InitiatedBy\n| order by TimeGenerated desc",
+ "qradar": "SELECT username, QIDNAME(qid) as event, \"Target\" as resource, starttime FROM events WHERE username = '' AND logsourcetypename(devicetype) ILIKE '%Azure AD%' ORDER BY starttime DESC LAST 24 HOURS",
+ "sigma": null,
+ "velociraptor": "SELECT Pid, Name, CommandLine, Exe, CreateTime FROM pslist() ORDER BY CreateTime DESC LIMIT 150",
+ "carbon_black": null,
+ "sysmon": "powershell.exe;cmd.exe;wscript.exe;cscript.exe \\\\Run\\\\;\\\\RunOnce\\\\;\\\\Policies\\\\Explorer\\\\Run powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe '\n| summarize Attempts=count() by UserPrincipalName, IPAddress, ResultType\n| order by Attempts desc",
+ "qradar": "SELECT sourceip, username, COUNT(*) as attempts, QIDNAME(qid) as event FROM events WHERE sourceip = '' AND logsourcetypename(devicetype) ILIKE '%Azure AD%' GROUP BY sourceip, username, event ORDER BY attempts DESC LAST 24 HOURS",
+ "sigma": null,
+ "velociraptor": null,
+ "carbon_black": null,
+ "sysmon": "powershell.exe;cmd.exe;wscript.exe;cscript.exe lsass.exe 0x1fffff;0x1010 '\n| project TimeGenerated, Operation, UserId, ClientIPAddress, Parameters\n| order by TimeGenerated desc",
+ "qradar": "SELECT username, QIDNAME(qid) as event, \"Parameters\" as params, starttime FROM events WHERE logsourcetypename(devicetype) ILIKE '%Office 365%' AND QIDNAME(qid) ILIKE '%InboxRule%' AND username = '' ORDER BY starttime DESC LAST 24 HOURS",
+ "sigma": null,
+ "velociraptor": null,
+ "carbon_black": null,
+ "sysmon": "powershell.exe;cmd.exe;wscript.exe;cscript.exe '\n| project TimeGenerated, OperationName, Actor, TargetResources\n| order by TimeGenerated desc",
+ "qradar": "SELECT username, QIDNAME(qid) as event, \"Target\" as app, starttime FROM events WHERE logsourcetypename(devicetype) ILIKE '%Azure AD%' AND (QIDNAME(qid) ILIKE '%OAuth%' OR QIDNAME(qid) ILIKE '%consent%') ORDER BY starttime DESC LAST 7 DAYS",
+ "sigma": null,
+ "velociraptor": null,
+ "carbon_black": null,
+ "sysmon": "powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe \\\\Run\\\\;\\\\RunOnce\\\\;\\\\Policies\\\\Explorer\\\\Run '\n| summarize Logins=count() by IPAddress, tostring(LocationDetails.countryOrRegion), bin(TimeGenerated, 1d)\n| order by TimeGenerated desc",
+ "qradar": "SELECT username, sourceip, COUNT(*) as logins, starttime FROM events WHERE username = '' AND logsourcetypename(devicetype) ILIKE '%Azure AD%' GROUP BY username, sourceip, starttime ORDER BY logins DESC LAST 30 DAYS",
+ "sigma": null,
+ "velociraptor": null,
+ "carbon_black": null,
+ "sysmon": "powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe kernel32.dll;ntdll.dll powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe lsass.exe 0x1fffff;0x1010 169.254.169.254;metadata;imds;assume-role powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 powershell.exe;cmd.exe;wscript.exe;cscript.exe lsass.exe 0x1fffff;0x1010 \\\\Run\\\\;\\\\RunOnce\\\\;\\\\Policies\\\\Explorer\\\\Run powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe .locked;.encrypted;.crypt;README lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe lsass.exe 0x1fffff;0x1010 \\\\Run\\\\;\\\\RunOnce\\\\;\\\\Policies\\\\Explorer\\\\Run powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 powershell.exe;cmd.exe;wscript.exe;cscript.exe .locked;.encrypted;.crypt;README powershell.exe -enc;-nop;IEX;DownloadString powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;wscript.exe;cscript.exe .locked;.encrypted;.crypt;README powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe kernel32.dll;ntdll.dll powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe 135;139;445;3389 lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 lsass.exe 0x1fffff;0x1010 lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe . [^.]+)\\\\.\" | eval sub_len=len(sub) | stats count avg(sub_len) as avg_len by query | where avg_len > 30 | sort -avg_len",
+ "kql": "DnsEvents\n| where TimeGenerated > ago(1h)\n| where Name has '.'\n| extend SubLabel = extract('^([^.]+)\\\\.', 1, Name)\n| extend SubLen = strlen(SubLabel)\n| where SubLen > 30\n| summarize QueryCount=count(), AvgSubLen=avg(SubLen) by ClientIP, Name\n| order by AvgSubLen desc",
+ "qradar": "SELECT sourceip, \"DNS Query\" as query, COUNT(*) as requests FROM events WHERE logsourcetypename(devicetype) ILIKE '%DNS%' GROUP BY sourceip, query HAVING COUNT(*) > 20 ORDER BY requests DESC LAST 1 HOURS",
+ "sigma": null,
+ "velociraptor": "SELECT Laddr, Lport, Raddr, Rport, State, Pid, Name, Ctime FROM netstat() WHERE Rport = 53 AND Name =~ '(?i)(powershell|cmd|nslookup|python|perl)' ORDER BY Ctime DESC LIMIT 200",
+ "carbon_black": "netconn_count:[20 TO *] AND (process_name:powershell.exe OR process_name:cmd.exe OR process_name:nslookup.exe)",
+ "sysmon": "powershell.exe . '\n| where RemotePort !in (80, 443, 53, 22)\n| summarize Connections=count() by RemoteIP, RemotePort\n| order by Connections desc",
+ "qradar": "SELECT sourceip, destinationip, destinationport, COUNT(*) as conn FROM events WHERE sourceip = '' AND destinationport NOT IN (80, 443, 53, 22) AND logsourcetypename(devicetype) ILIKE '%Firewall%' GROUP BY sourceip, destinationip, destinationport ORDER BY conn DESC LAST 1 HOURS",
+ "sigma": null,
+ "velociraptor": "SELECT Laddr, Lport, Raddr, Rport, State, Pid, Name, Ctime FROM netstat() WHERE Rport = 53 AND Name =~ '(?i)(powershell|cmd|nslookup|python|perl)' ORDER BY Ctime DESC LIMIT 200",
+ "carbon_black": "netconn_count:[20 TO *] AND (process_name:powershell.exe OR process_name:cmd.exe OR process_name:nslookup.exe)",
+ "sysmon": "powershell.exe . '\n| summarize Queries=count() by ClientIP\n| order by Queries desc",
+ "qradar": "SELECT sourceip, COUNT(*) as queries FROM events WHERE logsourcetypename(devicetype) ILIKE '%DNS%' AND \"DNS Query\" ILIKE '%%' GROUP BY sourceip ORDER BY queries DESC LAST 24 HOURS",
+ "sigma": null,
+ "velociraptor": "SELECT Laddr, Lport, Raddr, Rport, State, Pid, Name, Ctime FROM netstat() WHERE Rport = 53 AND Name =~ '(?i)(powershell|cmd|nslookup|python|perl)' ORDER BY Ctime DESC LIMIT 200",
+ "carbon_black": "netconn_count:[20 TO *] AND (process_name:powershell.exe OR process_name:cmd.exe OR process_name:nslookup.exe)",
+ "sysmon": "powershell.exe . '\n| summarize Queries=count() by ClientIP, Name\n| order by Queries desc",
+ "qradar": "SELECT sourceip, \"DNS Query\" as query, COUNT(*) as requests FROM events WHERE logsourcetypename(devicetype) ILIKE '%DNS%' AND \"DNS Query\" ILIKE '%%' GROUP BY sourceip, query ORDER BY requests DESC LAST 15 MINUTES",
+ "sigma": null,
+ "velociraptor": "SELECT Laddr, Lport, Raddr, Rport, State, Pid, Name, Ctime FROM netstat() WHERE Rport = 53 AND Name =~ '(?i)(powershell|cmd|nslookup|python|perl)' ORDER BY Ctime DESC LIMIT 200",
+ "carbon_black": "netconn_count:[20 TO *] AND (process_name:powershell.exe OR process_name:cmd.exe OR process_name:nslookup.exe)",
+ "sysmon": "powershell.exe . '\n| summarize Connections=count() by RemoteIP, RemotePort\n| order by Connections desc",
+ "qradar": "SELECT sourceip, destinationip, destinationport, COUNT(*) as conn FROM events WHERE sourceip = '' AND logsourcetypename(devicetype) ILIKE '%Firewall%' GROUP BY sourceip, destinationip, destinationport ORDER BY conn DESC LAST 1 HOURS",
+ "sigma": null,
+ "velociraptor": null,
+ "carbon_black": null,
+ "sysmon": "powershell.exe . '\n| where FileName in ('dnscat2.exe','iodine.exe','ncat.exe','dns2tcp.exe','powerdns.exe')\n| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, SHA256\n| order by TimeGenerated desc",
+ "qradar": "SELECT sourceip, \"Process Name\" as process, \"Command Line\" as cmdline, starttime FROM events WHERE logsourcetypename(devicetype) ILIKE '%Sysmon%' AND QIDNAME(qid) ILIKE '%ProcessCreate%' AND \"Process Name\" ILIKE '%dns%' ORDER BY starttime DESC LAST 24 HOURS",
+ "sigma": null,
+ "velociraptor": null,
+ "carbon_black": null,
+ "sysmon": "powershell.exe . powershell.exe;cmd.exe;wscript.exe;cscript.exe '\n| where RegistryKey has_any ('Run','RunOnce','Policies\\\\Explorer\\\\Run')\n| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData\n| order by TimeGenerated desc",
+ "qradar": "SELECT sourceip, \"Registry Key\" as regkey, QIDNAME(qid) as event, starttime FROM events WHERE logsourcetypename(devicetype) ILIKE '%Sysmon%' AND QIDNAME(qid) ILIKE '%Registry%' AND sourceip = '' ORDER BY starttime DESC LAST 24 HOURS",
+ "sigma": null,
+ "velociraptor": null,
+ "carbon_black": null,
+ "sysmon": "\\\\Run\\\\;\\\\RunOnce\\\\;\\\\Policies\\\\Explorer\\\\Run '\n| where SubType == 'LookupQuery'\n| summarize Queries=count() by QueryType, Name\n| order by Queries desc",
+ "qradar": "SELECT sourceip, \"DNS Query\" as query, \"Record Type\" as type, COUNT(*) as requests FROM events WHERE logsourcetypename(devicetype) ILIKE '%DNS%' AND sourceip = '' GROUP BY sourceip, query, type ORDER BY requests DESC LAST 24 HOURS",
+ "sigma": null,
+ "velociraptor": null,
+ "carbon_black": null,
+ "sysmon": "powershell.exe . powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 powershell.exe . )\n| where RemotePort == 53\n| summarize DNSQueries=count() by DeviceName, RemoteIP, bin(TimeGenerated, 1h)\n| order by TimeGenerated desc",
+ "qradar": "SELECT sourceip, destinationip, COUNT(*) as queries FROM events WHERE destinationport = 53 AND sourceip IN () AND logsourcetypename(devicetype) ILIKE '%DNS%' GROUP BY sourceip, destinationip ORDER BY queries DESC LAST 3 DAYS",
+ "sigma": null,
+ "velociraptor": null,
+ "carbon_black": null,
+ "sysmon": "powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 lsass.exe 0x1fffff;0x1010 powershell.exe . powershell.exe -enc;-nop;IEX;DownloadString powershell.exe;cmd.exe;wscript.exe;cscript.exe lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe .locked;.encrypted;.crypt;README kernel32.dll;ntdll.dll powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe lsass.exe 0x1fffff;0x1010 '\n| project TimeGenerated, SenderFromAddress, RecipientEmailAddress, Subject, SenderIPv4, AuthenticationDetails\n| order by TimeGenerated desc",
+ "qradar": "SELECT \"Sender\" as sender, \"Recipient\" as recipient, \"Subject\" as subject, sourceip, starttime FROM events WHERE logsourcetypename(devicetype) ILIKE '%Office 365%' AND QIDNAME(qid) ILIKE '%email%' ORDER BY starttime DESC LAST 24 HOURS",
+ "sigma": null,
+ "velociraptor": null,
+ "carbon_black": null,
+ "sysmon": "powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe '\n| where RecipientEmailAddress has_any ('finance','payroll','accounts','hr','vendor')\n| project TimeGenerated, SenderFromAddress, RecipientEmailAddress, Subject\n| order by TimeGenerated desc",
+ "qradar": "SELECT \"Sender\" as sender, \"Recipient\" as recipient, \"Subject\" as subject, starttime FROM events WHERE logsourcetypename(devicetype) ILIKE '%Office 365%' AND \"Sender\" = '' ORDER BY starttime DESC LAST 24 HOURS",
+ "sigma": null,
+ "velociraptor": "SELECT Pid, Name, CommandLine, Exe, CreateTime FROM pslist() ORDER BY CreateTime DESC LIMIT 150",
+ "carbon_black": null,
+ "sysmon": "lsass.exe 0x1fffff;0x1010 '\n| project TimeGenerated, UserPrincipalName, IPAddress, AppDisplayName, ResultType, LocationDetails\n| order by TimeGenerated desc",
+ "qradar": "SELECT username, sourceip, QIDNAME(qid) as event, starttime FROM events WHERE username = '' AND logsourcetypename(devicetype) ILIKE '%Azure AD%' ORDER BY starttime DESC LAST 24 HOURS",
+ "sigma": null,
+ "velociraptor": null,
+ "carbon_black": null,
+ "sysmon": "lsass.exe 0x1fffff;0x1010 '\n| project TimeGenerated, UserId, Operation, Parameters, ClientIPAddress\n| order by TimeGenerated desc",
+ "qradar": "SELECT username, QIDNAME(qid) as event, \"Parameters\" as params, starttime FROM events WHERE logsourcetypename(devicetype) ILIKE '%Office 365%' AND QIDNAME(qid) ILIKE '%InboxRule%' AND username = '' ORDER BY starttime DESC LAST 24 HOURS",
+ "sigma": null,
+ "velociraptor": null,
+ "carbon_black": null,
+ "sysmon": "powershell.exe;cmd.exe;wscript.exe;cscript.exe '\n| where Subject has_any ('wire','transfer','invoice','payment','urgent')\n| project TimeGenerated, SenderFromAddress, RecipientEmailAddress, Subject\n| order by TimeGenerated desc",
+ "qradar": "SELECT \"Sender\" as sender, \"Recipient\" as recipient, \"Subject\" as subject, starttime FROM events WHERE logsourcetypename(devicetype) ILIKE '%Office 365%' AND \"Sender\" = '' AND LOWER(\"Subject\") LIKE '%wire%' OR LOWER(\"Subject\") LIKE '%invoice%' ORDER BY starttime DESC LAST 48 HOURS",
+ "sigma": null,
+ "velociraptor": null,
+ "carbon_black": null,
+ "sysmon": "powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 '\n| summarize count() by Operation\n| order by count_ desc",
+ "qradar": "SELECT username, QIDNAME(qid) as event, COUNT(*) as occurrences FROM events WHERE username = '' AND logsourcetypename(devicetype) ILIKE '%Office 365%' GROUP BY username, event ORDER BY occurrences DESC LAST 7 DAYS",
+ "sigma": null,
+ "velociraptor": "SELECT Pid, Name, CommandLine, Exe, CreateTime FROM pslist() ORDER BY CreateTime DESC LIMIT 150",
+ "carbon_black": null,
+ "sysmon": "powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 powershell.exe;cmd.exe;wscript.exe;cscript.exe '\n| where Operation in ('New-InboxRule','Set-InboxRule','Add-MailboxPermission','SendAs')\n| project TimeGenerated, UserId, Operation, ClientIPAddress, Parameters\n| order by TimeGenerated desc",
+ "qradar": "SELECT username, QIDNAME(qid) as event, COUNT(*) as occurrences, starttime FROM events WHERE username = '' AND logsourcetypename(devicetype) ILIKE '%Office 365%' GROUP BY username, event, starttime ORDER BY occurrences DESC LAST 30 DAYS",
+ "sigma": null,
+ "velociraptor": "SELECT Pid, Name, CommandLine, Exe, CreateTime FROM pslist() ORDER BY CreateTime DESC LIMIT 150",
+ "carbon_black": null,
+ "sysmon": "powershell.exe;cmd.exe;wscript.exe;cscript.exe lsass.exe 0x1fffff;0x1010 '\n| where EventID in (4624, 4625, 4672, 4648)\n| summarize count() by EventID, WorkstationName, IpAddress, bin(TimeGenerated, 1h)\n| order by TimeGenerated desc",
+ "qradar": "SELECT username, sourceip, QIDNAME(qid) as event, COUNT(*) as occurrences FROM events WHERE username = '' AND logsourcetypename(devicetype) ILIKE '%Windows%' GROUP BY username, sourceip, event ORDER BY occurrences DESC LAST 7 DAYS",
+ "sigma": null,
+ "velociraptor": "SELECT Laddr, Lport, Raddr, Rport, State, Pid, Name, Ctime FROM netstat() WHERE Rport IN (22,53,80,443,8080,8443) AND Name =~ '(?i)(powershell|cmd|wscript|cscript|rundll32|mshta|curl|wget)' ORDER BY Ctime DESC LIMIT 200",
+ "carbon_black": "netconn_count:[10 TO *] AND NOT (process_name:chrome.exe OR process_name:msedge.exe OR process_name:firefox.exe OR process_name:outlook.exe OR process_name:teams.exe OR process_name:OneDrive.exe)",
+ "sysmon": "lsass.exe 0x1fffff;0x1010 '\n| where InitiatingProcessFileName in ('outlook.exe','chrome.exe','firefox.exe','iexplore.exe','w3wp.exe')\n| where FileName in ('cmd.exe','powershell.exe','wscript.exe','mshta.exe')\n| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName\n| order by TimeGenerated desc",
+ "qradar": "SELECT sourceip, \"Process Name\" as process, \"Parent Process\" as parent, \"Command Line\" as cmdline, starttime FROM events WHERE logsourcetypename(devicetype) ILIKE '%Sysmon%' AND QIDNAME(qid) ILIKE '%ProcessCreate%' AND username = '' ORDER BY starttime DESC LAST 24 HOURS",
+ "sigma": null,
+ "velociraptor": "SELECT Child.Pid, Child.Name, Child.CommandLine, Parent.Name AS ParentName, Child.CreateTime FROM pslist() AS Child JOIN pslist() AS Parent ON Child.Ppid = Parent.Pid WHERE Parent.Name IN ('outlook.exe', 'chrome.exe', 'firefox.exe', 'iexplore.exe', 'w3wp.exe') AND Child.Name IN ('cmd.exe', 'powershell.exe')",
+ "carbon_black": "(process_name:cmd.exe OR process_name:powershell.exe OR process_name:wscript.exe OR process_name:mshta.exe) AND (parent_name:outlook.exe OR parent_name:chrome.exe OR parent_name:firefox.exe OR parent_name:iexplore.exe OR parent_name:winword.exe OR parent_name:excel.exe OR parent_name:msedge.exe OR parent_name:w3wp.exe)",
+ "sysmon": "lsass.exe 0x1fffff;0x1010 \\\\Run\\\\;\\\\RunOnce\\\\;\\\\Policies\\\\Explorer\\\\Run '\n| where EventID in (4624, 4625, 4648, 4672)\n| project TimeGenerated, EventID, Account, WorkstationName, IpAddress, LogonType\n| order by TimeGenerated desc",
+ "qradar": "SELECT username, sourceip, QIDNAME(qid) as event, starttime FROM events WHERE username = '' AND logsourcetypename(devicetype) ILIKE '%Windows%' ORDER BY starttime DESC LAST 1 HOURS",
+ "sigma": null,
+ "velociraptor": null,
+ "carbon_black": null,
+ "sysmon": "powershell.exe -enc;-nop;IEX;DownloadString '\n| project TimeGenerated, EventID, Account, MemberName, GroupName\n| order by TimeGenerated desc",
+ "qradar": "SELECT username, \"Group Name\" as group_name, QIDNAME(qid) as event, starttime FROM events WHERE logsourcetypename(devicetype) ILIKE '%Windows%' AND qid IN (SELECT qid FROM qidmap WHERE eventid IN ('4729','4733','4757')) ORDER BY starttime DESC LAST 24 HOURS",
+ "sigma": null,
+ "velociraptor": "SELECT EventID, TimeCreated, Computer, Channel, Message FROM Artifact.Windows.EventLogs.SecurityEventLogParser() ORDER BY TimeCreated DESC LIMIT 200",
+ "carbon_black": "(process_name:net.exe OR process_name:net1.exe OR process_name:powershell.exe) AND (cmdline:*localgroup* OR cmdline:*domain admins* OR cmdline:*enterprise admins* OR cmdline:*remove*)",
+ "sysmon": "powershell.exe;cmd.exe;wscript.exe;cscript.exe '\n| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData\n| order by TimeGenerated desc",
+ "qradar": "SELECT sourceip, \"Registry Key\" as regkey, QIDNAME(qid) as event, starttime FROM events WHERE logsourcetypename(devicetype) ILIKE '%Sysmon%' AND QIDNAME(qid) ILIKE '%Registry%' ORDER BY starttime DESC LAST 24 HOURS",
+ "sigma": null,
+ "velociraptor": "SELECT EventID, TimeCreated, Computer, Channel, Message FROM Artifact.Windows.EventLogs.SecurityEventLogParser() ORDER BY TimeCreated DESC LIMIT 200",
+ "carbon_black": "(process_name:schtasks.exe OR process_name:sc.exe OR process_name:reg.exe OR process_name:powershell.exe) AND (cmdline:*delete* OR cmdline:*CurrentVersion*Run* OR cmdline:*Remove-ItemProperty* OR cmdline:*DeleteValue*)",
+ "sysmon": "\\\\Run\\\\;\\\\RunOnce\\\\;\\\\Policies\\\\Explorer\\\\Run lsass.exe 0x1fffff;0x1010 lsass.exe 0x1fffff;0x1010 lsass.exe 0x1fffff;0x1010 )\n| where ResultType == 0\n| project TimeGenerated, UserPrincipalName, IPAddress, AppDisplayName, LocationDetails\n| order by TimeGenerated desc",
+ "qradar": "SELECT sourceip, username, QIDNAME(qid) as event, starttime FROM events WHERE sourceip IN () AND logsourcetypename(devicetype) ILIKE '%Azure AD%' AND \"Result\" = 'Success' ORDER BY starttime DESC LAST 1 HOURS",
+ "sigma": null,
+ "velociraptor": "SELECT Laddr, Lport, Raddr, Rport, State, Pid, Name, Ctime FROM netstat() WHERE Rport IN (22,53,80,443,8080,8443) AND Name =~ '(?i)(powershell|cmd|wscript|cscript|rundll32|mshta|curl|wget)' ORDER BY Ctime DESC LIMIT 200",
+ "carbon_black": "netconn_count:[10 TO *] AND NOT (process_name:chrome.exe OR process_name:msedge.exe OR process_name:firefox.exe OR process_name:outlook.exe OR process_name:teams.exe OR process_name:OneDrive.exe)",
+ "sysmon": "lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 )\n| summarize Attempts=count(), Users=dcount(UserPrincipalName) by IPAddress, ResultType\n| order by Attempts desc",
+ "qradar": "SELECT sourceip, COUNT(*) as attempts FROM events WHERE sourceip IN () AND logsourcetypename(devicetype) ILIKE '%Azure AD%' GROUP BY sourceip ORDER BY attempts DESC LAST 24 HOURS",
+ "sigma": null,
+ "velociraptor": null,
+ "carbon_black": null,
+ "sysmon": "powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe kernel32.dll;ntdll.dll powershell.exe;cmd.exe;wscript.exe;cscript.exe lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe 135;139;445;3389 '\n| where EventID in (4624, 4625)\n| summarize Success=countif(EventID==4624), Failures=countif(EventID==4625) by TargetUserName, IpAddress\n| where Success > 0",
+ "qradar": "SELECT sourceip, username, SUM(CASE WHEN qid IN (SELECT qid FROM qidmap WHERE eventid='4624') THEN 1 ELSE 0 END) as success, SUM(CASE WHEN qid IN (SELECT qid FROM qidmap WHERE eventid='4625') THEN 1 ELSE 0 END) as failures FROM events WHERE sourceip = '' AND logsourcetypename(devicetype) ILIKE '%Windows%' GROUP BY sourceip, username LAST 1 HOURS",
+ "sigma": null,
+ "velociraptor": "SELECT EventID, TimeCreated, Computer, Channel, Message FROM Artifact.Windows.EventLogs.SecurityEventLogParser() ORDER BY TimeCreated DESC LIMIT 200",
+ "carbon_black": null,
+ "sysmon": "powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe 135;139;445;3389 )\n| summarize Connections=count() by RemoteIP, DeviceName\n| order by Connections desc",
+ "qradar": "SELECT sourceip, destinationip, COUNT(*) as conn FROM events WHERE destinationport = 3389 AND sourceip IN () AND logsourcetypename(devicetype) ILIKE '%Firewall%' GROUP BY sourceip, destinationip ORDER BY conn DESC LAST 1 HOURS",
+ "sigma": null,
+ "velociraptor": null,
+ "carbon_black": null,
+ "sysmon": "powershell.exe 135;139;445;3389 powershell.exe;cmd.exe;wscript.exe;cscript.exe )\n| project TimeGenerated, TargetUserName, IpAddress, WorkstationName\n| order by TimeGenerated desc",
+ "qradar": "SELECT username, sourceip, starttime FROM events WHERE logsourcetypename(devicetype) ILIKE '%Windows%' AND qid IN (SELECT qid FROM qidmap WHERE eventid = '4624') AND sourceip IN () ORDER BY starttime DESC LAST 24 HOURS",
+ "sigma": null,
+ "velociraptor": null,
+ "carbon_black": null,
+ "sysmon": "powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe 135;139;445;3389 \\\\Run\\\\;\\\\RunOnce\\\\;\\\\Policies\\\\Explorer\\\\Run \\\\Run\\\\;\\\\RunOnce\\\\;\\\\Policies\\\\Explorer\\\\Run '\n| summarize Targets=dcount(RemoteIP) by RemotePort, InitiatingProcessFileName\n| order by Targets desc",
+ "qradar": "SELECT sourceip, destinationip, destinationport, COUNT(*) as conn FROM events WHERE sourceip = '' AND destinationport IN (445, 3389, 139) GROUP BY sourceip, destinationip, destinationport ORDER BY conn DESC LAST 48 HOURS",
+ "sigma": null,
+ "velociraptor": null,
+ "carbon_black": null,
+ "sysmon": "powershell.exe 135;139;445;3389 powershell.exe 135;139;445;3389 lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;wscript.exe;cscript.exe lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;wscript.exe;cscript.exe lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe lsass.exe 0x1fffff;0x1010 lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;wscript.exe;cscript.exe lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;wscript.exe;cscript.exe \\\\Run\\\\;\\\\RunOnce\\\\;\\\\Policies\\\\Explorer\\\\Run powershell.exe;cmd.exe;wscript.exe;cscript.exe \\\\Run\\\\;\\\\RunOnce\\\\;\\\\Policies\\\\Explorer\\\\Run kernel32.dll;ntdll.dll powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe ' or Subject contains ''\n| summarize RecipientCount=dcount(RecipientEmailAddress), Recipients=make_set(RecipientEmailAddress) by SenderFromAddress, Subject, SenderIPv4, DeliveryAction\n| order by RecipientCount desc",
+ "qradar": "SELECT \"Sender\", \"Recipient\", \"Subject\", \"Message-ID\", QIDNAME(qid) as EventName, starttime FROM events WHERE logsourcetypename(devicetype) ILIKE '%Email%' OR logsourcetypename(devicetype) ILIKE '%Proofpoint%' ORDER BY starttime DESC LAST 24 HOURS",
+ "sigma": "title: Phishing Email Delivery Detection\nstatus: experimental\ndescription: Detects delivery of emails with suspicious attachments or links from external senders\nlogsource:\n category: email\ndetection:\n selection:\n action:\n - 'delivered'\n - 'allow'\n suspicious_indicators:\n attachment_type|contains:\n - '.exe'\n - '.js'\n - '.hta'\n - '.iso'\n - '.lnk'\n condition: selection and suspicious_indicators\nfalsepositives:\n - Legitimate software deliveries\nlevel: medium",
+ "velociraptor": "SELECT * FROM foreach(\n row=users(),\n query={\n SELECT FullPath, Size, Mtime, hash(path=FullPath) as Hash\n FROM glob(globs=['%APPDATA%/Local/Temp/*.{exe,js,hta,lnk,iso}',\n 'C:/Users/*/Downloads/*.{exe,js,hta,lnk,iso}',\n 'C:/Users/*/AppData/Local/Temp/*'])\n WHERE Mtime > now() - 86400\n LIMIT 200\n }\n)",
+ "carbon_black": "filemod_name:*.{exe,js,hta,lnk,iso} AND (process_name:outlook.exe OR process_name:thunderbird.exe OR process_name:chrome.exe OR process_name:msedge.exe) AND filemod_type:CREATE",
+ "sysmon": "OUTLOOK.EXE;thunderbird.exe;chrome.exe;msedge.exe;firefox.exe .exe;.js;.hta;.lnk;.iso;.vbs;.wsf;.ps1 ' or RemoteUrl contains ''\n| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort, ActionType\n| order by TimeGenerated desc",
+ "qradar": "SELECT sourceip, username, \"URL\" as url, QIDNAME(qid) as event, magnitude FROM events WHERE logsourcetypename(devicetype) ILIKE '%Proxy%' AND \"URL\" ILIKE '%%' ORDER BY starttime DESC LAST 24 HOURS",
+ "sigma": "title: Phishing URL Click via Web Proxy\nstatus: experimental\ndescription: Detects user clicking a known phishing or suspicious URL through web proxy\nlogsource:\n category: proxy\ndetection:\n selection:\n c-uri-query|contains:\n - 'credential'\n - 'verify'\n - 'secure-login'\n filter_legit:\n cs-host|contains:\n - 'microsoft.com'\n - 'google.com'\n condition: selection and not filter_legit\nfalsepositives:\n - Legitimate password portals\nlevel: medium",
+ "velociraptor": "SELECT FullPath, Size, Mtime, hash(path=FullPath) as Hash\nFROM glob(globs=['C:/Users/*/Downloads/*', 'C:/Users/*/AppData/Local/Temp/*'])\nWHERE Mtime > now() - 7200\nORDER BY Mtime DESC\nLIMIT 500",
+ "carbon_black": "(process_name:chrome.exe OR process_name:msedge.exe OR process_name:firefox.exe) AND netconn_domain:",
+ "sysmon": "chrome.exe;msedge.exe;firefox.exe;iexplore.exe 80;443 OUTLOOK.EXE powershell.exe;cmd.exe;wscript.exe;mshta.exe WINWORD.EXE;EXCEL.EXE;POWERPNT.EXE;OUTLOOK.EXE powershell.exe;cmd.exe;wscript.exe;cscript.exe;mshta.exe;rundll32.exe;regsvr32.exe ' or Subject == ''\n| summarize count() by RecipientEmailAddress, DeliveryAction, DeliveryLocation\n| order by count_ desc",
+ "qradar": "SELECT \"Recipient\", \"Sender\", \"Subject\", starttime FROM events WHERE logsourcetypename(devicetype) ILIKE '%Email%' AND \"Sender\" = '' ORDER BY starttime DESC LAST 24 HOURS",
+ "sigma": null,
+ "velociraptor": null,
+ "carbon_black": null,
+ "sysmon": null
+ }
+ },
+ {
+ "title": "Isolate any endpoint where the payload was confirmed executed",
+ "detail": "If EDR confirms execution of a dropped payload (process spawned from Office or browser, suspicious file creation), immediately network-isolate the host using EDR agent isolation. Preserve the system for forensic acquisition before any remediation. Revoke the user's session tokens across all applications.",
+ "queries": {
+ "splunk": "index=wineventlog EventCode IN (4688, 7045) | search CommandLine IN (\"*powershell*\",\"*cmd*\",\"*mshta*\") | stats count by ComputerName, AccountName, CommandLine | sort -count",
+ "kql": "DeviceProcessEvents\n| where DeviceName == ''\n| where TimeGenerated > ago(4h)\n| project TimeGenerated, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName\n| order by TimeGenerated desc",
+ "qradar": "SELECT sourceip, username, \"Process Name\" as process, \"Command Line\" as cmdline, magnitude FROM events WHERE sourceip = '' AND \"Event ID\" IN ('4688','7045') ORDER BY magnitude DESC LAST 4 HOURS",
+ "sigma": null,
+ "velociraptor": "SELECT Pid, Name, CommandLine, Ppid, CreateTime, Username\nFROM pslist()\nWHERE Name =~ '(?i)(powershell|cmd|wscript|cscript|mshta|rundll32)'\nORDER BY CreateTime DESC\nLIMIT 100",
+ "carbon_black": "hostname: AND (process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe)",
+ "sysmon": "powershell.exe;cmd.exe;wscript.exe;mshta.exe;rundll32.exe schtasks.exe /create \\Run\\;\\RunOnce\\;\\Policies\\Explorer\\Run '\n| summarize Recipients=make_set(RecipientEmailAddress)\n| extend RecipientCount=array_length(Recipients)",
+ "qradar": "SELECT \"Recipient\", \"Sender\", \"Subject\" FROM events WHERE logsourcetypename(devicetype) ILIKE '%Email%' AND \"Subject\" = '' LAST 24 HOURS",
+ "sigma": null,
+ "velociraptor": null,
+ "carbon_black": null,
+ "sysmon": null
+ }
+ },
+ {
+ "title": "Update detection rules and block lists",
+ "detail": "Add the phishing domain, sender IP, URL patterns, and attachment hashes to email gateway block lists, EDR IOC feeds, DNS sinkholes, and web proxy deny lists. Create or tune SIEM detection rules to catch similar campaigns. Submit IOCs to threat intel sharing platforms (ISACs, MISP).",
+ "queries": {
+ "splunk": "index=network sourcetype=proxy cs_host=[phishing_domain] | timechart count span=1h",
+ "kql": "DnsEvents\n| where Name contains ''\n| summarize QueryCount=count(), Sources=make_set(ClientIP) by Name\n| order by QueryCount desc",
+ "qradar": "SELECT sourceip, \"DNS Query\" as query, count(*) as hits FROM events WHERE logsourcetypename(devicetype) ILIKE '%DNS%' AND \"DNS Query\" ILIKE '%%' GROUP BY sourceip, \"DNS Query\" ORDER BY hits DESC LAST 24 HOURS",
+ "sigma": null,
+ "velociraptor": null,
+ "carbon_black": null,
+ "sysmon": null
+ }
+ }
+ ],
+ "metrics": [
+ { "name": "Time to Retract", "target": "<30 minutes from initial detection" },
+ { "name": "Credential Reset SLA", "target": "<60 minutes if credential harvesting confirmed" },
+ { "name": "Endpoint Isolation SLA", "target": "<15 minutes if payload executed" },
+ { "name": "User Notification", "target": "<2 hours from confirmation" }
+ ]
+}
diff --git a/app/playbooks/identity/pb39-ad-kerberos-attacks.json b/app/playbooks/identity/pb39-ad-kerberos-attacks.json
new file mode 100644
index 0000000..fb7baa1
--- /dev/null
+++ b/app/playbooks/identity/pb39-ad-kerberos-attacks.json
@@ -0,0 +1,175 @@
+{
+ "id": "pb39",
+ "num": 39,
+ "name": "Active Directory / Kerberos Attacks",
+ "fullName": "Active Directory / Kerberos Attacks",
+ "type": "Credential Access – Kerberos / AD Abuse",
+ "severity": "Critical",
+ "priority": "Critical (domain-wide credential compromise risk)",
+ "detection": "Windows Security Event logs (SIEM), AD audit logs, EDR, Honey accounts",
+ "scenario": "Suspicious Kerberos activity is detected indicating potential Kerberoasting, AS-REP Roasting, Pass-the-Ticket, Golden Ticket, or DCSync attack. Indicators include excessive TGS requests for service accounts (Event 4769 with RC4 encryption), pre-authentication failures (4768 error 0x18), logons using forged tickets, or non-DC machines requesting AD replication (Event 4662).",
+ "mitre": "T1558.003, T1558.001, T1550.003, T1078, T1207",
+ "tools": "SIEM (Splunk, Sentinel); Windows Security Event logs; AD audit logs; EDR (CrowdStrike, Defender); BloodHound/SharpHound (for AD path analysis); Velociraptor",
+ "sev": "critical",
+ "cat": "Identity",
+ "source": "library",
+ "updated": "2026-05-17",
+ "related": ["pb09", "pb14", "pb20"],
+ "detSteps": [
+ {
+ "title": "Detect Kerberoasting — excessive TGS-REQ with RC4 encryption",
+ "detail": "Kerberoasting requests Kerberos service tickets for accounts with SPNs using RC4 (0x17) encryption rather than AES, so the ticket can be cracked offline. Look for Event ID 4769 (Kerberos Service Ticket Operations) with Ticket Encryption Type 0x17 (RC4-HMAC) from a single account in a short window, targeting multiple service accounts. Normal environments use AES (0x12 or 0x11).",
+ "queries": {
+ "splunk": "index=wineventlog EventCode=4769 Ticket_Encryption_Type=0x17 NOT ServiceName=\"krbtgt\" NOT ServiceName=*$ | stats count as tgs_requests dc(ServiceName) as unique_spns by Account_Name, Client_Address | where tgs_requests > 5 | sort -tgs_requests",
+ "kql": "SecurityEvent\n| where TimeGenerated > ago(1h)\n| where EventID == 4769\n| where TicketEncryptionType == '0x17'\n| where ServiceName !endswith '$' and ServiceName != 'krbtgt'\n| summarize TGSCount=count(), UniqueSPNs=dcount(ServiceName), SPNList=make_set(ServiceName) by Account, IpAddress\n| where TGSCount > 5\n| order by TGSCount desc",
+ "qradar": "SELECT username as account, sourceip, COUNT(*) as tgs_count, COUNT(DISTINCT \"Service Name\") as unique_spns FROM events WHERE logsourcetypename(devicetype) = 'Microsoft Windows Security Event Log' AND \"Event ID\" = '4769' AND \"Ticket Encryption Type\" = '0x17' AND \"Service Name\" NOT ILIKE '%$' GROUP BY username, sourceip HAVING tgs_count > 5 ORDER BY tgs_count DESC LAST 1 HOURS",
+ "sigma": "title: Kerberoasting via RC4 Downgrade\nstatus: stable\ndescription: Detects Kerberoasting — multiple TGS requests with RC4 encryption targeting service accounts\nlogsource:\n product: windows\n service: security\ndetection:\n selection:\n EventID: 4769\n TicketEncryptionType: '0x17'\n filter_machine_accounts:\n ServiceName|endswith: '$'\n filter_krbtgt:\n ServiceName: 'krbtgt'\n condition: selection and not filter_machine_accounts and not filter_krbtgt\nfalsepositives:\n - Legacy systems that only support RC4\nlevel: high",
+ "velociraptor": "SELECT EventID, TimeGenerated, Computer, AccountName, ServiceName, TicketEncryptionType, ClientAddress\nFROM wmi(query=\"SELECT * FROM Win32_NTLogEvent WHERE Logfile='Security' AND EventCode=4769\")\nWHERE TicketEncryptionType = '0x17'\nAND NOT ServiceName =~ '.*\\\\$'\nAND ServiceName != 'krbtgt'\nORDER BY TimeGenerated DESC\nLIMIT 200",
+ "carbon_black": "(process_name:Rubeus.exe OR process_name:GetUserSPNs.exe OR cmdline:\"kerberoast\") OR (process_name:powershell.exe AND cmdline:\"Get-DomainSPNTicket\")",
+ "sysmon": "kerberoast;Get-DomainSPNTicket;Invoke-Kerberoast;GetUserSPNs asreproast;Get-ASREPHash;Invoke-ASREPRoasting kerberos::golden;kerberos::silver;sekurlsa::tickets;Pass-the-Ticket lsadump::dcsync;drsuapi;NTDSUtil;ntds.dit AND (process_name:Rubeus.exe OR process_name:mimikatz.exe OR cmdline:kerberoast)",
+ "sysmon": "88;389;636;3268;3269 mimikatz;Rubeus;SharpHound '\n| where TimeGenerated > ago(24h)\n| summarize Accounts=dcount(UserPrincipalName), Operations=make_set(AppDisplayName) by IPAddress\n| order by Accounts desc",
+ "qradar": "SELECT username, sourceip, QIDNAME(qid) as event, count(*) as hits FROM events WHERE sourceip = '' GROUP BY username, sourceip, event ORDER BY hits DESC LAST 24 HOURS",
+ "sigma": null,
+ "velociraptor": null,
+ "carbon_black": null,
+ "sysmon": null
+ }
+ },
+ {
+ "title": "Force password reset and re-enrol MFA device",
+ "detail": "Force an immediate password reset for the compromised account through a verified out-of-band channel (not email if email is also compromised). Ensure the new password is not reused and meets complexity requirements. Re-enrol the user's MFA using a phishing-resistant method (FIDO2 hardware key, Microsoft Authenticator number matching). Do not re-enable SMS MFA if SIM swap was the attack vector.",
+ "queries": {
+ "splunk": "index=azure sourcetype=azure:aad:audit OperationName=\"Reset user password\" | table _time, InitiatedBy, Target, ResultDescription",
+ "kql": "AuditLogs\n| where TimeGenerated > ago(24h)\n| where OperationName == 'Reset user password'\n| extend Actor = tostring(InitiatedBy.user.userPrincipalName)\n| extend Target = tostring(TargetResources[0].userPrincipalName)\n| project TimeGenerated, OperationName, Actor, Target\n| order by TimeGenerated desc",
+ "qradar": "SELECT username, \"Operation Name\" as op, \"Target\" as target FROM events WHERE \"Operation Name\" ILIKE '%password reset%' OR \"Operation Name\" ILIKE '%MFA enroll%' ORDER BY starttime DESC LAST 24 HOURS",
+ "sigma": null,
+ "velociraptor": null,
+ "carbon_black": null,
+ "sysmon": null
+ }
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Audit all actions taken by the attacker during the session",
+ "detail": "Review all audit logs for the compromised account from the time of the illegitimate sign-in to the time of containment. Look for: emails read or exfiltrated, files accessed or downloaded, OAuth app consents granted, new inbox rules created, new accounts created, and privilege escalation attempts. Every action must be documented for the IR report and potential legal proceedings.",
+ "queries": {
+ "splunk": "index=o365 sourcetype=o365:management:activity UserId=[compromised_user] earliest=[attack_start] latest=[containment_time] | stats count by Operation, ClientIPAddress | sort -count",
+ "kql": "OfficeActivity\n| where UserId == ''\n| where TimeGenerated between (datetime('') .. datetime(''))\n| summarize count() by Operation, ClientIP\n| order by count_ desc",
+ "qradar": "SELECT username, QIDNAME(qid) as event, sourceip, starttime FROM events WHERE username = '' AND starttime BETWEEN '' AND '' ORDER BY starttime DESC LAST 24 HOURS",
+ "sigma": null,
+ "velociraptor": null,
+ "carbon_black": null,
+ "sysmon": null
+ }
+ },
+ {
+ "title": "Remediate any changes made by the attacker",
+ "detail": "Reverse all attacker-made changes: remove inbox forwarding rules, revoke OAuth app consents, delete newly created accounts, restore modified permissions and group memberships. If the attacker created additional backdoor accounts or OAuth apps for persistence, ensure these are all removed. Document each change reversal with timestamps.",
+ "queries": {
+ "splunk": "index=o365 sourcetype=o365:management:activity Operation IN (\"New-InboxRule\",\"Add-MailboxPermission\",\"Add member to role\",\"Consent to application\") UserId=[compromised_user] | table _time, Operation, Parameters | sort _time",
+ "kql": "AuditLogs\n| where TimeGenerated > ago(24h)\n| where InitiatedBy.user.userPrincipalName == ''\n| where OperationName in ('Add member to role','Consent to application','New-InboxRule','Add app role assignment to service principal')\n| project TimeGenerated, OperationName, TargetResources\n| order by TimeGenerated desc",
+ "qradar": "SELECT username, QIDNAME(qid) as event, \"Additional Information\" as info FROM events WHERE username = '' AND (QIDNAME(qid) ILIKE '%inbox rule%' OR QIDNAME(qid) ILIKE '%consent%' OR QIDNAME(qid) ILIKE '%role%') ORDER BY starttime DESC LAST 24 HOURS",
+ "sigma": null,
+ "velociraptor": null,
+ "carbon_black": null,
+ "sysmon": null
+ }
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Upgrade all high-value accounts to phishing-resistant MFA",
+ "detail": "Transition all privileged accounts (global admins, security admins, privileged roles) to FIDO2 hardware keys or certificate-based authentication. Enable number matching and additional context in push notifications for all remaining authenticator app users. Disable SMS-based MFA organisation-wide if possible. Apply Conditional Access requiring compliant device for all sign-ins.",
+ "queries": {
+ "splunk": "index=azure sourcetype=azure:aad:audit OperationName=\"Update user\" | search \"AuthenticationMethod\" | table _time, Target, InitiatedBy, ResultDescription",
+ "kql": "AuditLogs\n| where TimeGenerated > ago(7d)\n| where OperationName == 'User registered security info'\n| extend Method = tostring(TargetResources[0].modifiedProperties[0].newValue)\n| summarize count() by Method\n| order by count_ desc",
+ "qradar": "SELECT username, \"Authentication Method\" as method, COUNT(*) as count FROM events WHERE QIDNAME(qid) ILIKE '%MFA%' GROUP BY username, method ORDER BY count DESC LAST 7 DAYS",
+ "sigma": null,
+ "velociraptor": null,
+ "carbon_black": null,
+ "sysmon": null
+ }
+ },
+ {
+ "title": "Monitor the compromised account intensively for 30 days",
+ "detail": "Place the affected account on an elevated monitoring watchlist. Alert on any new sign-in from an unknown device, new country, or during unusual hours. Alert on any MFA method change. Mandate weekly check-ins with the affected user for 30 days. Conduct a post-incident review and provide the user with awareness training on MFA fatigue and phishing.",
+ "queries": {
+ "splunk": "index=azure sourcetype=azure:aad:audit UserPrincipalName=[affected_user] | timechart count span=1h by OperationName",
+ "kql": "SigninLogs\n| where UserPrincipalName == ''\n| where TimeGenerated > ago(30d)\n| where RiskLevelDuringSignIn != 'none'\n| project TimeGenerated, IPAddress, AppDisplayName, RiskLevelDuringSignIn, ResultType\n| order by TimeGenerated desc",
+ "qradar": "SELECT username, sourceip, QIDNAME(qid) as event, magnitude, starttime FROM events WHERE username = '' ORDER BY starttime DESC LAST 30 DAYS",
+ "sigma": null,
+ "velociraptor": null,
+ "carbon_black": null,
+ "sysmon": null
+ }
+ }
+ ],
+ "metrics": [
+ { "name": "Session Revocation SLA", "target": "<5 minutes from confirmation" },
+ { "name": "Password Reset SLA", "target": "<15 minutes via out-of-band channel" },
+ { "name": "Attacker Action Audit", "target": "Complete within 2 hours of containment" },
+ { "name": "Phishing-Resistant MFA Deployment", "target": "All privileged accounts within 48 hours" }
+ ]
+}
diff --git a/app/playbooks/insider-threat/pb02-insider-data-exfiltration.json b/app/playbooks/insider-threat/pb02-insider-data-exfiltration.json
new file mode 100644
index 0000000..35d1e5c
--- /dev/null
+++ b/app/playbooks/insider-threat/pb02-insider-data-exfiltration.json
@@ -0,0 +1,225 @@
+{
+ "id": "pb02",
+ "num": 2,
+ "name": "Insider Data Exfiltration",
+ "fullName": "Insider Data Exfiltration",
+ "type": "Insider Threat – Data Exfiltration",
+ "severity": "High (especially for regulated or confidential data)",
+ "priority": "High to Critical",
+ "detection": "DLP, SIEM, Proxy logs, CASB, EDR, Email gateway",
+ "scenario": "An internal employee, contractor or privileged user attempts to or successfully exfiltrates sensitive data through unauthorised channels such as personal email, cloud storage, removable media or file transfer tools.",
+ "mitre": "T1020, T1048, T1537",
+ "tools": "SIEM (e.g., Splunk, IBM QRadar, Microsoft Sentinel); DLP systems (e.g., Symantec, Forcepoint, Microsoft Purview); CASB (e.g., Netskope, Microsoft Defender for Cloud Apps); Endpoint agents (e.g., EDR with data transfer monitoring); Proxy & firewall logs; Email Security Gateway (e.g., Proofpoint, Mime",
+ "sev": "critical",
+ "cat": "Insider Threat",
+ "source": "library",
+ "detSteps": [
+ {
+ "title": "Identify abnormal outbound data volume",
+ "detail": "Look for unusually high outbound data from a single internal IP — particularly to cloud storage (Dropbox, Google Drive, OneDrive, Mega, WeTransfer) or personal email. Compare against that host's 30-day baseline to contextualise the anomaly.",
+ "queries": {
+ "splunk": "index=network sourcetype=proxy OR sourcetype=firewall | stats sum(bytes_out) as total_out by src_ip, dest_host | where total_out > 500000000 | sort -total_out",
+ "kql": null,
+ "qradar": null,
+ "sigma": null,
+ "velociraptor": "SELECT Laddr, Lport, Raddr, Rport, State, Pid, Name, Ctime FROM netstat() WHERE Rport IN (21,22,53,80,443,8080,8443) AND Name =~ '(?i)(powershell|cmd|curl|wget|rclone|7z|winscp|ftp)' ORDER BY Ctime DESC LIMIT 200",
+ "carbon_black": null,
+ "sysmon": "powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 powershell.exe . lsass.exe 0x1fffff;0x1010 lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 kernel32.dll;ntdll.dll lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 powershell.exe;cmd.exe;wscript.exe;cscript.exe lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 lsass.exe 0x1fffff;0x1010 powershell.exe -enc;-nop;IEX;DownloadString powershell.exe -enc;-nop;IEX;DownloadString powershell.exe;cmd.exe;wscript.exe;cscript.exe kernel32.dll;ntdll.dll powershell.exe -enc;-nop;IEX;DownloadString lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe -enc;-nop;IEX;DownloadString powershell.exe;cmd.exe;wscript.exe;cscript.exe lsass.exe 0x1fffff;0x1010 lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 powershell.exe;cmd.exe;wscript.exe;cscript.exe lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 lsass.exe 0x1fffff;0x1010 lsass.exe 0x1fffff;0x1010 lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;wscript.exe;cscript.exe lsass.exe 0x1fffff;0x1010 powershell.exe -enc;-nop;IEX;DownloadString powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;wscript.exe;cscript.exe lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 powershell.exe 135;139;445;3389 powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe 135;139;445;3389 powershell.exe 135;139;445;3389 powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 '\n| where RemoteIPType == 'Public'\n| project TimeGenerated, DeviceName, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessFileName\n| order by TimeGenerated desc",
+ "qradar": "SELECT sourceip, \"DNS Request\" as query, destinationip, QIDNAME(qid) as event FROM events WHERE logsourcetypename(devicetype) ILIKE '%DNS%' AND sourceip = '' ORDER BY starttime DESC LAST 24 HOURS",
+ "sigma": null,
+ "velociraptor": "SELECT Laddr, Lport, Raddr, Rport, State, Pid, Name, Ctime FROM netstat() WHERE Rport IN (22,53,80,443,8080,8443) AND Name =~ '(?i)(powershell|cmd|wscript|cscript|rundll32|mshta|curl|wget)' ORDER BY Ctime DESC LIMIT 200",
+ "carbon_black": "netconn_count:[10 TO *] AND (process_name:powershell.exe OR process_name:cmd.exe OR process_name:wscript.exe OR process_name:cscript.exe OR process_name:rundll32.exe) AND NOT (process_name:chrome.exe OR process_name:msedge.exe OR process_name:firefox.exe OR process_name:outlook.exe OR process_name:teams.exe)",
+ "sysmon": "powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 '\n| where TimeGenerated > ago(2h)\n| summarize Connections=count() by RemoteIP, RemotePort\n| order by Connections desc",
+ "qradar": "SELECT sourceip, destinationip, destinationport, SUM(eventcount) as total FROM events WHERE sourceip = '' AND logsourcetypename(devicetype) ILIKE '%Firewall%' GROUP BY sourceip, destinationip, destinationport ORDER BY total DESC LAST 2 HOURS",
+ "sigma": null,
+ "velociraptor": "SELECT Laddr, Lport, Raddr, Rport, State, Pid, Name, Ctime FROM netstat() WHERE Rport IN (135,139,445,3389) AND Name =~ '(?i)(powershell|cmd|wmic|psexec|rundll32)' ORDER BY Ctime DESC LIMIT 200",
+ "carbon_black": "netconn_count:[10 TO *] AND NOT (process_name:chrome.exe OR process_name:msedge.exe OR process_name:firefox.exe OR process_name:outlook.exe OR process_name:teams.exe OR process_name:OneDrive.exe)",
+ "sysmon": "powershell.exe 135;139;445;3389 '\n| summarize count() by SourceIP, DeviceAction\n| order by count_ desc",
+ "qradar": "SELECT sourceip, destinationip, QIDNAME(qid) as event, eventcount FROM events WHERE destinationip = '' ORDER BY starttime DESC LAST 1 HOURS",
+ "sigma": null,
+ "velociraptor": "SELECT Laddr, Lport, Raddr, Rport, State, Pid, Name, Ctime FROM netstat() WHERE Rport IN (22,53,80,443,8080,8443) AND Name =~ '(?i)(powershell|cmd|wscript|cscript|rundll32|mshta|curl|wget)' ORDER BY Ctime DESC LIMIT 200",
+ "carbon_black": "netconn_count:[10 TO *] AND (process_name:powershell.exe OR process_name:cmd.exe OR process_name:wscript.exe OR process_name:cscript.exe OR process_name:rundll32.exe) AND NOT (process_name:chrome.exe OR process_name:msedge.exe OR process_name:firefox.exe OR process_name:outlook.exe OR process_name:teams.exe)",
+ "sysmon": "powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 '\n| project TimeGenerated, EventID, Account, WorkstationName, IpAddress\n| order by TimeGenerated desc",
+ "qradar": "SELECT username, sourceip, QIDNAME(qid) as event, starttime FROM events WHERE username = '' AND qid IN (SELECT qid FROM qidmap WHERE qidname LIKE '%Logon%') ORDER BY starttime DESC LAST 24 HOURS",
+ "sigma": null,
+ "velociraptor": "SELECT Laddr, Lport, Raddr, Rport, State, Pid, Name, Ctime FROM netstat() WHERE Rport IN (135,139,445,3389) AND Name =~ '(?i)(powershell|cmd|wmic|psexec|rundll32)' ORDER BY Ctime DESC LIMIT 200",
+ "carbon_black": "netconn_count:[10 TO *] AND (process_name:powershell.exe OR process_name:cmd.exe OR process_name:wscript.exe OR process_name:cscript.exe OR process_name:rundll32.exe) AND NOT (process_name:chrome.exe OR process_name:msedge.exe OR process_name:firefox.exe OR process_name:outlook.exe OR process_name:teams.exe)",
+ "sysmon": "lsass.exe 0x1fffff;0x1010 .locked;.encrypted;.crypt;README '\n| where RegistryKey has_any ('Run','RunOnce','Policies\\\\Explorer\\\\Run')\n| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData\n| order by TimeGenerated desc",
+ "qradar": "SELECT sourceip, \"Registry Key\" as regkey, \"Registry Value\" as regval FROM events WHERE logsourcetypename(devicetype) ILIKE '%Sysmon%' AND QIDNAME(qid) ILIKE '%Registry%' AND sourceip = '' ORDER BY starttime DESC LAST 24 HOURS",
+ "sigma": null,
+ "velociraptor": "SELECT Laddr, Lport, Raddr, Rport, State, Pid, Name, Ctime FROM netstat() WHERE Rport IN (22,53,80,443,8080,8443) AND Name =~ '(?i)(powershell|cmd|wscript|cscript|rundll32|mshta|curl|wget)' ORDER BY Ctime DESC LIMIT 200",
+ "carbon_black": "netconn_count:[10 TO *] AND (process_name:powershell.exe OR process_name:cmd.exe OR process_name:curl.exe OR process_name:wget.exe OR process_name:rclone.exe OR process_name:7z.exe)",
+ "sysmon": "\\\\Run\\\\;\\\\RunOnce\\\\;\\\\Policies\\\\Explorer\\\\Run powershell.exe 135;139;445;3389 )\n| where TimeGenerated > ago(24h)\n| summarize Hosts=dcount(DeviceName) by RemoteIP\n| order by Hosts desc",
+ "qradar": "SELECT sourceip, destinationip, COUNT(DISTINCT sourceip) as hosts FROM events WHERE destinationip IN () GROUP BY sourceip, destinationip ORDER BY hosts DESC LAST 24 HOURS",
+ "sigma": null,
+ "velociraptor": "SELECT Laddr, Lport, Raddr, Rport, State, Pid, Name, Ctime FROM netstat() WHERE Rport IN (22,53,80,443,8080,8443) AND Name =~ '(?i)(powershell|cmd|wscript|cscript|rundll32|mshta|curl|wget)' ORDER BY Ctime DESC LIMIT 200",
+ "carbon_black": "netconn_count:[10 TO *] AND (process_name:powershell.exe OR process_name:cmd.exe OR process_name:wscript.exe OR process_name:cscript.exe OR process_name:rundll32.exe) AND NOT (process_name:chrome.exe OR process_name:msedge.exe OR process_name:firefox.exe OR process_name:outlook.exe OR process_name:teams.exe)",
+ "sysmon": "\\\\Run\\\\;\\\\RunOnce\\\\;\\\\Policies\\\\Explorer\\\\Run \\\\Run\\\\;\\\\RunOnce\\\\;\\\\Policies\\\\Explorer\\\\Run powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 lsass.exe 0x1fffff;0x1010 )\n| where RemoteIPType == 'Public'\n| where TimeGenerated > ago(14d)\n| summarize Connections=count() by DeviceName, RemoteIP, bin(TimeGenerated, 1h)\n| order by TimeGenerated desc",
+ "qradar": "SELECT sourceip, destinationip, destinationport, COUNT(*) as conn FROM events WHERE sourceip IN () AND eventdirection = 'O' GROUP BY sourceip, destinationip, destinationport ORDER BY conn DESC LAST 14 DAYS",
+ "sigma": null,
+ "velociraptor": "SELECT Laddr, Lport, Raddr, Rport, State, Pid, Name, Ctime FROM netstat() WHERE Rport IN (135,139,445,3389) AND Name =~ '(?i)(powershell|cmd|wmic|psexec|rundll32)' ORDER BY Ctime DESC LIMIT 200",
+ "carbon_black": "netconn_count:[10 TO *] AND (process_name:powershell.exe OR process_name:cmd.exe OR process_name:wscript.exe OR process_name:cscript.exe OR process_name:rundll32.exe) AND NOT (process_name:chrome.exe OR process_name:msedge.exe OR process_name:firefox.exe OR process_name:outlook.exe OR process_name:teams.exe)",
+ "sysmon": "powershell.exe 135;139;445;3389 .locked;.encrypted;.crypt;README D:\\\\;E:\\\\;F:\\\\ powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 powershell.exe 135;139;445;3389 powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 \\\\Run\\\\;\\\\RunOnce\\\\;\\\\Policies\\\\Explorer\\\\Run powershell.exe 135;139;445;3389 D:\\\\;E:\\\\;F:\\\\ .locked;.encrypted;.crypt;README lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe lsass.exe 0x1fffff;0x1010 .locked;.encrypted;.crypt;README powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe mshta.exe;regsvr32.exe;certutil.exe;wmic.exe;rundll32.exe;odbcconf.exe;cmstp.exe http;scrobj.dll;.sct;-urlcache;javascript:;vbscript: certutil.exe -urlcache;-decode;-decodehex regsvr32.exe /i:http;scrobj.dll;.sct;/i:\\\\ wmic.exe process call create;/node:;node: mshta.exe;regsvr32.exe;certutil.exe;wmic.exe;cmstp.exe 80;443;8080;8443 certutil.exe;bitsadmin.exe;mshta.exe;wmic.exe \\Temp\\;\\AppData\\;\\ProgramData\\ \\Run\\;\\RunOnce\\;\\Policies\\Explorer\\Run;\\Services\\ '\n| where TimeGenerated > ago(14d)\n| where FileName in~ ('mshta.exe','regsvr32.exe','certutil.exe','wmic.exe','rundll32.exe')\n| project TimeGenerated, FileName, ProcessCommandLine, InitiatingProcessFileName\n| order by TimeGenerated desc",
+ "qradar": "SELECT sourceip, \"Process Name\" as process, \"Command Line\" as cmdline FROM events WHERE sourceip = '' AND (\"Process Name\" ILIKE '%mshta.exe%' OR \"Process Name\" ILIKE '%certutil.exe%' OR \"Process Name\" ILIKE '%regsvr32.exe%') ORDER BY starttime DESC LAST 14 DAYS",
+ "sigma": null,
+ "velociraptor": null,
+ "carbon_black": null,
+ "sysmon": null
+ }
+ }
+ ],
+ "metrics": [
+ { "name": "Detection Time", "target": "<10 minutes from LOLBin execution alert" },
+ { "name": "Endpoint Isolation SLA", "target": "<15 minutes from confirmed malicious execution" },
+ { "name": "Artefact Removal", "target": "<2 hours post-isolation" },
+ { "name": "ASR Rule Deployment", "target": "Within 24 hours of eradication" }
+ ]
+}
diff --git a/app/playbooks/manifest.json b/app/playbooks/manifest.json
new file mode 100644
index 0000000..88dede9
--- /dev/null
+++ b/app/playbooks/manifest.json
@@ -0,0 +1,2621 @@
+{
+ "version": "4.0",
+ "generated": "2026-05-18",
+ "playbooks": [
+ {
+ "id": "pb01",
+ "num": 1,
+ "name": "Ransomware Infection",
+ "cat": "Malware",
+ "sev": "critical",
+ "type": "Malware – Ransomware",
+ "mitre": "T1486, T1059, T1021.002",
+ "source": "library",
+ "file": "malware/pb01-ransomware-infection.json",
+ "related": [
+ "pb09",
+ "pb40",
+ "pb14"
+ ]
+ },
+ {
+ "id": "pb02",
+ "num": 2,
+ "name": "Insider Data Exfiltration",
+ "cat": "Insider Threat",
+ "sev": "critical",
+ "type": "Insider Threat – Data Exfiltration",
+ "mitre": "T1020, T1048, T1537",
+ "source": "library",
+ "file": "insider-threat/pb02-insider-data-exfiltration.json"
+ },
+ {
+ "id": "pb03",
+ "num": 3,
+ "name": "Cloud Account Compromise",
+ "cat": "Cloud",
+ "sev": "critical",
+ "type": "Identity Compromise – Cloud Account",
+ "mitre": "T1078, T1087.004, T1556.004, T1531",
+ "source": "library",
+ "file": "cloud/pb03-cloud-account-compromise.json",
+ "related": [
+ "pb16",
+ "pb25",
+ "pb42"
+ ]
+ },
+ {
+ "id": "pb04",
+ "num": 4,
+ "name": "Web Application Exploitation",
+ "cat": "Application",
+ "sev": "critical",
+ "type": "Application-layer Attack",
+ "mitre": "T1190, T1059, T1505",
+ "source": "library",
+ "file": "application/pb04-web-application-exploitation.json"
+ },
+ {
+ "id": "pb05",
+ "num": 5,
+ "name": "Supply Chain Attack",
+ "cat": "Supply Chain",
+ "sev": "critical",
+ "type": "Supply Chain Compromise",
+ "mitre": "T1195.002, T1195.001, T1105",
+ "source": "library",
+ "file": "supply-chain/pb05-supply-chain-attack.json"
+ },
+ {
+ "id": "pb06",
+ "num": 6,
+ "name": "Malware via USB Device",
+ "cat": "Malware",
+ "sev": "high",
+ "type": "Physical Media-Based Malware Infection",
+ "mitre": "T1200, T1091, T1059",
+ "source": "library",
+ "file": "malware/pb06-malware-via-usb-device.json"
+ },
+ {
+ "id": "pb07",
+ "num": 7,
+ "name": "DDoS Attack",
+ "cat": "Application",
+ "sev": "critical",
+ "type": "Network/Application Layer Availability Attack",
+ "mitre": "T1498, T1499, T1498.001",
+ "source": "library",
+ "file": "application/pb07-ddos-attack.json"
+ },
+ {
+ "id": "pb08",
+ "num": 8,
+ "name": "Business Email Compromise (BEC)",
+ "cat": "Identity",
+ "sev": "critical",
+ "type": "Social Engineering / Identity Compromise",
+ "mitre": "T1078, T1114, T1204, T1585.002",
+ "source": "library",
+ "file": "identity/pb08-business-email-compromise-bec.json",
+ "related": [
+ "pb38",
+ "pb11",
+ "pb20"
+ ]
+ },
+ {
+ "id": "pb09",
+ "num": 9,
+ "name": "Unauthorised Privilege Escalation",
+ "cat": "Identity",
+ "sev": "critical",
+ "type": "Access Control Violation / Privilege Misuse",
+ "mitre": "T1068, T1548, T1078",
+ "source": "library",
+ "file": "identity/pb09-unauthorised-privilege-escalation.json",
+ "related": [
+ "pb14",
+ "pb39",
+ "pb40"
+ ]
+ },
+ {
+ "id": "pb10",
+ "num": 10,
+ "name": "Cloud Storage Misconfiguration Exposure",
+ "cat": "Data",
+ "sev": "critical",
+ "type": "Data Exposure – Misconfiguration",
+ "mitre": "T1530, T1562.007",
+ "source": "library",
+ "file": "data/pb10-cloud-storage-misconfiguration-exposure.json"
+ },
+ {
+ "id": "pb11",
+ "num": 11,
+ "name": "Credential Stuffing Attack",
+ "cat": "Identity",
+ "sev": "high",
+ "type": "Account Takeover via Credential Abuse",
+ "mitre": "T1110.001, T1078, T1589.001, T1589.002",
+ "source": "library",
+ "file": "identity/pb11-credential-stuffing-attack.json",
+ "related": [
+ "pb14",
+ "pb08",
+ "pb42"
+ ]
+ },
+ {
+ "id": "pb12",
+ "num": 12,
+ "name": "Unauthorised Internal Database Access",
+ "cat": "Data",
+ "sev": "critical",
+ "type": "Access Control Violation – Data Access Abuse",
+ "mitre": "T1071.001, T1213.003, T1078",
+ "source": "library",
+ "file": "data/pb12-unauthorised-internal-database-access.json"
+ },
+ {
+ "id": "pb13",
+ "num": 13,
+ "name": "Shadow IT Asset Discovery",
+ "cat": "Other",
+ "sev": "high",
+ "type": "Asset Management / Policy Violation",
+ "mitre": "T1584, T1087.001, T1078",
+ "source": "library",
+ "file": "other/pb13-shadow-it-asset-discovery.json"
+ },
+ {
+ "id": "pb14",
+ "num": 14,
+ "name": "RDP Brute-Force Attack",
+ "cat": "Identity",
+ "sev": "critical",
+ "type": "Credential Attack – RDP Login Abuse",
+ "mitre": "T1110.001, T1078, T1021.001",
+ "source": "library",
+ "file": "identity/pb14-rdp-brute-force-attack.json",
+ "related": [
+ "pb09",
+ "pb11",
+ "pb39"
+ ]
+ },
+ {
+ "id": "pb15",
+ "num": 15,
+ "name": "Unauthorised Access to Development",
+ "cat": "Insider Threat",
+ "sev": "critical",
+ "type": "Access Control Violation / Insider Threat",
+ "mitre": "T1087.001, T1059, T1606, T1565.002",
+ "source": "library",
+ "file": "insider-threat/pb15-unauthorised-access-to-development.json"
+ },
+ {
+ "id": "pb16",
+ "num": 16,
+ "name": "Abuse of OAuth Integrations",
+ "cat": "Cloud",
+ "sev": "critical",
+ "type": "Third-Party App Abuse / Token-Based Account Compromise",
+ "mitre": "T1525, T1556.004, T1087",
+ "source": "library",
+ "file": "cloud/pb16-abuse-of-oauth-integrations.json"
+ },
+ {
+ "id": "pb17",
+ "num": 17,
+ "name": "Data Exfiltration via DNS Tunnelling",
+ "cat": "Data",
+ "sev": "critical",
+ "type": "Covert Channel – Data Exfiltration",
+ "mitre": "T1048.003, T1071.004, T1568.002",
+ "source": "library",
+ "file": "data/pb17-data-exfiltration-via-dns-tunnelling.json",
+ "related": [
+ "pb41",
+ "pb07",
+ "pb28"
+ ]
+ },
+ {
+ "id": "pb18",
+ "num": 18,
+ "name": "Unauthorised JavaScript Injection on Public",
+ "cat": "Application",
+ "sev": "critical",
+ "type": "Web Application Compromise – Script Injection",
+ "mitre": "T1059.007, T1185, T1189, T1557.002",
+ "source": "library",
+ "file": "application/pb18-unauthorised-javascript-injection-on-public.json"
+ },
+ {
+ "id": "pb19",
+ "num": 19,
+ "name": "Insecure API Endpoint Exploitation",
+ "cat": "Application",
+ "sev": "critical",
+ "type": "Application-Layer Exploit – API Abuse",
+ "mitre": "T1190, T1499, T1001.003, T1539",
+ "source": "library",
+ "file": "application/pb19-insecure-api-endpoint-exploitation.json"
+ },
+ {
+ "id": "pb20",
+ "num": 20,
+ "name": "Insider Credential Theft and Misuse",
+ "cat": "Insider Threat",
+ "sev": "critical",
+ "type": "Insider Threat – Credential Abuse",
+ "mitre": "T1078, T1087, T1110.003, T1213.003",
+ "source": "library",
+ "file": "insider-threat/pb20-insider-credential-theft-and-misuse.json"
+ },
+ {
+ "id": "pb21",
+ "num": 21,
+ "name": "Cloud Identity Misconfiguration",
+ "cat": "Other",
+ "sev": "critical",
+ "type": "Misconfiguration – IAM / Access Policy",
+ "mitre": "T1078.004, T1098.001, T1550.001",
+ "source": "library",
+ "file": "other/pb21-cloud-identity-misconfiguration.json"
+ },
+ {
+ "id": "pb22",
+ "num": 22,
+ "name": "CI/CD Pipeline Exploitation",
+ "cat": "Supply Chain",
+ "sev": "critical",
+ "type": "Software Supply Chain / Pipeline Compromise",
+ "mitre": "T1556, T1587.002, T1059.006, T1136.003",
+ "source": "library",
+ "file": "supply-chain/pb22-ci-cd-pipeline-exploitation.json"
+ },
+ {
+ "id": "pb23",
+ "num": 23,
+ "name": "Unauthorised Use of Generative AI Tools in",
+ "cat": "Data",
+ "sev": "critical",
+ "type": "Policy Violation / Data Exposure Risk",
+ "mitre": "T1087.003, T1567.002, T1203",
+ "source": "library",
+ "file": "data/pb23-unauthorised-use-of-generative-ai-tools-in.json"
+ },
+ {
+ "id": "pb24",
+ "num": 24,
+ "name": "OAuth Token Replay Abuse",
+ "cat": "Identity",
+ "sev": "critical",
+ "type": "Identity Compromise – Token Abuse",
+ "mitre": "T1528, T1078.004, T1550.003",
+ "source": "library",
+ "file": "identity/pb24-oauth-token-replay-abuse.json"
+ },
+ {
+ "id": "pb25",
+ "num": 25,
+ "name": "Misconfigured Public Cloud Storage Access",
+ "cat": "Cloud",
+ "sev": "critical",
+ "type": "Cloud Misconfiguration – Public Exposure",
+ "mitre": "T1530, T1526, T1213.003",
+ "source": "library",
+ "file": "cloud/pb25-misconfigured-public-cloud-storage-access.json"
+ },
+ {
+ "id": "pb26",
+ "num": 26,
+ "name": "Lateral Movement Across Cloud Workloads",
+ "cat": "Cloud",
+ "sev": "critical",
+ "type": "Cloud Intrusion – Lateral Movement",
+ "mitre": "T1021, T1570, T1086.001, T1534",
+ "source": "library",
+ "file": "cloud/pb26-lateral-movement-across-cloud-workloads.json"
+ },
+ {
+ "id": "pb27",
+ "num": 27,
+ "name": "Unauthorised Cloud Database Snapshot Exports",
+ "cat": "Data",
+ "sev": "critical",
+ "type": "Data Exposure – Snapshot Abuse",
+ "mitre": "T1530, T1005, T1078.004, T1048",
+ "source": "library",
+ "file": "data/pb27-unauthorised-cloud-database-snapshot-exports.json"
+ },
+ {
+ "id": "pb28",
+ "num": 28,
+ "name": "Container Breakout Attempt",
+ "cat": "Other",
+ "sev": "critical",
+ "type": "Container Runtime Security – Escape Attempt",
+ "mitre": "T1611, T1059, T1203",
+ "source": "library",
+ "file": "other/pb28-container-breakout-attempt.json"
+ },
+ {
+ "id": "pb29",
+ "num": 29,
+ "name": "Shadow IT SaaS Usage & Data Exposure",
+ "cat": "Cloud",
+ "sev": "high",
+ "type": "Policy Violation – Unauthorised SaaS Usage",
+ "mitre": "T1087.003, T1537, T1213",
+ "source": "library",
+ "file": "cloud/pb29-shadow-it-saas-usage-data-exposure.json"
+ },
+ {
+ "id": "pb30",
+ "num": 30,
+ "name": "API Key Leakage via Public GitHub Repositories",
+ "cat": "Identity",
+ "sev": "critical",
+ "type": "Credential Exposure – Source Code Leak",
+ "mitre": "T1552.001, T1087, T1528",
+ "source": "library",
+ "file": "identity/pb30-api-key-leakage-via-public-github-repositories.json"
+ },
+ {
+ "id": "pb31",
+ "num": 31,
+ "name": "Unauthorised Access to CI/CD Secrets",
+ "cat": "Identity",
+ "sev": "critical",
+ "type": "Credential Exposure – CI/CD Security Breach",
+ "mitre": "T1552.004, T1529, T1078.004, T1059",
+ "source": "library",
+ "file": "identity/pb31-unauthorised-access-to-ci-cd-secrets.json"
+ },
+ {
+ "id": "pb32",
+ "num": 32,
+ "name": "Zero-Day Exploitation in Third-Party Libraries",
+ "cat": "Supply Chain",
+ "sev": "critical",
+ "type": "Zero-Day Exploitation – Supply Chain / Library",
+ "mitre": "T1190, T1210, T1588.006",
+ "source": "library",
+ "file": "supply-chain/pb32-zero-day-exploitation-in-third-party-libraries.json"
+ },
+ {
+ "id": "pb33",
+ "num": 33,
+ "name": "Abuse of Stolen Session Tokens in SaaS",
+ "cat": "Cloud",
+ "sev": "critical",
+ "type": "Account Hijack – Session Token Abuse",
+ "mitre": "T1539, T1078, T1185",
+ "source": "library",
+ "file": "cloud/pb33-abuse-of-stolen-session-tokens-in-saas.json"
+ },
+ {
+ "id": "pb34",
+ "num": 34,
+ "name": "Cloud-Native Ransomware in Object Storage",
+ "cat": "Malware",
+ "sev": "critical",
+ "type": "Ransomware – Object Storage (Cloud-native)",
+ "mitre": "T1485, T1486, T1531",
+ "source": "library",
+ "file": "malware/pb34-cloud-native-ransomware-in-object-storage.json"
+ },
+ {
+ "id": "pb35",
+ "num": 35,
+ "name": "Malicious Insider Staging Data in the Cloud",
+ "cat": "Insider Threat",
+ "sev": "critical",
+ "type": "Insider Threat – Data Staging / Exfiltration",
+ "mitre": "T1537, T1081, T1567.002",
+ "source": "library",
+ "file": "insider-threat/pb35-malicious-insider-staging-data-in-the-cloud.json"
+ },
+ {
+ "id": "pb36",
+ "num": 36,
+ "name": "Unauthorised SaaS OAuth Application",
+ "cat": "Cloud",
+ "sev": "critical",
+ "type": "OAuth Abuse – Unauthorised Third-Party App",
+ "mitre": "T1528, T1550.001, T1098.003",
+ "source": "library",
+ "file": "cloud/pb36-unauthorised-saas-oauth-application.json"
+ },
+ {
+ "id": "pb-dns",
+ "num": 37,
+ "name": "DNS Attacks",
+ "cat": "Network",
+ "sev": "high",
+ "type": "Network – DNS Abuse",
+ "mitre": "T1071.004, T1048.003, T1568.002, T1498",
+ "source": "library",
+ "file": "network/pb-dns-attacks.json"
+ },
+ {
+ "id": "pb38",
+ "num": 38,
+ "name": "Phishing / Spearphishing",
+ "cat": "Identity",
+ "sev": "high",
+ "type": "Social Engineering – Phishing / Spearphishing",
+ "mitre": "T1566, T1566.001, T1204.002, T1078",
+ "source": "library",
+ "updated": "2026-05-17",
+ "related": [
+ "pb08",
+ "pb20",
+ "pb42"
+ ],
+ "file": "identity/pb38-phishing-spearphishing.json"
+ },
+ {
+ "id": "pb39",
+ "num": 39,
+ "name": "AD / Kerberos Attacks",
+ "cat": "Identity",
+ "sev": "critical",
+ "type": "Identity Attack – Active Directory / Kerberos",
+ "mitre": "T1558.003, T1558.001, T1550.003, T1078",
+ "source": "library",
+ "updated": "2026-05-17",
+ "related": [
+ "pb09",
+ "pb14",
+ "pb20"
+ ],
+ "file": "identity/pb39-ad-kerberos-attacks.json"
+ },
+ {
+ "id": "pb40",
+ "num": 40,
+ "name": "LOLBins / Living-off-the-Land",
+ "cat": "Malware",
+ "sev": "high",
+ "type": "Malware – Living-off-the-Land / LOLBin Abuse",
+ "mitre": "T1218, T1059.003, T1055, T1574",
+ "source": "library",
+ "updated": "2026-05-17",
+ "related": [
+ "pb01",
+ "pb09",
+ "pb39"
+ ],
+ "file": "malware/pb40-lolbins-living-off-the-land.json"
+ },
+ {
+ "id": "pb41",
+ "num": 41,
+ "name": "ARP Spoofing / MITM / Port Scan",
+ "cat": "Network",
+ "sev": "high",
+ "type": "Network – Man-in-the-Middle / Reconnaissance",
+ "mitre": "T1557.002, T1046, T1040, T1018",
+ "source": "library",
+ "updated": "2026-05-17",
+ "related": [
+ "pb14",
+ "pb17",
+ "pb07"
+ ],
+ "file": "network/pb41-network-attacks-arp-mitm.json"
+ },
+ {
+ "id": "pb42",
+ "num": 42,
+ "name": "MFA Bypass / SIM Swap",
+ "cat": "Identity",
+ "sev": "critical",
+ "type": "Account Takeover – MFA Fatigue / SIM Swap",
+ "mitre": "T1621, T1566.001, T1111, T1078, T1539",
+ "source": "library",
+ "updated": "2026-05-17",
+ "related": [
+ "pb03",
+ "pb11",
+ "pb38"
+ ],
+ "file": "identity/pb42-mfa-bypass-sim-swap.json"
+ },
+ {
+ "id": "apt-g0001",
+ "num": 43,
+ "name": "MITRE ATT&CK Group — Axiom",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1189, T1190, T1566, T1203, T1546.008, T1003, T1021.001, T1563.002, T1005, T1560, T1001.002, T1553, T1583.002, T1583.003, T1584.005",
+ "source": "library",
+ "file": "threat-groups/apt-g0001-axiom.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0002",
+ "num": 44,
+ "name": "MITRE ATT&CK Group — Moafee",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1027.001",
+ "source": "library",
+ "file": "threat-groups/apt-g0002-moafee.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0003",
+ "num": 45,
+ "name": "MITRE ATT&CK Group — Cleaver",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1003.001, T1557.002, T1585.001, T1587.001, T1588.002",
+ "source": "library",
+ "file": "threat-groups/apt-g0003-cleaver.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0004",
+ "num": 46,
+ "name": "MITRE ATT&CK Group — Ke3chang",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1078.004, T1133, T1190, T1059, T1059.003, T1569.002, T1543.003, T1547.001, T1003.001, T1003.002, T1003.003, T1003.004, T1056.001, T1558.001, T1007, T1016, T1018, T1033, T1049, T1057, T1069.002, T1082, T1083",
+ "source": "library",
+ "file": "threat-groups/apt-g0004-ke3chang.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0005",
+ "num": 47,
+ "name": "MITRE ATT&CK Group — APT12",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1566.001, T1203, T1204.002, T1102.002, T1568.003",
+ "source": "library",
+ "file": "threat-groups/apt-g0005-apt12.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0006",
+ "num": 48,
+ "name": "MITRE ATT&CK Group — APT1",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1566.001, T1566.002, T1059.003, T1003.001, T1007, T1016, T1049, T1057, T1087.001, T1135, T1021.001, T1550.002, T1005, T1114.001, T1114.002, T1119, T1560.001, T1583.001, T1584.001, T1585.002, T1588.001, T1588.002, T1036.005",
+ "source": "library",
+ "file": "threat-groups/apt-g0006-apt1.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0007",
+ "num": 49,
+ "name": "MITRE ATT&CK Group — APT28",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1078.004, T1091, T1133, T1189, T1190, T1199, T1566.001, T1669, T1059.001, T1059.003, T1203, T1204.001, T1204.002, T1559.002, T1037.001, T1098.002, T1137.002, T1505.003, T1542.003, T1546.015, T1547.001, T1068, T1134.001",
+ "source": "library",
+ "file": "threat-groups/apt-g0007-apt28.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0008",
+ "num": 50,
+ "name": "MITRE ATT&CK Group — Carbanak",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1543.003, T1102.002, T1219, T1686, T1588.002, T1036.004, T1036.005, T1218.011",
+ "source": "library",
+ "file": "threat-groups/apt-g0008-carbanak.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0009",
+ "num": 51,
+ "name": "MITRE ATT&CK Group — Deep Panda",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1047, T1059.001, T1505.003, T1546.008, T1018, T1057, T1021.002, T1027.005, T1218.010, T1564.003",
+ "source": "library",
+ "file": "threat-groups/apt-g0009-deep-panda.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0010",
+ "num": 52,
+ "name": "MITRE ATT&CK Group — Turla",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078.003, T1189, T1566.002, T1059.001, T1059.003, T1059.005, T1059.006, T1059.007, T1106, T1204.001, T1112, T1546.003, T1546.013, T1547.001, T1547.004, T1055, T1055.001, T1068, T1134.002, T1110, T1555.004, T1007, T1012, T1016",
+ "source": "library",
+ "file": "threat-groups/apt-g0010-turla.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0011",
+ "num": 53,
+ "name": "MITRE ATT&CK Group — PittyTiger",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1588.002",
+ "source": "library",
+ "file": "threat-groups/apt-g0011-pittytiger.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0012",
+ "num": 54,
+ "name": "MITRE ATT&CK Group — Darkhotel",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1091, T1189, T1566.001, T1059.003, T1203, T1204.002, T1547.001, T1056.001, T1016, T1057, T1082, T1083, T1124, T1497, T1497.001, T1497.002, T1518.001, T1080, T1105, T1573.001, T1553.002, T1027.013, T1036.005, T1140",
+ "source": "library",
+ "file": "threat-groups/apt-g0012-darkhotel.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0013",
+ "num": 55,
+ "name": "MITRE ATT&CK Group — APT30",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1566.001, T1204.002",
+ "source": "library",
+ "file": "threat-groups/apt-g0013-apt30.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0016",
+ "num": 56,
+ "name": "MITRE ATT&CK Group — APT29",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1078.003, T1078.004, T1133, T1190, T1199, T1566.001, T1566.002, T1566.003, T1047, T1053.005, T1059.001, T1059.006, T1059.009, T1203, T1204.001, T1204.002, T1651, T1037, T1037.004, T1098.002, T1098.005, T1136.003, T1505.003",
+ "source": "library",
+ "file": "threat-groups/apt-g0016-apt29.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0017",
+ "num": 57,
+ "name": "MITRE ATT&CK Group — DragonOK",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "",
+ "source": "library",
+ "file": "threat-groups/apt-g0017-dragonok.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0018",
+ "num": 58,
+ "name": "MITRE ATT&CK Group — admin@338",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1566.001, T1059.003, T1203, T1204.002, T1007, T1016, T1049, T1069.001, T1082, T1083, T1087.001, T1036.005",
+ "source": "library",
+ "file": "threat-groups/apt-g0018-admin-338.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0019",
+ "num": 59,
+ "name": "MITRE ATT&CK Group — Naikon",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078.002, T1566.001, T1047, T1053.005, T1204.002, T1574.001, T1137.006, T1547.001, T1016, T1018, T1046, T1518.001, T1036.004, T1036.005",
+ "source": "library",
+ "file": "threat-groups/apt-g0019-naikon.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0020",
+ "num": 60,
+ "name": "MITRE ATT&CK Group — Equation",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1542.002, T1120, T1480.001, T1564.005",
+ "source": "library",
+ "file": "threat-groups/apt-g0020-equation.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0021",
+ "num": 61,
+ "name": "MITRE ATT&CK Group — Molerats",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1566.001, T1566.002, T1053.005, T1059.001, T1059.005, T1059.007, T1204.001, T1204.002, T1547.001, T1555.003, T1057, T1105, T1553.002, T1027.015, T1140, T1218.007",
+ "source": "library",
+ "file": "threat-groups/apt-g0021-molerats.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0022",
+ "num": 62,
+ "name": "MITRE ATT&CK Group — APT3",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078.002, T1566.002, T1053.005, T1059.001, T1059.003, T1203, T1204.001, T1574.001, T1098.007, T1136.001, T1543.003, T1546.008, T1547.001, T1003.001, T1056.001, T1110.002, T1552.001, T1555.003, T1016, T1018, T1033, T1049, T1057, T1069",
+ "source": "library",
+ "file": "threat-groups/apt-g0022-apt3.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0023",
+ "num": 63,
+ "name": "MITRE ATT&CK Group — APT16",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1584.004",
+ "source": "library",
+ "file": "threat-groups/apt-g0023-apt16.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0024",
+ "num": 64,
+ "name": "MITRE ATT&CK Group — Putter Panda",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1547.001, T1055.001, T1685, T1027.013",
+ "source": "library",
+ "file": "threat-groups/apt-g0024-putter-panda.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0025",
+ "num": 65,
+ "name": "MITRE ATT&CK Group — APT17",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1583.006, T1585",
+ "source": "library",
+ "file": "threat-groups/apt-g0025-apt17.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0026",
+ "num": 66,
+ "name": "MITRE ATT&CK Group — APT18",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1133, T1053.002, T1059.003, T1547.001, T1082, T1083, T1071.001, T1071.004, T1105, T1027.013, T1070.004",
+ "source": "library",
+ "file": "threat-groups/apt-g0026-apt18.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0027",
+ "num": 67,
+ "name": "MITRE ATT&CK Group — Threat Group-3390",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1133, T1189, T1190, T1195.002, T1199, T1566.001, T1047, T1053.002, T1059.001, T1059.003, T1203, T1204.002, T1574.001, T1112, T1505.003, T1543.003, T1547.001, T1055.012, T1068, T1548.002, T1003.001, T1003.002, T1003.004",
+ "source": "library",
+ "file": "threat-groups/apt-g0027-threat-group-3390.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0028",
+ "num": 68,
+ "name": "MITRE ATT&CK Group — Threat Group-1314",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078.002, T1059.003, T1072, T1021.002",
+ "source": "library",
+ "file": "threat-groups/apt-g0028-threat-group-1314.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0029",
+ "num": 69,
+ "name": "MITRE ATT&CK Group — Scarlet Mimic",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1036.002",
+ "source": "library",
+ "file": "threat-groups/apt-g0029-scarlet-mimic.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0030",
+ "num": 70,
+ "name": "MITRE ATT&CK Group — Lotus Blossom",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1047, T1112, T1543.003, T1134, T1539, T1012, T1016, T1016.001, T1018, T1046, T1049, T1083, T1087.001, T1087.002, T1482, T1074.001, T1560.001, T1560.003, T1090.001, T1090.003, T1588.002",
+ "source": "library",
+ "file": "threat-groups/apt-g0030-lotus-blossom.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0032",
+ "num": 71,
+ "name": "MITRE ATT&CK Group — Lazarus Group",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1189, T1566.001, T1566.002, T1566.003, T1047, T1053.005, T1059.001, T1059.003, T1059.005, T1106, T1203, T1204.002, T1574.001, T1574.013, T1098, T1542.003, T1543.003, T1547.001, T1547.009, T1055.001, T1134.002, T1056.001, T1110.003",
+ "source": "library",
+ "file": "threat-groups/apt-g0032-lazarus-group.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0033",
+ "num": 72,
+ "name": "MITRE ATT&CK Group — Poseidon Group",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1059.001, T1003, T1007, T1049, T1057, T1087.001, T1087.002, T1036.005",
+ "source": "library",
+ "file": "threat-groups/apt-g0033-poseidon-group.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0034",
+ "num": 73,
+ "name": "MITRE ATT&CK Group — Sandworm Team",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1078.002, T1133, T1190, T1195, T1195.002, T1199, T1566.001, T1566.002, T1047, T1053.005, T1059.001, T1059.005, T1072, T1106, T1203, T1204.001, T1204.002, T1505.003, T1003.001, T1003.003, T1040, T1056.001, T1539",
+ "source": "library",
+ "file": "threat-groups/apt-g0034-sandworm-team.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0035",
+ "num": 74,
+ "name": "MITRE ATT&CK Group — Dragonfly",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1133, T1189, T1190, T1195.002, T1566.001, T1053.005, T1059, T1059.001, T1059.003, T1059.006, T1203, T1204.002, T1098.007, T1112, T1136.001, T1505.003, T1547.001, T1003.002, T1003.003, T1003.004, T1110, T1110.002, T1187",
+ "source": "library",
+ "file": "threat-groups/apt-g0035-dragonfly.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0036",
+ "num": 75,
+ "name": "MITRE ATT&CK Group — GCMAN",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1021.004, T1021.005",
+ "source": "library",
+ "file": "threat-groups/apt-g0036-gcman.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0037",
+ "num": 76,
+ "name": "MITRE ATT&CK Group — FIN6",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1566.001, T1566.003, T1047, T1053.005, T1059, T1059.001, T1059.003, T1059.007, T1204.002, T1569.002, T1547.001, T1068, T1134, T1003.001, T1003.003, T1110.002, T1555, T1555.003, T1018, T1046, T1087.002, T1021.001, T1005",
+ "source": "library",
+ "file": "threat-groups/apt-g0037-fin6.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0038",
+ "num": 77,
+ "name": "MITRE ATT&CK Group — Stealth Falcon",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1047, T1053.005, T1059, T1059.001, T1555, T1555.003, T1555.004, T1012, T1016, T1033, T1057, T1082, T1005, T1071.001, T1573.001, T1041",
+ "source": "library",
+ "file": "threat-groups/apt-g0038-stealth-falcon.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0039",
+ "num": 78,
+ "name": "MITRE ATT&CK Group — Suckfly",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1059.003, T1003, T1046, T1553.002",
+ "source": "library",
+ "file": "threat-groups/apt-g0039-suckfly.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0040",
+ "num": 79,
+ "name": "MITRE ATT&CK Group — Patchwork",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1189, T1566.001, T1566.002, T1053.005, T1059.001, T1059.003, T1059.005, T1197, T1203, T1204.001, T1204.002, T1559.002, T1574.001, T1112, T1547.001, T1055.012, T1548.002, T1555.003, T1033, T1082, T1083, T1518.001, T1680, T1021.001",
+ "source": "library",
+ "file": "threat-groups/apt-g0040-patchwork.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0041",
+ "num": 80,
+ "name": "MITRE ATT&CK Group — Strider",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1556.002, T1090.001, T1564.005",
+ "source": "library",
+ "file": "threat-groups/apt-g0041-strider.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0043",
+ "num": 81,
+ "name": "MITRE ATT&CK Group — Group5",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1056.001, T1113, T1027.013, T1070.004",
+ "source": "library",
+ "file": "threat-groups/apt-g0043-group5.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0044",
+ "num": 82,
+ "name": "MITRE ATT&CK Group — Winnti Group",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1057, T1083, T1105, T1553.002, T1583.001, T1014",
+ "source": "library",
+ "file": "threat-groups/apt-g0044-winnti-group.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0045",
+ "num": 83,
+ "name": "MITRE ATT&CK Group — menuPass",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1190, T1199, T1566.001, T1047, T1053.005, T1059.001, T1059.003, T1106, T1204.002, T1574.001, T1055.012, T1003.002, T1003.003, T1003.004, T1056.001, T1016, T1018, T1046, T1049, T1083, T1087.002, T1021.001, T1021.004",
+ "source": "library",
+ "file": "threat-groups/apt-g0045-menupass.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0046",
+ "num": 84,
+ "name": "MITRE ATT&CK Group — FIN7",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1078.003, T1091, T1190, T1195.002, T1566.001, T1566.002, T1047, T1053.005, T1059, T1059.001, T1059.003, T1059.005, T1059.007, T1204.001, T1204.002, T1559.002, T1569.002, T1674, T1543.003, T1546.011, T1547.001, T1558.003, T1033",
+ "source": "library",
+ "file": "threat-groups/apt-g0046-fin7.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0047",
+ "num": 85,
+ "name": "MITRE ATT&CK Group — Gamaredon Group",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1091, T1566.001, T1047, T1053.005, T1059.001, T1059.003, T1059.005, T1106, T1204.001, T1204.002, T1559.001, T1112, T1137, T1547.001, T1055, T1012, T1016.001, T1033, T1057, T1082, T1083, T1120, T1497.001, T1518.001",
+ "source": "library",
+ "file": "threat-groups/apt-g0047-gamaredon-group.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0048",
+ "num": 86,
+ "name": "MITRE ATT&CK Group — RTM",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1189, T1566.001, T1204.002, T1574.001, T1547.001, T1102.001, T1219.002",
+ "source": "library",
+ "file": "threat-groups/apt-g0048-rtm.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0049",
+ "num": 87,
+ "name": "MITRE ATT&CK Group — OilRig",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1078.002, T1133, T1195, T1566.001, T1566.002, T1566.003, T1047, T1053.005, T1059, T1059.001, T1059.003, T1059.005, T1203, T1204.001, T1204.002, T1112, T1137.004, T1505.003, T1543.003, T1556.002, T1068, T1003.001, T1003.004",
+ "source": "library",
+ "file": "threat-groups/apt-g0049-oilrig.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0050",
+ "num": 88,
+ "name": "MITRE ATT&CK Group — APT32",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078.003, T1189, T1566.001, T1566.002, T1047, T1053.005, T1059, T1059.001, T1059.003, T1059.005, T1059.007, T1072, T1203, T1204.001, T1204.002, T1569.002, T1574.001, T1112, T1137, T1505.003, T1543.003, T1547.001, T1055, T1068",
+ "source": "library",
+ "file": "threat-groups/apt-g0050-apt32.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0051",
+ "num": 89,
+ "name": "MITRE ATT&CK Group — FIN10",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1078.003, T1053.005, T1059.001, T1059.003, T1547.001, T1033, T1021.001, T1570, T1588.002, T1070.004",
+ "source": "library",
+ "file": "threat-groups/apt-g0051-fin10.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0052",
+ "num": 90,
+ "name": "MITRE ATT&CK Group — CopyKittens",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1059.001, T1560.001, T1560.003, T1090, T1553.002, T1588.002, T1218.011, T1564.003",
+ "source": "library",
+ "file": "threat-groups/apt-g0052-copykittens.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0053",
+ "num": 91,
+ "name": "MITRE ATT&CK Group — FIN5",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1133, T1059, T1110, T1018, T1074.001, T1119, T1090.002, T1685.005, T1588.002, T1070.004",
+ "source": "library",
+ "file": "threat-groups/apt-g0053-fin5.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0054",
+ "num": 92,
+ "name": "MITRE ATT&CK Group — Sowbug",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1059.003, T1003, T1056.001, T1082, T1083, T1135, T1039, T1560.001, T1036.005",
+ "source": "library",
+ "file": "threat-groups/apt-g0054-sowbug.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0055",
+ "num": 93,
+ "name": "MITRE ATT&CK Group — NEODYMIUM",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "",
+ "source": "library",
+ "file": "threat-groups/apt-g0055-neodymium.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0056",
+ "num": 94,
+ "name": "MITRE ATT&CK Group — PROMETHIUM",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078.003, T1189, T1204.002, T1205.001, T1543.003, T1547.001, T1553.002, T1587.002, T1587.003, T1036.004, T1036.005",
+ "source": "library",
+ "file": "threat-groups/apt-g0056-promethium.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0059",
+ "num": 95,
+ "name": "MITRE ATT&CK Group — Magic Hound",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078.001, T1078.002, T1189, T1190, T1566.002, T1566.003, T1047, T1053.005, T1059.001, T1059.003, T1059.005, T1204.001, T1204.002, T1098.002, T1098.007, T1112, T1136.001, T1505.003, T1547.001, T1003.001, T1056.001, T1016, T1016.001, T1016.002",
+ "source": "library",
+ "file": "threat-groups/apt-g0059-magic-hound.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0060",
+ "num": 96,
+ "name": "MITRE ATT&CK Group — BRONZE BUTLER",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1189, T1566.001, T1053.002, T1053.005, T1059.001, T1059.003, T1059.005, T1059.006, T1203, T1204.002, T1574.001, T1547.001, T1548.002, T1003.001, T1007, T1018, T1083, T1087.002, T1124, T1518, T1080, T1550.003, T1005, T1039",
+ "source": "library",
+ "file": "threat-groups/apt-g0060-bronze-butler.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0061",
+ "num": 97,
+ "name": "MITRE ATT&CK Group — FIN8",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1566.001, T1566.002, T1047, T1053.005, T1059.001, T1059.003, T1204.001, T1204.002, T1112, T1546.003, T1055.004, T1068, T1134.001, T1003.001, T1016.001, T1018, T1033, T1082, T1482, T1518.001, T1021.001, T1021.002, T1074.002",
+ "source": "library",
+ "file": "threat-groups/apt-g0061-fin8.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0062",
+ "num": 98,
+ "name": "MITRE ATT&CK Group — TA459",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1566.001, T1059.001, T1059.005, T1203, T1204.002",
+ "source": "library",
+ "file": "threat-groups/apt-g0062-ta459.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0063",
+ "num": 99,
+ "name": "MITRE ATT&CK Group — BlackOasis",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1027",
+ "source": "library",
+ "file": "threat-groups/apt-g0063-blackoasis.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0064",
+ "num": 100,
+ "name": "MITRE ATT&CK Group — APT33",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1078.004, T1566.001, T1566.002, T1053.005, T1059.001, T1059.005, T1203, T1204.001, T1204.002, T1546.003, T1547.001, T1068, T1003.001, T1003.004, T1003.005, T1040, T1110.003, T1552.001, T1552.006, T1555, T1555.003, T1560.001, T1071.001",
+ "source": "library",
+ "file": "threat-groups/apt-g0064-apt33.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0065",
+ "num": 101,
+ "name": "MITRE ATT&CK Group — Leviathan",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1133, T1189, T1190, T1566.001, T1566.002, T1047, T1059.001, T1059.005, T1197, T1203, T1204.001, T1204.002, T1559.002, T1505.003, T1546.003, T1547.001, T1547.009, T1055.001, T1003, T1003.001, T1021.001, T1021.004, T1534",
+ "source": "library",
+ "file": "threat-groups/apt-g0065-leviathan.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0066",
+ "num": 102,
+ "name": "MITRE ATT&CK Group — Elderwood",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1189, T1566.001, T1566.002, T1203, T1204.001, T1204.002, T1105, T1027.002, T1027.013",
+ "source": "library",
+ "file": "threat-groups/apt-g0066-elderwood.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0067",
+ "num": 103,
+ "name": "MITRE ATT&CK Group — APT37",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1189, T1566.001, T1053.005, T1059, T1059.003, T1059.005, T1059.006, T1106, T1203, T1204.002, T1559.002, T1547.001, T1055, T1548.002, T1555.003, T1033, T1057, T1082, T1120, T1005, T1123, T1071.001, T1102.002, T1105",
+ "source": "library",
+ "file": "threat-groups/apt-g0067-apt37.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0068",
+ "num": 104,
+ "name": "MITRE ATT&CK Group — PLATINUM",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1189, T1566.001, T1204.002, T1055, T1068, T1003.001, T1056.001, T1056.004, T1095, T1105, T1036",
+ "source": "library",
+ "file": "threat-groups/apt-g0068-platinum.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0069",
+ "num": 105,
+ "name": "MITRE ATT&CK Group — MuddyWater",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1190, T1566, T1566.001, T1566.002, T1047, T1053.005, T1059.001, T1059.003, T1059.005, T1059.006, T1059.007, T1203, T1204.001, T1204.002, T1204.004, T1559.001, T1559.002, T1574.001, T1137.001, T1547.001, T1548.002, T1003.001, T1003.004, T1003.005",
+ "source": "library",
+ "file": "threat-groups/apt-g0069-muddywater.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0070",
+ "num": 106,
+ "name": "MITRE ATT&CK Group — Dark Caracal",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1189, T1566.003, T1059.003, T1204.002, T1547.001, T1083, T1005, T1113, T1071.001, T1027.002, T1027.013, T1218.001",
+ "source": "library",
+ "file": "threat-groups/apt-g0070-dark-caracal.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0071",
+ "num": 107,
+ "name": "MITRE ATT&CK Group — Orangeworm",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1021.002, T1071.001",
+ "source": "library",
+ "file": "threat-groups/apt-g0071-orangeworm.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0073",
+ "num": 108,
+ "name": "MITRE ATT&CK Group — APT19",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1189, T1566.001, T1059, T1059.001, T1204.002, T1574.001, T1112, T1543.003, T1547.001, T1016, T1033, T1082, T1071.001, T1132.001, T1588.002, T1027.010, T1027.013, T1140, T1218.010, T1218.011, T1564.003",
+ "source": "library",
+ "file": "threat-groups/apt-g0073-apt19.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0075",
+ "num": 109,
+ "name": "MITRE ATT&CK Group — Rancor",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1566.001, T1053.005, T1059.003, T1059.005, T1204.002, T1546.003, T1071.001, T1105, T1218.007",
+ "source": "library",
+ "file": "threat-groups/apt-g0075-rancor.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0076",
+ "num": 110,
+ "name": "MITRE ATT&CK Group — Thrip",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1059.001, T1219.002, T1048.003, T1588.002",
+ "source": "library",
+ "file": "threat-groups/apt-g0076-thrip.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0077",
+ "num": 111,
+ "name": "MITRE ATT&CK Group — Leafminer",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1189, T1059.007, T1136.001, T1055.013, T1003.001, T1003.004, T1003.005, T1110.003, T1552.001, T1555, T1555.003, T1018, T1046, T1083, T1114.002, T1588.002, T1027.010",
+ "source": "library",
+ "file": "threat-groups/apt-g0077-leafminer.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0078",
+ "num": 112,
+ "name": "MITRE ATT&CK Group — Gorgon Group",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1566.001, T1059.001, T1059.003, T1059.005, T1106, T1204.002, T1112, T1547.001, T1547.009, T1055.002, T1055.012, T1105, T1685, T1588.002, T1140, T1564.003",
+ "source": "library",
+ "file": "threat-groups/apt-g0078-gorgon-group.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0079",
+ "num": 113,
+ "name": "MITRE ATT&CK Group — DarkHydrus",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1566.001, T1059.001, T1204.002, T1187, T1588.002, T1221, T1564.003",
+ "source": "library",
+ "file": "threat-groups/apt-g0079-darkhydrus.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0080",
+ "num": 114,
+ "name": "MITRE ATT&CK Group — Cobalt Group",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1195.002, T1566.001, T1566.002, T1053.005, T1059.001, T1059.003, T1059.005, T1059.007, T1203, T1204.001, T1204.002, T1559.002, T1037.001, T1543.003, T1547.001, T1055, T1068, T1548.002, T1046, T1518.001, T1021.001, T1071.001, T1071.004, T1105",
+ "source": "library",
+ "file": "threat-groups/apt-g0080-cobalt-group.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0081",
+ "num": 115,
+ "name": "MITRE ATT&CK Group — Tropic Trooper",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078.003, T1091, T1566.001, T1059.003, T1106, T1203, T1204.002, T1574.001, T1505.003, T1543.003, T1547.001, T1547.004, T1055.001, T1016, T1033, T1046, T1049, T1057, T1082, T1083, T1135, T1518, T1518.001, T1680",
+ "source": "library",
+ "file": "threat-groups/apt-g0081-tropic-trooper.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0082",
+ "num": 116,
+ "name": "MITRE ATT&CK Group — APT38",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1189, T1566.001, T1053.003, T1053.005, T1059.001, T1059.003, T1059.005, T1106, T1204.001, T1204.002, T1569.002, T1112, T1505.003, T1543.003, T1055, T1548.002, T1056.001, T1110, T1033, T1049, T1057, T1082, T1083, T1135",
+ "source": "library",
+ "file": "threat-groups/apt-g0082-apt38.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0083",
+ "num": 117,
+ "name": "MITRE ATT&CK Group — SilverTerrier",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1071.001, T1071.002, T1071.003, T1657",
+ "source": "library",
+ "file": "threat-groups/apt-g0083-silverterrier.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0084",
+ "num": 118,
+ "name": "MITRE ATT&CK Group — Gallmaker",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1566.001, T1059.001, T1204.002, T1559.002, T1560.001, T1027",
+ "source": "library",
+ "file": "threat-groups/apt-g0084-gallmaker.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0085",
+ "num": 119,
+ "name": "MITRE ATT&CK Group — FIN4",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1566.001, T1566.002, T1059.005, T1204.001, T1204.002, T1056.001, T1056.002, T1114.002, T1071.001, T1090.003, T1564.008",
+ "source": "library",
+ "file": "threat-groups/apt-g0085-fin4.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0087",
+ "num": 120,
+ "name": "MITRE ATT&CK Group — APT39",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1190, T1566.001, T1566.002, T1053.005, T1059, T1059.001, T1059.005, T1059.006, T1059.010, T1197, T1204.001, T1204.002, T1569.002, T1136.001, T1505.003, T1546.010, T1547.001, T1547.009, T1003, T1003.001, T1056, T1056.001, T1110",
+ "source": "library",
+ "file": "threat-groups/apt-g0087-apt39.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0088",
+ "num": 121,
+ "name": "MITRE ATT&CK Group — TEMP.Veles",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "",
+ "source": "library",
+ "file": "threat-groups/apt-g0088-temp-veles.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0089",
+ "num": 122,
+ "name": "MITRE ATT&CK Group — The White Company",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1566.001, T1203, T1204.002, T1124, T1518.001, T1027.002, T1070.004",
+ "source": "library",
+ "file": "threat-groups/apt-g0089-the-white-company.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0090",
+ "num": 123,
+ "name": "MITRE ATT&CK Group — WIRTE",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1566.001, T1566.002, T1059.001, T1059.003, T1059.005, T1106, T1204.001, T1204.002, T1574.001, T1497.001, T1074.001, T1114.001, T1071.001, T1105, T1571, T1041, T1583.001, T1586.002, T1588.002, T1608.001, T1027.010, T1027.015, T1036.005, T1140",
+ "source": "library",
+ "file": "threat-groups/apt-g0090-wirte.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0091",
+ "num": 124,
+ "name": "MITRE ATT&CK Group — Silence",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1566.001, T1053.005, T1059.001, T1059.003, T1059.005, T1059.007, T1072, T1106, T1204.002, T1569.002, T1112, T1547.001, T1055, T1003.001, T1018, T1021.001, T1113, T1125, T1090.002, T1105, T1571, T1553.002, T1588.002",
+ "source": "library",
+ "file": "threat-groups/apt-g0091-silence.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0092",
+ "num": 125,
+ "name": "MITRE ATT&CK Group — TA505",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078.002, T1566.001, T1566.002, T1059.001, T1059.003, T1059.005, T1059.007, T1106, T1204.001, T1204.002, T1559.002, T1112, T1055.001, T1552.001, T1555.003, T1069, T1087.003, T1071.001, T1105, T1568.001, T1486, T1553.002, T1553.005, T1685",
+ "source": "library",
+ "file": "threat-groups/apt-g0092-ta505.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0093",
+ "num": 126,
+ "name": "MITRE ATT&CK Group — GALLIUM",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1133, T1190, T1047, T1053.005, T1059.001, T1059.003, T1574.001, T1136.002, T1505.003, T1003.001, T1003.002, T1016, T1018, T1033, T1049, T1550.002, T1570, T1005, T1074.001, T1560.001, T1090.002, T1105, T1041",
+ "source": "library",
+ "file": "threat-groups/apt-g0093-gallium.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0094",
+ "num": 127,
+ "name": "MITRE ATT&CK Group — Kimsuky",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078.003, T1133, T1190, T1566, T1566.001, T1566.002, T1053.005, T1059.001, T1059.003, T1059.005, T1059.006, T1059.007, T1106, T1204.001, T1204.002, T1204.004, T1559.001, T1098.007, T1112, T1136.001, T1176.001, T1205, T1505.003, T1543.003",
+ "source": "library",
+ "file": "threat-groups/apt-g0094-kimsuky.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0095",
+ "num": 128,
+ "name": "MITRE ATT&CK Group — Machete",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1189, T1566.001, T1566.002, T1053.005, T1059.003, T1059.005, T1059.006, T1204.001, T1204.002, T1036.005, T1218.007",
+ "source": "library",
+ "file": "threat-groups/apt-g0095-machete.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0096",
+ "num": 129,
+ "name": "MITRE ATT&CK Group — APT41",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1133, T1190, T1195.002, T1566.001, T1047, T1053.005, T1059.001, T1059.003, T1059.004, T1197, T1203, T1569.002, T1574.001, T1574.006, T1037, T1098.007, T1112, T1136.001, T1542.003, T1543.003, T1546.008, T1547.001, T1055",
+ "source": "library",
+ "file": "threat-groups/apt-g0096-apt41.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0098",
+ "num": 130,
+ "name": "MITRE ATT&CK Group — BlackTech",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1190, T1566.001, T1566.002, T1106, T1203, T1204.001, T1204.002, T1574.001, T1046, T1021.004, T1588.002, T1588.003, T1588.004, T1036.002",
+ "source": "library",
+ "file": "threat-groups/apt-g0098-blacktech.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0099",
+ "num": 131,
+ "name": "MITRE ATT&CK Group — APT-C-36",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1133, T1566.001, T1566.002, T1047, T1053.005, T1059.001, T1059.005, T1059.007, T1204.001, T1204.002, T1574.001, T1055.012, T1534, T1105, T1568, T1571, T1593, T1583.001, T1583.003, T1583.006, T1584.005, T1586.002, T1586.003, T1587.001",
+ "source": "library",
+ "file": "threat-groups/apt-g0099-apt-c-36.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0100",
+ "num": 132,
+ "name": "MITRE ATT&CK Group — Inception",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1566.001, T1059.001, T1059.005, T1203, T1204.002, T1547.001, T1555.003, T1057, T1069.002, T1082, T1083, T1518, T1005, T1071.001, T1090.003, T1102, T1573.001, T1588.002, T1027.013, T1218.005, T1218.010, T1221",
+ "source": "library",
+ "file": "threat-groups/apt-g0100-inception.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0102",
+ "num": 133,
+ "name": "MITRE ATT&CK Group — Wizard Spider",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1078.002, T1133, T1566.001, T1566.002, T1047, T1053.005, T1059.001, T1059.003, T1197, T1204.001, T1204.002, T1569.002, T1112, T1136.001, T1136.002, T1543.003, T1547.001, T1547.004, T1055, T1055.001, T1003.001, T1003.002, T1003.003",
+ "source": "library",
+ "file": "threat-groups/apt-g0102-wizard-spider.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0103",
+ "num": 134,
+ "name": "MITRE ATT&CK Group — Mofang",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1566.001, T1566.002, T1204.001, T1204.002, T1027.013, T1027.015",
+ "source": "library",
+ "file": "threat-groups/apt-g0103-mofang.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0105",
+ "num": 135,
+ "name": "MITRE ATT&CK Group — DarkVishnya",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1200, T1059.001, T1543.003, T1040, T1110, T1046, T1135, T1219, T1571, T1588.002",
+ "source": "library",
+ "file": "threat-groups/apt-g0105-darkvishnya.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0106",
+ "num": 136,
+ "name": "MITRE ATT&CK Group — Rocke",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1190, T1053.003, T1059.004, T1059.006, T1574.006, T1037, T1543.002, T1547.001, T1055.002, T1552.004, T1018, T1046, T1057, T1082, T1518.001, T1021.004, T1071, T1071.001, T1102, T1102.001, T1105, T1571, T1496.001, T1222.002",
+ "source": "library",
+ "file": "threat-groups/apt-g0106-rocke.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0107",
+ "num": 137,
+ "name": "MITRE ATT&CK Group — Whitefly",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1059, T1204.002, T1574.001, T1068, T1003.001, T1105, T1588.002, T1027.013, T1036.005",
+ "source": "library",
+ "file": "threat-groups/apt-g0107-whitefly.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0108",
+ "num": 138,
+ "name": "MITRE ATT&CK Group — Blue Mockingbird",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1190, T1047, T1053.005, T1059.001, T1059.003, T1569.002, T1574.012, T1112, T1543.003, T1546.003, T1134, T1003.001, T1082, T1021.001, T1021.002, T1090, T1496.001, T1588.002, T1027.013, T1036.005, T1218.010, T1218.011",
+ "source": "library",
+ "file": "threat-groups/apt-g0108-blue-mockingbird.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0112",
+ "num": 139,
+ "name": "MITRE ATT&CK Group — Windshift",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1189, T1566.001, T1566.002, T1566.003, T1047, T1059.005, T1204.001, T1204.002, T1547.001, T1033, T1057, T1082, T1518, T1518.001, T1071.001, T1105, T1027, T1036, T1036.001",
+ "source": "library",
+ "file": "threat-groups/apt-g0112-windshift.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0114",
+ "num": 140,
+ "name": "MITRE ATT&CK Group — Chimera",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1078.002, T1133, T1047, T1053.005, T1059.001, T1059.003, T1106, T1569.002, T1574.001, T1556.001, T1003.003, T1110.003, T1110.004, T1111, T1007, T1012, T1016, T1018, T1033, T1046, T1049, T1057, T1069.001",
+ "source": "library",
+ "file": "threat-groups/apt-g0114-chimera.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0115",
+ "num": 141,
+ "name": "MITRE ATT&CK Group — GOLD SOUTHFIELD",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1133, T1190, T1195.002, T1199, T1566, T1059.001, T1113, T1219, T1027.010",
+ "source": "library",
+ "file": "threat-groups/apt-g0115-gold-southfield.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0117",
+ "num": 142,
+ "name": "MITRE ATT&CK Group — Fox Kitten",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1190, T1053.005, T1059, T1059.001, T1059.003, T1136.001, T1505.003, T1546.008, T1003.001, T1003.003, T1110, T1552.001, T1555.005, T1012, T1018, T1046, T1083, T1087.001, T1087.002, T1217, T1021.001, T1021.002, T1021.004",
+ "source": "library",
+ "file": "threat-groups/apt-g0117-fox-kitten.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0119",
+ "num": 143,
+ "name": "MITRE ATT&CK Group — Indrik Spider",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1078.002, T1047, T1059.001, T1059.003, T1059.007, T1204.002, T1112, T1136, T1136.001, T1484.001, T1003.001, T1552.001, T1555.005, T1558.003, T1007, T1012, T1018, T1021.001, T1021.004, T1074.001, T1105, T1567.002, T1486",
+ "source": "library",
+ "file": "threat-groups/apt-g0119-indrik-spider.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0120",
+ "num": 144,
+ "name": "MITRE ATT&CK Group — Evilnum",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1566.002, T1059.007, T1204.001, T1574.001, T1548.002, T1539, T1555, T1497.001, T1105, T1219.002, T1070.004",
+ "source": "library",
+ "file": "threat-groups/apt-g0120-evilnum.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0121",
+ "num": 145,
+ "name": "MITRE ATT&CK Group — Sidewinder",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1566.001, T1566.002, T1059.001, T1059.005, T1059.007, T1203, T1204.001, T1204.002, T1559.002, T1574.001, T1547.001, T1016, T1033, T1057, T1082, T1083, T1124, T1518, T1518.001, T1074.001, T1119, T1071.001, T1105, T1020",
+ "source": "library",
+ "file": "threat-groups/apt-g0121-sidewinder.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0122",
+ "num": 146,
+ "name": "MITRE ATT&CK Group — Silent Librarian",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1110.003, T1114, T1114.003, T1589.002, T1589.003, T1594, T1598.003, T1583.001, T1585.002, T1588.002, T1588.004, T1608.005",
+ "source": "library",
+ "file": "threat-groups/apt-g0122-silent-librarian.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0123",
+ "num": 147,
+ "name": "MITRE ATT&CK Group — Volatile Cedar",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1190, T1505.003, T1105, T1595.002, T1595.003",
+ "source": "library",
+ "file": "threat-groups/apt-g0123-volatile-cedar.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0124",
+ "num": 148,
+ "name": "MITRE ATT&CK Group — Windigo",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1189, T1059, T1082, T1083, T1518, T1005, T1090",
+ "source": "library",
+ "file": "threat-groups/apt-g0124-windigo.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0125",
+ "num": 149,
+ "name": "MITRE ATT&CK Group — HAFNIUM",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078.003, T1078.004, T1190, T1199, T1059.001, T1059.003, T1098, T1136.002, T1505.003, T1068, T1003.001, T1003.003, T1110.003, T1555.006, T1016, T1016.001, T1018, T1033, T1057, T1083, T1550.001, T1005, T1114.002, T1119",
+ "source": "library",
+ "file": "threat-groups/apt-g0125-hafnium.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0126",
+ "num": 150,
+ "name": "MITRE ATT&CK Group — Higaisa",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1566.001, T1053.005, T1059.003, T1059.005, T1059.007, T1106, T1203, T1204.002, T1574.001, T1547.001, T1016, T1057, T1082, T1124, T1680, T1001.003, T1071.001, T1090.001, T1573.001, T1029, T1041, T1027.001, T1027.013, T1027.015",
+ "source": "library",
+ "file": "threat-groups/apt-g0126-higaisa.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0127",
+ "num": 151,
+ "name": "MITRE ATT&CK Group — TA551",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1566.001, T1059.003, T1204.002, T1071.001, T1105, T1132.001, T1568.002, T1589.002, T1027.003, T1027.010, T1036, T1218.005, T1218.010, T1218.011",
+ "source": "library",
+ "file": "threat-groups/apt-g0127-ta551.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0128",
+ "num": 152,
+ "name": "MITRE ATT&CK Group — ZIRCONIUM",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1566.002, T1059.003, T1059.006, T1204.001, T1547.001, T1068, T1555.003, T1012, T1016, T1033, T1082, T1124, T1090.003, T1102.002, T1105, T1573.001, T1665, T1041, T1567.002, T1598, T1598.003, T1583.001, T1583.006, T1584.008",
+ "source": "library",
+ "file": "threat-groups/apt-g0128-zirconium.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0129",
+ "num": 153,
+ "name": "MITRE ATT&CK Group — Mustang Panda",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1091, T1566.001, T1566.002, T1047, T1053.005, T1059, T1059.001, T1059.003, T1059.005, T1059.007, T1072, T1106, T1129, T1203, T1204.001, T1204.002, T1574.001, T1574.005, T1176.002, T1205, T1505.003, T1546.003, T1547.001, T1003",
+ "source": "library",
+ "file": "threat-groups/apt-g0129-mustang-panda.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0130",
+ "num": 154,
+ "name": "MITRE ATT&CK Group — Ajax Security Team",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1566.001, T1566.003, T1204.002, T1056.001, T1555.003, T1105",
+ "source": "library",
+ "file": "threat-groups/apt-g0130-ajax-security-team.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0131",
+ "num": 155,
+ "name": "MITRE ATT&CK Group — Tonto Team",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1566.001, T1059.001, T1059.006, T1203, T1204.002, T1574.001, T1505.003, T1068, T1003, T1056.001, T1069.001, T1135, T1210, T1090.002, T1105",
+ "source": "library",
+ "file": "threat-groups/apt-g0131-tonto-team.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0133",
+ "num": 156,
+ "name": "MITRE ATT&CK Group — Nomadic Octopus",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1566.001, T1059.001, T1059.003, T1204.002, T1105, T1036, T1564.003",
+ "source": "library",
+ "file": "threat-groups/apt-g0133-nomadic-octopus.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0134",
+ "num": 157,
+ "name": "MITRE ATT&CK Group — Transparent Tribe",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1189, T1566.001, T1566.002, T1059.005, T1203, T1204.001, T1204.002, T1568, T1583.001, T1584.001, T1608.004, T1027.013, T1036.005, T1564.001",
+ "source": "library",
+ "file": "threat-groups/apt-g0134-transparent-tribe.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0135",
+ "num": 158,
+ "name": "MITRE ATT&CK Group — BackdoorDiplomacy",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1190, T1574.001, T1505.003, T1055.001, T1046, T1049, T1120, T1074.001, T1095, T1105, T1588.001, T1588.002, T1027, T1036.004, T1036.005",
+ "source": "library",
+ "file": "threat-groups/apt-g0135-backdoordiplomacy.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0136",
+ "num": 159,
+ "name": "MITRE ATT&CK Group — IndigoZebra",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1566.001, T1204.002, T1105, T1583.001, T1583.006, T1586.002, T1588.002",
+ "source": "library",
+ "file": "threat-groups/apt-g0136-indigozebra.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0137",
+ "num": 160,
+ "name": "MITRE ATT&CK Group — Ferocious Kitten",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1566.001, T1204.002, T1583.001, T1588.002, T1036.002, T1036.005",
+ "source": "library",
+ "file": "threat-groups/apt-g0137-ferocious-kitten.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0138",
+ "num": 161,
+ "name": "MITRE ATT&CK Group — Andariel",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1189, T1566.001, T1203, T1204.002, T1049, T1057, T1005, T1105, T1590.005, T1592.002, T1588.001, T1027.003",
+ "source": "library",
+ "file": "threat-groups/apt-g0138-andariel.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0139",
+ "num": 162,
+ "name": "MITRE ATT&CK Group — TeamTNT",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1133, T1059.001, T1059.003, T1059.004, T1059.009, T1059.013, T1204.003, T1569.003, T1609, T1610, T1098.004, T1136.001, T1543.002, T1543.003, T1547.001, T1611, T1552.001, T1552.004, T1552.005, T1007, T1016, T1046, T1049, T1057",
+ "source": "library",
+ "file": "threat-groups/apt-g0139-teamtnt.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0140",
+ "num": 163,
+ "name": "MITRE ATT&CK Group — LazyScripter",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1566.001, T1566.002, T1059.001, T1059.003, T1059.005, T1059.007, T1204.001, T1204.002, T1547.001, T1071.004, T1102, T1105, T1583.001, T1583.006, T1588.001, T1608.001, T1027.010, T1036, T1218.005, T1218.011",
+ "source": "library",
+ "file": "threat-groups/apt-g0140-lazyscripter.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0142",
+ "num": 164,
+ "name": "MITRE ATT&CK Group — Confucius",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1566.001, T1566.002, T1053.005, T1059.001, T1059.005, T1203, T1204.001, T1204.002, T1547.001, T1083, T1680, T1119, T1071.001, T1105, T1041, T1567.002, T1583.006, T1218.005, T1221",
+ "source": "library",
+ "file": "threat-groups/apt-g0142-confucius.json",
+ "related": []
+ },
+ {
+ "id": "apt-g0143",
+ "num": 165,
+ "name": "MITRE ATT&CK Group — Aquatic Panda",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078.002, T1047, T1059.001, T1059.003, T1059.004, T1574.001, T1574.006, T1112, T1543.003, T1003.001, T1007, T1033, T1082, T1087, T1518.001, T1654, T1021, T1021.001, T1021.002, T1021.004, T1550.002, T1005, T1560.001, T1105",
+ "source": "library",
+ "file": "threat-groups/apt-g0143-aquatic-panda.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1001",
+ "num": 166,
+ "name": "MITRE ATT&CK Group — HEXANE",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1053.005, T1059.001, T1059.005, T1204.002, T1546.003, T1056.001, T1110, T1110.003, T1555, T1555.003, T1010, T1016, T1016.001, T1018, T1033, T1049, T1057, T1069.001, T1082, T1518, T1021.001, T1534, T1102.002, T1105",
+ "source": "library",
+ "file": "threat-groups/apt-g1001-hexane.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1002",
+ "num": 167,
+ "name": "MITRE ATT&CK Group — BITTER",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1566.001, T1053.005, T1203, T1204.002, T1559.002, T1068, T1071.001, T1095, T1105, T1568, T1573, T1583.001, T1588.002, T1608.001, T1027.013, T1036.004",
+ "source": "library",
+ "file": "threat-groups/apt-g1002-bitter.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1003",
+ "num": 168,
+ "name": "MITRE ATT&CK Group — Ember Bear",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078.001, T1133, T1190, T1195, T1047, T1053.005, T1059.001, T1203, T1112, T1505.003, T1003, T1003.001, T1003.002, T1003.004, T1110, T1110.003, T1552.001, T1018, T1046, T1654, T1021, T1210, T1550.002, T1570",
+ "source": "library",
+ "file": "threat-groups/apt-g1003-ember-bear.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1004",
+ "num": 169,
+ "name": "MITRE ATT&CK Group — LAPSUS$",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1078.004, T1133, T1199, T1204, T1098.003, T1136.003, T1068, T1003.003, T1003.006, T1111, T1552.008, T1555.003, T1555.005, T1621, T1069.002, T1087.002, T1005, T1114.003, T1213.001, T1213.002, T1213.003, T1213.005, T1090",
+ "source": "library",
+ "file": "threat-groups/apt-g1004-lapsus.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1005",
+ "num": 170,
+ "name": "MITRE ATT&CK Group — POLONIUM",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1199, T1090, T1102.002, T1567.002, T1583.006, T1588.002",
+ "source": "library",
+ "file": "threat-groups/apt-g1005-polonium.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1006",
+ "num": 171,
+ "name": "MITRE ATT&CK Group — Earth Lusca",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1189, T1190, T1566.002, T1047, T1053.005, T1059.001, T1059.005, T1059.006, T1059.007, T1204.001, T1204.002, T1574.001, T1098.004, T1112, T1543.003, T1547.012, T1548.002, T1003.001, T1003.006, T1007, T1016, T1018, T1033, T1049",
+ "source": "library",
+ "file": "threat-groups/apt-g1006-earth-lusca.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1007",
+ "num": 172,
+ "name": "MITRE ATT&CK Group — Aoqin Dragon",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1091, T1203, T1204.002, T1083, T1570, T1587.001, T1588.002, T1027.002, T1036",
+ "source": "library",
+ "file": "threat-groups/apt-g1007-aoqin-dragon.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1008",
+ "num": 173,
+ "name": "MITRE ATT&CK Group — SideCopy",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1566.001, T1059.005, T1106, T1204.002, T1574.001, T1016, T1082, T1518, T1518.001, T1614, T1105, T1598.002, T1584.001, T1608.001, T1036.005, T1218.005",
+ "source": "library",
+ "file": "threat-groups/apt-g1008-sidecopy.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1009",
+ "num": 174,
+ "name": "MITRE ATT&CK Group — Moses Staff",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1190, T1505.003, T1016, T1082, T1087.001, T1021.002, T1105, T1553.002, T1686.003, T1587.001, T1588.002, T1027.013",
+ "source": "library",
+ "file": "threat-groups/apt-g1009-moses-staff.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1011",
+ "num": 175,
+ "name": "MITRE ATT&CK Group — EXOTIC LILY",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1566.001, T1566.002, T1566.003, T1203, T1204.001, T1204.002, T1102, T1589.002, T1593.001, T1594, T1597, T1583.001, T1585.001, T1585.002, T1608.001",
+ "source": "library",
+ "file": "threat-groups/apt-g1011-exotic-lily.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1012",
+ "num": 176,
+ "name": "MITRE ATT&CK Group — CURIUM",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1189, T1566.001, T1566.003, T1059.001, T1204.002, T1505.003, T1082, T1124, T1005, T1041, T1048.002, T1598.003, T1583.001, T1583.003, T1583.004, T1584.006, T1585.001, T1585.002, T1608.004",
+ "source": "library",
+ "file": "threat-groups/apt-g1012-curium.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1013",
+ "num": 177,
+ "name": "MITRE ATT&CK Group — Metador",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1059.003, T1546.003, T1071.001, T1095, T1105, T1588.001, T1588.002, T1027.013, T1070.004",
+ "source": "library",
+ "file": "threat-groups/apt-g1013-metador.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1014",
+ "num": 178,
+ "name": "MITRE ATT&CK Group — LuminousMoth",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1091, T1566.002, T1053.005, T1204.001, T1574.001, T1112, T1547.001, T1539, T1557.002, T1033, T1083, T1005, T1560, T1071.001, T1105, T1030, T1041, T1567.002, T1553.002, T1587.001, T1588.001, T1588.002, T1588.004, T1608.001",
+ "source": "library",
+ "file": "threat-groups/apt-g1014-luminousmoth.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1015",
+ "num": 179,
+ "name": "MITRE ATT&CK Group — Scattered Spider",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1078.004, T1133, T1059.001, T1059.004, T1204, T1098, T1098.003, T1136, T1543.002, T1556.006, T1556.009, T1068, T1484.002, T1003.003, T1539, T1552.001, T1552.004, T1555.005, T1621, T1016, T1018, T1069, T1069.002",
+ "source": "library",
+ "file": "threat-groups/apt-g1015-scattered-spider.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1016",
+ "num": 180,
+ "name": "MITRE ATT&CK Group — FIN13",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078.001, T1133, T1190, T1047, T1053.005, T1059.001, T1059.003, T1059.005, T1574.001, T1098.007, T1136.001, T1505.003, T1547.001, T1556, T1134.003, T1003.001, T1003.002, T1003.003, T1056.001, T1552.001, T1016, T1016.001, T1046, T1049",
+ "source": "library",
+ "file": "threat-groups/apt-g1016-fin13.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1017",
+ "num": 181,
+ "name": "MITRE ATT&CK Group — Volt Typhoon",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1078.002, T1133, T1190, T1047, T1059.001, T1059.003, T1059.004, T1112, T1505.003, T1068, T1003.001, T1003.003, T1056.001, T1552, T1552.004, T1555, T1555.003, T1007, T1010, T1012, T1016, T1016.001, T1018",
+ "source": "library",
+ "file": "threat-groups/apt-g1017-volt-typhoon.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1018",
+ "num": 182,
+ "name": "MITRE ATT&CK Group — TA2541",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1566.001, T1566.002, T1047, T1053.005, T1059.001, T1059.005, T1204.001, T1204.002, T1547.001, T1055, T1055.012, T1016.001, T1082, T1518.001, T1105, T1568, T1573.002, T1685, T1583.001, T1583.006, T1588.001, T1588.002, T1608.001, T1027.002",
+ "source": "library",
+ "file": "threat-groups/apt-g1018-ta2541.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1019",
+ "num": 183,
+ "name": "MITRE ATT&CK Group — MoustachedBouncer",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1659, T1059.001, T1059.007, T1068, T1074.002, T1113, T1090, T1027.002",
+ "source": "library",
+ "file": "threat-groups/apt-g1019-moustachedbouncer.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1020",
+ "num": 184,
+ "name": "MITRE ATT&CK Group — Mustard Tempest",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1189, T1566.002, T1204.001, T1082, T1105, T1583.004, T1583.008, T1584.001, T1608.001, T1608.004, T1608.006, T1036.005",
+ "source": "library",
+ "file": "threat-groups/apt-g1020-mustard-tempest.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1021",
+ "num": 185,
+ "name": "MITRE ATT&CK Group — Cinnamon Tempest",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1078.002, T1190, T1047, T1059.001, T1059.003, T1059.006, T1574.001, T1543.003, T1484.001, T1021.002, T1080, T1090, T1105, T1572, T1567.002, T1657, T1588.002, T1140",
+ "source": "library",
+ "file": "threat-groups/apt-g1021-cinnamon-tempest.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1022",
+ "num": 186,
+ "name": "MITRE ATT&CK Group — ToddyCat",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078.002, T1190, T1566.003, T1047, T1053.005, T1059.001, T1059.003, T1106, T1018, T1049, T1057, T1069.002, T1083, T1087.002, T1518.001, T1680, T1021.002, T1005, T1074.002, T1560.001, T1095, T1567.002, T1686, T1036.005",
+ "source": "library",
+ "file": "threat-groups/apt-g1022-toddycat.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1023",
+ "num": 187,
+ "name": "MITRE ATT&CK Group — APT5",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078.002, T1078.004, T1190, T1053.003, T1059.001, T1059.003, T1098.007, T1136.001, T1505.003, T1554, T1055, T1003.001, T1003.002, T1056.001, T1049, T1057, T1083, T1654, T1021.001, T1021.004, T1074.001, T1560.001, T1685, T1583.005",
+ "source": "library",
+ "file": "threat-groups/apt-g1023-apt5.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1024",
+ "num": 188,
+ "name": "MITRE ATT&CK Group — Akira",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1133, T1059.001, T1558, T1018, T1482, T1021.001, T1213.002, T1560.001, T1219, T1567.002, T1486, T1531, T1657, T1685, T1027.001, T1036.005",
+ "source": "library",
+ "file": "threat-groups/apt-g1024-akira.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1026",
+ "num": 189,
+ "name": "MITRE ATT&CK Group — Malteiro",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1566.001, T1059.005, T1204.002, T1055.001, T1555, T1555.003, T1082, T1518.001, T1614.001, T1657, T1027.013, T1140",
+ "source": "library",
+ "file": "threat-groups/apt-g1026-malteiro.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1028",
+ "num": 190,
+ "name": "MITRE ATT&CK Group — APT-C-23",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "",
+ "source": "library",
+ "file": "threat-groups/apt-g1028-apt-c-23.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1030",
+ "num": 191,
+ "name": "MITRE ATT&CK Group — Agrius",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078.002, T1190, T1059.003, T1505.003, T1543.003, T1003.001, T1003.002, T1110, T1110.003, T1018, T1046, T1021.001, T1570, T1005, T1074.001, T1119, T1560.001, T1041, T1685, T1583, T1036, T1140",
+ "source": "library",
+ "file": "threat-groups/apt-g1030-agrius.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1031",
+ "num": 192,
+ "name": "MITRE ATT&CK Group — Saint Bear",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1566.001, T1059, T1059.001, T1059.003, T1059.007, T1203, T1204.001, T1204.002, T1112, T1497, T1553.002, T1685, T1589.002, T1583.006, T1608.001, T1027.002, T1027.013, T1684.001",
+ "source": "library",
+ "file": "threat-groups/apt-g1031-saint-bear.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1032",
+ "num": 193,
+ "name": "MITRE ATT&CK Group — INC Ransom",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1190, T1566, T1047, T1059.003, T1569.002, T1046, T1049, T1069.002, T1087.002, T1135, T1021.001, T1570, T1074, T1560.001, T1071, T1105, T1219, T1537, T1486, T1657, T1685, T1588.002, T1036.005",
+ "source": "library",
+ "file": "threat-groups/apt-g1032-inc-ransom.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1033",
+ "num": 194,
+ "name": "MITRE ATT&CK Group — Star Blizzard",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1566.001, T1059.007, T1204.002, T1539, T1550.004, T1114.002, T1114.003, T1589, T1593, T1598.002, T1598.003, T1583, T1583.001, T1585.001, T1585.002, T1586.002, T1588.002, T1608.001, T1684.001",
+ "source": "library",
+ "file": "threat-groups/apt-g1033-star-blizzard.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1034",
+ "num": 195,
+ "name": "MITRE ATT&CK Group — Daggerfly",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1189, T1195.002, T1053.005, T1059.001, T1204.001, T1574.001, T1136.001, T1003.002, T1012, T1082, T1071.001, T1105, T1553.002, T1584.004, T1587.002, T1036.003, T1218.011",
+ "source": "library",
+ "file": "threat-groups/apt-g1034-daggerfly.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1035",
+ "num": 196,
+ "name": "MITRE ATT&CK Group — Winter Vivern",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1189, T1190, T1566.001, T1053.005, T1059, T1059.001, T1059.003, T1059.007, T1204.001, T1056.003, T1033, T1082, T1083, T1113, T1114.001, T1119, T1071.001, T1105, T1020, T1041, T1595.002, T1583.001, T1583.003, T1584.006",
+ "source": "library",
+ "file": "threat-groups/apt-g1035-winter-vivern.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1036",
+ "num": 197,
+ "name": "MITRE ATT&CK Group — Moonstone Sleet",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1195.002, T1566.001, T1566.003, T1053.005, T1204.002, T1569.002, T1547.001, T1003.001, T1016, T1033, T1082, T1217, T1071.001, T1105, T1486, T1589.002, T1591, T1598, T1598.003, T1583.001, T1583.003, T1585.001, T1585.002, T1587",
+ "source": "library",
+ "file": "threat-groups/apt-g1036-moonstone-sleet.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1037",
+ "num": 198,
+ "name": "MITRE ATT&CK Group — TA577",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1566.002, T1059.003, T1059.007, T1204.001, T1586.002, T1027.009",
+ "source": "library",
+ "file": "threat-groups/apt-g1037-ta577.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1038",
+ "num": 199,
+ "name": "MITRE ATT&CK Group — TA578",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1059.007, T1204.001, T1594, T1583.006",
+ "source": "library",
+ "file": "threat-groups/apt-g1038-ta578.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1039",
+ "num": 200,
+ "name": "MITRE ATT&CK Group — RedCurl",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1199, T1566.001, T1566.002, T1053.005, T1059.001, T1059.003, T1059.005, T1059.006, T1204.001, T1204.002, T1547.001, T1003.001, T1056.002, T1552.001, T1552.002, T1555.003, T1046, T1082, T1083, T1087.001, T1087.002, T1087.003, T1080, T1005",
+ "source": "library",
+ "file": "threat-groups/apt-g1039-redcurl.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1040",
+ "num": 201,
+ "name": "MITRE ATT&CK Group — Play",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1078.002, T1078.003, T1133, T1190, T1059.001, T1059.003, T1003.001, T1016, T1018, T1057, T1082, T1083, T1518.001, T1021.002, T1560.001, T1105, T1030, T1048, T1657, T1685, T1685.005, T1587.001, T1588.002",
+ "source": "library",
+ "file": "threat-groups/apt-g1040-play.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1041",
+ "num": 202,
+ "name": "MITRE ATT&CK Group — Sea Turtle",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1078.003, T1133, T1190, T1199, T1566, T1059.004, T1203, T1505.003, T1557, T1074.002, T1114.001, T1213.006, T1560.001, T1071.001, T1685.006, T1690, T1583, T1583.001, T1583.002, T1583.003, T1584.002, T1588.002, T1588.004",
+ "source": "library",
+ "file": "threat-groups/apt-g1041-sea-turtle.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1042",
+ "num": 203,
+ "name": "MITRE ATT&CK Group — RedEcho",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1071.001, T1568, T1571, T1573.002, T1583.001",
+ "source": "library",
+ "file": "threat-groups/apt-g1042-redecho.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1043",
+ "num": 204,
+ "name": "MITRE ATT&CK Group — BlackByte",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1078.002, T1190, T1047, T1053.005, T1059.001, T1059.003, T1569.002, T1112, T1136.002, T1505.003, T1543.003, T1547.001, T1055, T1055.012, T1068, T1134.003, T1003, T1012, T1016, T1018, T1046, T1082, T1087.002",
+ "source": "library",
+ "file": "threat-groups/apt-g1043-blackbyte.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1044",
+ "num": 205,
+ "name": "MITRE ATT&CK Group — APT42",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1566.002, T1047, T1053.005, T1059.001, T1059.005, T1112, T1547, T1056, T1056.001, T1111, T1539, T1555.003, T1016, T1082, T1087.001, T1518.001, T1113, T1530, T1071.001, T1102, T1132.001, T1573.002, T1682, T1583.001",
+ "source": "library",
+ "file": "threat-groups/apt-g1044-apt42.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1045",
+ "num": 206,
+ "name": "MITRE ATT&CK Group — Salt Typhoon",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1190, T1098.004, T1136, T1040, T1110.002, T1021.004, T1602.002, T1572, T1048.003, T1685.006, T1686, T1590.004, T1587.001, T1588.002",
+ "source": "library",
+ "file": "threat-groups/apt-g1045-salt-typhoon.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1046",
+ "num": 207,
+ "name": "MITRE ATT&CK Group — Storm-1811",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1566.002, T1566.003, T1566.004, T1059.001, T1059.003, T1204.002, T1574.001, T1547.001, T1056, T1033, T1087.002, T1482, T1021.002, T1021.004, T1570, T1074.001, T1105, T1219.002, T1048.002, T1486, T1667, T1222.001, T1583.001, T1585.003",
+ "source": "library",
+ "file": "threat-groups/apt-g1046-storm-1811.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1047",
+ "num": 208,
+ "name": "MITRE ATT&CK Group — Velvet Ant",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078.003, T1133, T1047, T1059.004, T1569.002, T1574.001, T1037.004, T1055, T1040, T1049, T1083, T1021.002, T1570, T1071, T1090.001, T1132, T1571, T1573.002, T1685, T1686, T1036.005, T1211",
+ "source": "library",
+ "file": "threat-groups/apt-g1047-velvet-ant.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1048",
+ "num": 209,
+ "name": "MITRE ATT&CK Group — UNC3886",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1078.001, T1190, T1059.001, T1059.003, T1059.004, T1059.006, T1059.012, T1203, T1675, T1037, T1037.004, T1205, T1205.001, T1505.006, T1554, T1068, T1548, T1003.001, T1040, T1212, T1555.005, T1057, T1083",
+ "source": "library",
+ "file": "threat-groups/apt-g1048-unc3886.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1049",
+ "num": 210,
+ "name": "MITRE ATT&CK Group — AppleJeus",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1566, T1657",
+ "source": "library",
+ "file": "threat-groups/apt-g1049-applejeus.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1050",
+ "num": 211,
+ "name": "MITRE ATT&CK Group — Water Galura",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1486, T1657, T1585.001",
+ "source": "library",
+ "file": "threat-groups/apt-g1050-water-galura.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1051",
+ "num": 212,
+ "name": "MITRE ATT&CK Group — Medusa Group",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1190, T1047, T1059.001, T1059.003, T1072, T1106, T1559.001, T1569.002, T1112, T1136.002, T1505.003, T1543.003, T1548.002, T1003.001, T1003.003, T1016, T1018, T1033, T1046, T1057, T1069.002, T1082, T1083",
+ "source": "library",
+ "file": "threat-groups/apt-g1051-medusa-group.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1052",
+ "num": 213,
+ "name": "MITRE ATT&CK Group — Contagious Interview",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1566.003, T1059.003, T1059.004, T1059.005, T1059.006, T1059.007, T1204.001, T1204.002, T1204.004, T1204.005, T1543.001, T1546.004, T1547.001, T1547.013, T1555.001, T1082, T1083, T1497, T1071.003, T1090, T1219.002, T1571, T1573.001, T1041",
+ "source": "library",
+ "file": "threat-groups/apt-g1052-contagious-interview.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1053",
+ "num": 214,
+ "name": "MITRE ATT&CK Group — Storm-0501",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078.004, T1190, T1053.005, T1059.001, T1059.009, T1098.001, T1098.003, T1556.009, T1484.001, T1484.002, T1003, T1003.006, T1110, T1552.004, T1555.005, T1555.006, T1057, T1082, T1087.002, T1087.004, T1482, T1518.001, T1526, T1580",
+ "source": "library",
+ "file": "threat-groups/apt-g1053-storm-0501.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1054",
+ "num": 215,
+ "name": "MITRE ATT&CK Group — MirrorFace",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1190, T1566.001, T1566.002, T1047, T1059.003, T1059.005, T1204.002, T1574.001, T1556.002, T1003.001, T1003.002, T1003.003, T1007, T1016, T1018, T1033, T1057, T1082, T1083, T1087.002, T1482, T1614.001, T1021.001, T1021.002",
+ "source": "library",
+ "file": "threat-groups/apt-g1054-mirrorface.json",
+ "related": []
+ },
+ {
+ "id": "apt-g1055",
+ "num": 216,
+ "name": "MITRE ATT&CK Group — VOID MANTICORE",
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": "T1078, T1078.002, T1078.004, T1133, T1190, T1199, T1566, T1047, T1059.001, T1059.006, T1072, T1204.002, T1651, T1098, T1547.001, T1484.001, T1003.001, T1110, T1110.001, T1110.004, T1552.002, T1082, T1087.002, T1021.001",
+ "source": "library",
+ "file": "threat-groups/apt-g1055-void-manticore.json",
+ "related": []
+ }
+ ]
+}
diff --git a/app/playbooks/mitre-techniques.json b/app/playbooks/mitre-techniques.json
new file mode 100644
index 0000000..b7976fe
--- /dev/null
+++ b/app/playbooks/mitre-techniques.json
@@ -0,0 +1,11251 @@
+{
+ "generatedAt": "2026-05-07T00:05:11.332Z",
+ "source": "mitre-attack/attack-stix-data",
+ "domains": {
+ "enterprise": {
+ "url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/enterprise-attack/enterprise-attack.json",
+ "objects": 25844
+ },
+ "mobile": {
+ "url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/mobile-attack/mobile-attack.json",
+ "objects": 2635
+ },
+ "ics": {
+ "url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/ics-attack/ics-attack.json",
+ "objects": 2173
+ }
+ },
+ "count": 918,
+ "techniques": [
+ {
+ "id": "T0800",
+ "name": "Activate Firmware Update Mode",
+ "url": "https://attack.mitre.org/techniques/T0800",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "inhibit-response-function"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0801",
+ "name": "Monitor Process State",
+ "url": "https://attack.mitre.org/techniques/T0801",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0802",
+ "name": "Automated Collection",
+ "url": "https://attack.mitre.org/techniques/T0802",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0806",
+ "name": "Brute Force I/O",
+ "url": "https://attack.mitre.org/techniques/T0806",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "impair-process-control"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0807",
+ "name": "Command-Line Interface",
+ "url": "https://attack.mitre.org/techniques/T0807",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0809",
+ "name": "Data Destruction",
+ "url": "https://attack.mitre.org/techniques/T0809",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "inhibit-response-function"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0811",
+ "name": "Data from Information Repositories",
+ "url": "https://attack.mitre.org/techniques/T0811",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0813",
+ "name": "Denial of Control",
+ "url": "https://attack.mitre.org/techniques/T0813",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0814",
+ "name": "Denial of Service",
+ "url": "https://attack.mitre.org/techniques/T0814",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "inhibit-response-function"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0815",
+ "name": "Denial of View",
+ "url": "https://attack.mitre.org/techniques/T0815",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0816",
+ "name": "Device Restart/Shutdown",
+ "url": "https://attack.mitre.org/techniques/T0816",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "inhibit-response-function"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0817",
+ "name": "Drive-by Compromise",
+ "url": "https://attack.mitre.org/techniques/T0817",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "initial-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0819",
+ "name": "Exploit Public-Facing Application",
+ "url": "https://attack.mitre.org/techniques/T0819",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "initial-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0820",
+ "name": "Exploitation for Evasion",
+ "url": "https://attack.mitre.org/techniques/T0820",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "evasion"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0821",
+ "name": "Modify Controller Tasking",
+ "url": "https://attack.mitre.org/techniques/T0821",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0822",
+ "name": "External Remote Services",
+ "url": "https://attack.mitre.org/techniques/T0822",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "initial-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0823",
+ "name": "Graphical User Interface",
+ "url": "https://attack.mitre.org/techniques/T0823",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0826",
+ "name": "Loss of Availability",
+ "url": "https://attack.mitre.org/techniques/T0826",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0827",
+ "name": "Loss of Control",
+ "url": "https://attack.mitre.org/techniques/T0827",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0828",
+ "name": "Loss of Productivity and Revenue",
+ "url": "https://attack.mitre.org/techniques/T0828",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0829",
+ "name": "Loss of View",
+ "url": "https://attack.mitre.org/techniques/T0829",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0830",
+ "name": "Adversary-in-the-Middle",
+ "url": "https://attack.mitre.org/techniques/T0830",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0831",
+ "name": "Manipulation of Control",
+ "url": "https://attack.mitre.org/techniques/T0831",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0832",
+ "name": "Manipulation of View",
+ "url": "https://attack.mitre.org/techniques/T0832",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0834",
+ "name": "Native API",
+ "url": "https://attack.mitre.org/techniques/T0834",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0835",
+ "name": "Manipulate I/O Image",
+ "url": "https://attack.mitre.org/techniques/T0835",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "inhibit-response-function"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0836",
+ "name": "Modify Parameter",
+ "url": "https://attack.mitre.org/techniques/T0836",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "impair-process-control"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0837",
+ "name": "Loss of Protection",
+ "url": "https://attack.mitre.org/techniques/T0837",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0838",
+ "name": "Modify Alarm Settings",
+ "url": "https://attack.mitre.org/techniques/T0838",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "inhibit-response-function"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0840",
+ "name": "Network Connection Enumeration",
+ "url": "https://attack.mitre.org/techniques/T0840",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0842",
+ "name": "Network Sniffing",
+ "url": "https://attack.mitre.org/techniques/T0842",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0843",
+ "name": "Program Download",
+ "url": "https://attack.mitre.org/techniques/T0843",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "lateral-movement"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0843.001",
+ "name": "Download All",
+ "url": "https://attack.mitre.org/techniques/T0843/001",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "lateral-movement"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T0843.002",
+ "name": "Online Edit",
+ "url": "https://attack.mitre.org/techniques/T0843/002",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "lateral-movement"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T0843.003",
+ "name": "Program Append",
+ "url": "https://attack.mitre.org/techniques/T0843/003",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "lateral-movement"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T0845",
+ "name": "Program Upload",
+ "url": "https://attack.mitre.org/techniques/T0845",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0846",
+ "name": "Remote System Discovery",
+ "url": "https://attack.mitre.org/techniques/T0846",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0846.001",
+ "name": "Port Scan",
+ "url": "https://attack.mitre.org/techniques/T0846/001",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T0846.002",
+ "name": "Broadcast Discovery",
+ "url": "https://attack.mitre.org/techniques/T0846/002",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T0846.003",
+ "name": "Multicast Discovery",
+ "url": "https://attack.mitre.org/techniques/T0846/003",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T0847",
+ "name": "Replication Through Removable Media",
+ "url": "https://attack.mitre.org/techniques/T0847",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "initial-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0848",
+ "name": "Rogue Master",
+ "url": "https://attack.mitre.org/techniques/T0848",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "initial-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0849",
+ "name": "Masquerading",
+ "url": "https://attack.mitre.org/techniques/T0849",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "evasion"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0851",
+ "name": "Rootkit",
+ "url": "https://attack.mitre.org/techniques/T0851",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "evasion",
+ "inhibit-response-function"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0852",
+ "name": "Screen Capture",
+ "url": "https://attack.mitre.org/techniques/T0852",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0853",
+ "name": "Scripting",
+ "url": "https://attack.mitre.org/techniques/T0853",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0858",
+ "name": "Change Operating Mode",
+ "url": "https://attack.mitre.org/techniques/T0858",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "execution",
+ "evasion"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0859",
+ "name": "Valid Accounts",
+ "url": "https://attack.mitre.org/techniques/T0859",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "persistence",
+ "lateral-movement"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0860",
+ "name": "Wireless Compromise",
+ "url": "https://attack.mitre.org/techniques/T0860",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "initial-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0861",
+ "name": "Point & Tag Identification",
+ "url": "https://attack.mitre.org/techniques/T0861",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0862",
+ "name": "Supply Chain Compromise",
+ "url": "https://attack.mitre.org/techniques/T0862",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "initial-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0863",
+ "name": "User Execution",
+ "url": "https://attack.mitre.org/techniques/T0863",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0864",
+ "name": "Transient Cyber Asset",
+ "url": "https://attack.mitre.org/techniques/T0864",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "initial-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0865",
+ "name": "Spearphishing Attachment",
+ "url": "https://attack.mitre.org/techniques/T0865",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "initial-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0866",
+ "name": "Exploitation of Remote Services",
+ "url": "https://attack.mitre.org/techniques/T0866",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "initial-access",
+ "lateral-movement"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0867",
+ "name": "Lateral Tool Transfer",
+ "url": "https://attack.mitre.org/techniques/T0867",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "lateral-movement"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0868",
+ "name": "Detect Operating Mode",
+ "url": "https://attack.mitre.org/techniques/T0868",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0869",
+ "name": "Standard Application Layer Protocol",
+ "url": "https://attack.mitre.org/techniques/T0869",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0871",
+ "name": "Execution through API",
+ "url": "https://attack.mitre.org/techniques/T0871",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0872",
+ "name": "Indicator Removal on Host",
+ "url": "https://attack.mitre.org/techniques/T0872",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "evasion"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0873",
+ "name": "Project File Infection",
+ "url": "https://attack.mitre.org/techniques/T0873",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "persistence"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0873.001",
+ "name": "Siemens Project File Format",
+ "url": "https://attack.mitre.org/techniques/T0873/001",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "persistence"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T0874",
+ "name": "Hooking",
+ "url": "https://attack.mitre.org/techniques/T0874",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "execution",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0877",
+ "name": "I/O Image",
+ "url": "https://attack.mitre.org/techniques/T0877",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0878",
+ "name": "Alarm Suppression",
+ "url": "https://attack.mitre.org/techniques/T0878",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "inhibit-response-function"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0879",
+ "name": "Damage to Property",
+ "url": "https://attack.mitre.org/techniques/T0879",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0880",
+ "name": "Loss of Safety",
+ "url": "https://attack.mitre.org/techniques/T0880",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0881",
+ "name": "Service Stop",
+ "url": "https://attack.mitre.org/techniques/T0881",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "inhibit-response-function"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0882",
+ "name": "Theft of Operational Information",
+ "url": "https://attack.mitre.org/techniques/T0882",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0883",
+ "name": "Internet Accessible Device",
+ "url": "https://attack.mitre.org/techniques/T0883",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "initial-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0884",
+ "name": "Connection Proxy",
+ "url": "https://attack.mitre.org/techniques/T0884",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0885",
+ "name": "Commonly Used Port",
+ "url": "https://attack.mitre.org/techniques/T0885",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0886",
+ "name": "Remote Services",
+ "url": "https://attack.mitre.org/techniques/T0886",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "initial-access",
+ "lateral-movement"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0887",
+ "name": "Wireless Sniffing",
+ "url": "https://attack.mitre.org/techniques/T0887",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "discovery",
+ "collection"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0888",
+ "name": "Remote System Information Discovery",
+ "url": "https://attack.mitre.org/techniques/T0888",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0889",
+ "name": "Modify Program",
+ "url": "https://attack.mitre.org/techniques/T0889",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "persistence"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0890",
+ "name": "Exploitation for Privilege Escalation",
+ "url": "https://attack.mitre.org/techniques/T0890",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "privilege-escalation"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0892",
+ "name": "Change Credential",
+ "url": "https://attack.mitre.org/techniques/T0892",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "inhibit-response-function"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0893",
+ "name": "Data from Local System",
+ "url": "https://attack.mitre.org/techniques/T0893",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0894",
+ "name": "System Binary Proxy Execution",
+ "url": "https://attack.mitre.org/techniques/T0894",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "evasion"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T0895",
+ "name": "Autorun Image",
+ "url": "https://attack.mitre.org/techniques/T0895",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1001",
+ "name": "Data Obfuscation",
+ "url": "https://attack.mitre.org/techniques/T1001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1001.001",
+ "name": "Junk Data",
+ "url": "https://attack.mitre.org/techniques/T1001/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1001.002",
+ "name": "Steganography",
+ "url": "https://attack.mitre.org/techniques/T1001/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1001.003",
+ "name": "Protocol or Service Impersonation",
+ "url": "https://attack.mitre.org/techniques/T1001/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1003",
+ "name": "OS Credential Dumping",
+ "url": "https://attack.mitre.org/techniques/T1003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1003.001",
+ "name": "LSASS Memory",
+ "url": "https://attack.mitre.org/techniques/T1003/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1003.002",
+ "name": "Security Account Manager",
+ "url": "https://attack.mitre.org/techniques/T1003/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1003.003",
+ "name": "NTDS",
+ "url": "https://attack.mitre.org/techniques/T1003/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1003.004",
+ "name": "LSA Secrets",
+ "url": "https://attack.mitre.org/techniques/T1003/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1003.005",
+ "name": "Cached Domain Credentials",
+ "url": "https://attack.mitre.org/techniques/T1003/005",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1003.006",
+ "name": "DCSync",
+ "url": "https://attack.mitre.org/techniques/T1003/006",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1003.007",
+ "name": "Proc Filesystem",
+ "url": "https://attack.mitre.org/techniques/T1003/007",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1003.008",
+ "name": "/etc/passwd and /etc/shadow",
+ "url": "https://attack.mitre.org/techniques/T1003/008",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1005",
+ "name": "Data from Local System",
+ "url": "https://attack.mitre.org/techniques/T1005",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1006",
+ "name": "Direct Volume Access",
+ "url": "https://attack.mitre.org/techniques/T1006",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1007",
+ "name": "System Service Discovery",
+ "url": "https://attack.mitre.org/techniques/T1007",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1008",
+ "name": "Fallback Channels",
+ "url": "https://attack.mitre.org/techniques/T1008",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1010",
+ "name": "Application Window Discovery",
+ "url": "https://attack.mitre.org/techniques/T1010",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1011",
+ "name": "Exfiltration Over Other Network Medium",
+ "url": "https://attack.mitre.org/techniques/T1011",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "exfiltration"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1011.001",
+ "name": "Exfiltration Over Bluetooth",
+ "url": "https://attack.mitre.org/techniques/T1011/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "exfiltration"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1012",
+ "name": "Query Registry",
+ "url": "https://attack.mitre.org/techniques/T1012",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1014",
+ "name": "Rootkit",
+ "url": "https://attack.mitre.org/techniques/T1014",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1016",
+ "name": "System Network Configuration Discovery",
+ "url": "https://attack.mitre.org/techniques/T1016",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1016.001",
+ "name": "Internet Connection Discovery",
+ "url": "https://attack.mitre.org/techniques/T1016/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1016.002",
+ "name": "Wi-Fi Discovery",
+ "url": "https://attack.mitre.org/techniques/T1016/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1018",
+ "name": "Remote System Discovery",
+ "url": "https://attack.mitre.org/techniques/T1018",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1020",
+ "name": "Automated Exfiltration",
+ "url": "https://attack.mitre.org/techniques/T1020",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "exfiltration"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1020.001",
+ "name": "Traffic Duplication",
+ "url": "https://attack.mitre.org/techniques/T1020/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "exfiltration"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1021",
+ "name": "Remote Services",
+ "url": "https://attack.mitre.org/techniques/T1021",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "lateral-movement"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1021.001",
+ "name": "Remote Desktop Protocol",
+ "url": "https://attack.mitre.org/techniques/T1021/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "lateral-movement"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1021.002",
+ "name": "SMB/Windows Admin Shares",
+ "url": "https://attack.mitre.org/techniques/T1021/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "lateral-movement"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1021.003",
+ "name": "Distributed Component Object Model",
+ "url": "https://attack.mitre.org/techniques/T1021/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "lateral-movement"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1021.004",
+ "name": "SSH",
+ "url": "https://attack.mitre.org/techniques/T1021/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "lateral-movement"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1021.005",
+ "name": "VNC",
+ "url": "https://attack.mitre.org/techniques/T1021/005",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "lateral-movement"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1021.006",
+ "name": "Windows Remote Management",
+ "url": "https://attack.mitre.org/techniques/T1021/006",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "lateral-movement"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1021.007",
+ "name": "Cloud Services",
+ "url": "https://attack.mitre.org/techniques/T1021/007",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "lateral-movement"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1021.008",
+ "name": "Direct Cloud VM Connections",
+ "url": "https://attack.mitre.org/techniques/T1021/008",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "lateral-movement"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1025",
+ "name": "Data from Removable Media",
+ "url": "https://attack.mitre.org/techniques/T1025",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1027",
+ "name": "Obfuscated Files or Information",
+ "url": "https://attack.mitre.org/techniques/T1027",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1027.001",
+ "name": "Binary Padding",
+ "url": "https://attack.mitre.org/techniques/T1027/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1027.002",
+ "name": "Software Packing",
+ "url": "https://attack.mitre.org/techniques/T1027/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1027.003",
+ "name": "Steganography",
+ "url": "https://attack.mitre.org/techniques/T1027/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1027.004",
+ "name": "Compile After Delivery",
+ "url": "https://attack.mitre.org/techniques/T1027/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1027.005",
+ "name": "Indicator Removal from Tools",
+ "url": "https://attack.mitre.org/techniques/T1027/005",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1027.006",
+ "name": "HTML Smuggling",
+ "url": "https://attack.mitre.org/techniques/T1027/006",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1027.007",
+ "name": "Dynamic API Resolution",
+ "url": "https://attack.mitre.org/techniques/T1027/007",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1027.008",
+ "name": "Stripped Payloads",
+ "url": "https://attack.mitre.org/techniques/T1027/008",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1027.009",
+ "name": "Embedded Payloads",
+ "url": "https://attack.mitre.org/techniques/T1027/009",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1027.010",
+ "name": "Command Obfuscation",
+ "url": "https://attack.mitre.org/techniques/T1027/010",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1027.011",
+ "name": "Fileless Storage",
+ "url": "https://attack.mitre.org/techniques/T1027/011",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1027.012",
+ "name": "LNK Icon Smuggling",
+ "url": "https://attack.mitre.org/techniques/T1027/012",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1027.013",
+ "name": "Encrypted/Encoded File",
+ "url": "https://attack.mitre.org/techniques/T1027/013",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1027.014",
+ "name": "Polymorphic Code",
+ "url": "https://attack.mitre.org/techniques/T1027/014",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1027.015",
+ "name": "Compression",
+ "url": "https://attack.mitre.org/techniques/T1027/015",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1027.016",
+ "name": "Junk Code Insertion",
+ "url": "https://attack.mitre.org/techniques/T1027/016",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1027.017",
+ "name": "SVG Smuggling",
+ "url": "https://attack.mitre.org/techniques/T1027/017",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1027.018",
+ "name": "Invisible Unicode",
+ "url": "https://attack.mitre.org/techniques/T1027/018",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1029",
+ "name": "Scheduled Transfer",
+ "url": "https://attack.mitre.org/techniques/T1029",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "exfiltration"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1030",
+ "name": "Data Transfer Size Limits",
+ "url": "https://attack.mitre.org/techniques/T1030",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "exfiltration"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1033",
+ "name": "System Owner/User Discovery",
+ "url": "https://attack.mitre.org/techniques/T1033",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1036",
+ "name": "Masquerading",
+ "url": "https://attack.mitre.org/techniques/T1036",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1036.001",
+ "name": "Invalid Code Signature",
+ "url": "https://attack.mitre.org/techniques/T1036/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1036.002",
+ "name": "Right-to-Left Override",
+ "url": "https://attack.mitre.org/techniques/T1036/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1036.003",
+ "name": "Rename Legitimate Utilities",
+ "url": "https://attack.mitre.org/techniques/T1036/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1036.004",
+ "name": "Masquerade Task or Service",
+ "url": "https://attack.mitre.org/techniques/T1036/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1036.005",
+ "name": "Match Legitimate Resource Name or Location",
+ "url": "https://attack.mitre.org/techniques/T1036/005",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1036.006",
+ "name": "Space after Filename",
+ "url": "https://attack.mitre.org/techniques/T1036/006",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1036.007",
+ "name": "Double File Extension",
+ "url": "https://attack.mitre.org/techniques/T1036/007",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1036.008",
+ "name": "Masquerade File Type",
+ "url": "https://attack.mitre.org/techniques/T1036/008",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1036.009",
+ "name": "Break Process Trees",
+ "url": "https://attack.mitre.org/techniques/T1036/009",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1036.010",
+ "name": "Masquerade Account Name",
+ "url": "https://attack.mitre.org/techniques/T1036/010",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1036.011",
+ "name": "Overwrite Process Arguments",
+ "url": "https://attack.mitre.org/techniques/T1036/011",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1036.012",
+ "name": "Browser Fingerprint",
+ "url": "https://attack.mitre.org/techniques/T1036/012",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1037",
+ "name": "Boot or Logon Initialization Scripts",
+ "url": "https://attack.mitre.org/techniques/T1037",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1037.001",
+ "name": "Logon Script (Windows)",
+ "url": "https://attack.mitre.org/techniques/T1037/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1037.002",
+ "name": "Login Hook",
+ "url": "https://attack.mitre.org/techniques/T1037/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1037.003",
+ "name": "Network Logon Script",
+ "url": "https://attack.mitre.org/techniques/T1037/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1037.004",
+ "name": "RC Scripts",
+ "url": "https://attack.mitre.org/techniques/T1037/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1037.005",
+ "name": "Startup Items",
+ "url": "https://attack.mitre.org/techniques/T1037/005",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1039",
+ "name": "Data from Network Shared Drive",
+ "url": "https://attack.mitre.org/techniques/T1039",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1040",
+ "name": "Network Sniffing",
+ "url": "https://attack.mitre.org/techniques/T1040",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access",
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1041",
+ "name": "Exfiltration Over C2 Channel",
+ "url": "https://attack.mitre.org/techniques/T1041",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "exfiltration"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1046",
+ "name": "Network Service Discovery",
+ "url": "https://attack.mitre.org/techniques/T1046",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1047",
+ "name": "Windows Management Instrumentation",
+ "url": "https://attack.mitre.org/techniques/T1047",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1048",
+ "name": "Exfiltration Over Alternative Protocol",
+ "url": "https://attack.mitre.org/techniques/T1048",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "exfiltration"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1048.001",
+ "name": "Exfiltration Over Symmetric Encrypted Non-C2 Protocol",
+ "url": "https://attack.mitre.org/techniques/T1048/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "exfiltration"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1048.002",
+ "name": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol",
+ "url": "https://attack.mitre.org/techniques/T1048/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "exfiltration"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1048.003",
+ "name": "Exfiltration Over Unencrypted Non-C2 Protocol",
+ "url": "https://attack.mitre.org/techniques/T1048/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "exfiltration"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1049",
+ "name": "System Network Connections Discovery",
+ "url": "https://attack.mitre.org/techniques/T1049",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1052",
+ "name": "Exfiltration Over Physical Medium",
+ "url": "https://attack.mitre.org/techniques/T1052",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "exfiltration"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1052.001",
+ "name": "Exfiltration over USB",
+ "url": "https://attack.mitre.org/techniques/T1052/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "exfiltration"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1053",
+ "name": "Scheduled Task/Job",
+ "url": "https://attack.mitre.org/techniques/T1053",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution",
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1053.002",
+ "name": "At",
+ "url": "https://attack.mitre.org/techniques/T1053/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution",
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1053.003",
+ "name": "Cron",
+ "url": "https://attack.mitre.org/techniques/T1053/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution",
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1053.005",
+ "name": "Scheduled Task",
+ "url": "https://attack.mitre.org/techniques/T1053/005",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution",
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1053.006",
+ "name": "Systemd Timers",
+ "url": "https://attack.mitre.org/techniques/T1053/006",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution",
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1053.007",
+ "name": "Container Orchestration Job",
+ "url": "https://attack.mitre.org/techniques/T1053/007",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution",
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1055",
+ "name": "Process Injection",
+ "url": "https://attack.mitre.org/techniques/T1055",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1055.001",
+ "name": "Dynamic-link Library Injection",
+ "url": "https://attack.mitre.org/techniques/T1055/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1055.002",
+ "name": "Portable Executable Injection",
+ "url": "https://attack.mitre.org/techniques/T1055/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1055.003",
+ "name": "Thread Execution Hijacking",
+ "url": "https://attack.mitre.org/techniques/T1055/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1055.004",
+ "name": "Asynchronous Procedure Call",
+ "url": "https://attack.mitre.org/techniques/T1055/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1055.005",
+ "name": "Thread Local Storage",
+ "url": "https://attack.mitre.org/techniques/T1055/005",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1055.008",
+ "name": "Ptrace System Calls",
+ "url": "https://attack.mitre.org/techniques/T1055/008",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1055.009",
+ "name": "Proc Memory",
+ "url": "https://attack.mitre.org/techniques/T1055/009",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1055.011",
+ "name": "Extra Window Memory Injection",
+ "url": "https://attack.mitre.org/techniques/T1055/011",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1055.012",
+ "name": "Process Hollowing",
+ "url": "https://attack.mitre.org/techniques/T1055/012",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1055.013",
+ "name": "Process Doppelgänging",
+ "url": "https://attack.mitre.org/techniques/T1055/013",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1055.014",
+ "name": "VDSO Hijacking",
+ "url": "https://attack.mitre.org/techniques/T1055/014",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1055.015",
+ "name": "ListPlanting",
+ "url": "https://attack.mitre.org/techniques/T1055/015",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1056",
+ "name": "Input Capture",
+ "url": "https://attack.mitre.org/techniques/T1056",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "collection",
+ "credential-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1056.001",
+ "name": "Keylogging",
+ "url": "https://attack.mitre.org/techniques/T1056/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "collection",
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1056.002",
+ "name": "GUI Input Capture",
+ "url": "https://attack.mitre.org/techniques/T1056/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "collection",
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1056.003",
+ "name": "Web Portal Capture",
+ "url": "https://attack.mitre.org/techniques/T1056/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "collection",
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1056.004",
+ "name": "Credential API Hooking",
+ "url": "https://attack.mitre.org/techniques/T1056/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "collection",
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1057",
+ "name": "Process Discovery",
+ "url": "https://attack.mitre.org/techniques/T1057",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1059",
+ "name": "Command and Scripting Interpreter",
+ "url": "https://attack.mitre.org/techniques/T1059",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1059.001",
+ "name": "PowerShell",
+ "url": "https://attack.mitre.org/techniques/T1059/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1059.002",
+ "name": "AppleScript",
+ "url": "https://attack.mitre.org/techniques/T1059/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1059.003",
+ "name": "Windows Command Shell",
+ "url": "https://attack.mitre.org/techniques/T1059/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1059.004",
+ "name": "Unix Shell",
+ "url": "https://attack.mitre.org/techniques/T1059/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1059.005",
+ "name": "Visual Basic",
+ "url": "https://attack.mitre.org/techniques/T1059/005",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1059.006",
+ "name": "Python",
+ "url": "https://attack.mitre.org/techniques/T1059/006",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1059.007",
+ "name": "JavaScript",
+ "url": "https://attack.mitre.org/techniques/T1059/007",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1059.008",
+ "name": "Network Device CLI",
+ "url": "https://attack.mitre.org/techniques/T1059/008",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1059.009",
+ "name": "Cloud API",
+ "url": "https://attack.mitre.org/techniques/T1059/009",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1059.010",
+ "name": "AutoHotKey & AutoIT",
+ "url": "https://attack.mitre.org/techniques/T1059/010",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1059.011",
+ "name": "Lua",
+ "url": "https://attack.mitre.org/techniques/T1059/011",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1059.012",
+ "name": "Hypervisor CLI",
+ "url": "https://attack.mitre.org/techniques/T1059/012",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1059.013",
+ "name": "Container CLI/API",
+ "url": "https://attack.mitre.org/techniques/T1059/013",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1068",
+ "name": "Exploitation for Privilege Escalation",
+ "url": "https://attack.mitre.org/techniques/T1068",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "privilege-escalation"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1069",
+ "name": "Permission Groups Discovery",
+ "url": "https://attack.mitre.org/techniques/T1069",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1069.001",
+ "name": "Local Groups",
+ "url": "https://attack.mitre.org/techniques/T1069/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1069.002",
+ "name": "Domain Groups",
+ "url": "https://attack.mitre.org/techniques/T1069/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1069.003",
+ "name": "Cloud Groups",
+ "url": "https://attack.mitre.org/techniques/T1069/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1070",
+ "name": "Indicator Removal",
+ "url": "https://attack.mitre.org/techniques/T1070",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1070.003",
+ "name": "Clear Command History",
+ "url": "https://attack.mitre.org/techniques/T1070/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1070.004",
+ "name": "File Deletion",
+ "url": "https://attack.mitre.org/techniques/T1070/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1070.005",
+ "name": "Network Share Connection Removal",
+ "url": "https://attack.mitre.org/techniques/T1070/005",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1070.006",
+ "name": "Timestomp",
+ "url": "https://attack.mitre.org/techniques/T1070/006",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1070.007",
+ "name": "Clear Network Connection History and Configurations",
+ "url": "https://attack.mitre.org/techniques/T1070/007",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1070.008",
+ "name": "Clear Mailbox Data",
+ "url": "https://attack.mitre.org/techniques/T1070/008",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1070.009",
+ "name": "Clear Persistence",
+ "url": "https://attack.mitre.org/techniques/T1070/009",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1070.010",
+ "name": "Relocate Malware",
+ "url": "https://attack.mitre.org/techniques/T1070/010",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1071",
+ "name": "Application Layer Protocol",
+ "url": "https://attack.mitre.org/techniques/T1071",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1071.001",
+ "name": "Web Protocols",
+ "url": "https://attack.mitre.org/techniques/T1071/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1071.002",
+ "name": "File Transfer Protocols",
+ "url": "https://attack.mitre.org/techniques/T1071/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1071.003",
+ "name": "Mail Protocols",
+ "url": "https://attack.mitre.org/techniques/T1071/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1071.004",
+ "name": "DNS",
+ "url": "https://attack.mitre.org/techniques/T1071/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1071.005",
+ "name": "Publish/Subscribe Protocols",
+ "url": "https://attack.mitre.org/techniques/T1071/005",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1072",
+ "name": "Software Deployment Tools",
+ "url": "https://attack.mitre.org/techniques/T1072",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution",
+ "lateral-movement"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1074",
+ "name": "Data Staged",
+ "url": "https://attack.mitre.org/techniques/T1074",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1074.001",
+ "name": "Local Data Staging",
+ "url": "https://attack.mitre.org/techniques/T1074/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1074.002",
+ "name": "Remote Data Staging",
+ "url": "https://attack.mitre.org/techniques/T1074/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1078",
+ "name": "Valid Accounts",
+ "url": "https://attack.mitre.org/techniques/T1078",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "persistence",
+ "privilege-escalation",
+ "initial-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1078.001",
+ "name": "Default Accounts",
+ "url": "https://attack.mitre.org/techniques/T1078/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "persistence",
+ "privilege-escalation",
+ "initial-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1078.002",
+ "name": "Domain Accounts",
+ "url": "https://attack.mitre.org/techniques/T1078/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "persistence",
+ "privilege-escalation",
+ "initial-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1078.003",
+ "name": "Local Accounts",
+ "url": "https://attack.mitre.org/techniques/T1078/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "persistence",
+ "privilege-escalation",
+ "initial-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1078.004",
+ "name": "Cloud Accounts",
+ "url": "https://attack.mitre.org/techniques/T1078/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "persistence",
+ "privilege-escalation",
+ "initial-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1080",
+ "name": "Taint Shared Content",
+ "url": "https://attack.mitre.org/techniques/T1080",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "lateral-movement"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1082",
+ "name": "System Information Discovery",
+ "url": "https://attack.mitre.org/techniques/T1082",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1083",
+ "name": "File and Directory Discovery",
+ "url": "https://attack.mitre.org/techniques/T1083",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1087",
+ "name": "Account Discovery",
+ "url": "https://attack.mitre.org/techniques/T1087",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1087.001",
+ "name": "Local Account",
+ "url": "https://attack.mitre.org/techniques/T1087/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1087.002",
+ "name": "Domain Account",
+ "url": "https://attack.mitre.org/techniques/T1087/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1087.003",
+ "name": "Email Account",
+ "url": "https://attack.mitre.org/techniques/T1087/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1087.004",
+ "name": "Cloud Account",
+ "url": "https://attack.mitre.org/techniques/T1087/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1090",
+ "name": "Proxy",
+ "url": "https://attack.mitre.org/techniques/T1090",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1090.001",
+ "name": "Internal Proxy",
+ "url": "https://attack.mitre.org/techniques/T1090/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1090.002",
+ "name": "External Proxy",
+ "url": "https://attack.mitre.org/techniques/T1090/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1090.003",
+ "name": "Multi-hop Proxy",
+ "url": "https://attack.mitre.org/techniques/T1090/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1090.004",
+ "name": "Domain Fronting",
+ "url": "https://attack.mitre.org/techniques/T1090/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1091",
+ "name": "Replication Through Removable Media",
+ "url": "https://attack.mitre.org/techniques/T1091",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "lateral-movement",
+ "initial-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1092",
+ "name": "Communication Through Removable Media",
+ "url": "https://attack.mitre.org/techniques/T1092",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1095",
+ "name": "Non-Application Layer Protocol",
+ "url": "https://attack.mitre.org/techniques/T1095",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1098",
+ "name": "Account Manipulation",
+ "url": "https://attack.mitre.org/techniques/T1098",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1098.001",
+ "name": "Additional Cloud Credentials",
+ "url": "https://attack.mitre.org/techniques/T1098/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1098.002",
+ "name": "Additional Email Delegate Permissions",
+ "url": "https://attack.mitre.org/techniques/T1098/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1098.003",
+ "name": "Additional Cloud Roles",
+ "url": "https://attack.mitre.org/techniques/T1098/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1098.004",
+ "name": "SSH Authorized Keys",
+ "url": "https://attack.mitre.org/techniques/T1098/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1098.005",
+ "name": "Device Registration",
+ "url": "https://attack.mitre.org/techniques/T1098/005",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1098.006",
+ "name": "Additional Container Cluster Roles",
+ "url": "https://attack.mitre.org/techniques/T1098/006",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1098.007",
+ "name": "Additional Local or Domain Groups",
+ "url": "https://attack.mitre.org/techniques/T1098/007",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1102",
+ "name": "Web Service",
+ "url": "https://attack.mitre.org/techniques/T1102",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1102.001",
+ "name": "Dead Drop Resolver",
+ "url": "https://attack.mitre.org/techniques/T1102/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1102.002",
+ "name": "Bidirectional Communication",
+ "url": "https://attack.mitre.org/techniques/T1102/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1102.003",
+ "name": "One-Way Communication",
+ "url": "https://attack.mitre.org/techniques/T1102/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1104",
+ "name": "Multi-Stage Channels",
+ "url": "https://attack.mitre.org/techniques/T1104",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1105",
+ "name": "Ingress Tool Transfer",
+ "url": "https://attack.mitre.org/techniques/T1105",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1106",
+ "name": "Native API",
+ "url": "https://attack.mitre.org/techniques/T1106",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1110",
+ "name": "Brute Force",
+ "url": "https://attack.mitre.org/techniques/T1110",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1110.001",
+ "name": "Password Guessing",
+ "url": "https://attack.mitre.org/techniques/T1110/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1110.002",
+ "name": "Password Cracking",
+ "url": "https://attack.mitre.org/techniques/T1110/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1110.003",
+ "name": "Password Spraying",
+ "url": "https://attack.mitre.org/techniques/T1110/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1110.004",
+ "name": "Credential Stuffing",
+ "url": "https://attack.mitre.org/techniques/T1110/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1111",
+ "name": "Multi-Factor Authentication Interception",
+ "url": "https://attack.mitre.org/techniques/T1111",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1112",
+ "name": "Modify Registry",
+ "url": "https://attack.mitre.org/techniques/T1112",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment",
+ "persistence"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1113",
+ "name": "Screen Capture",
+ "url": "https://attack.mitre.org/techniques/T1113",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1114",
+ "name": "Email Collection",
+ "url": "https://attack.mitre.org/techniques/T1114",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1114.001",
+ "name": "Local Email Collection",
+ "url": "https://attack.mitre.org/techniques/T1114/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1114.002",
+ "name": "Remote Email Collection",
+ "url": "https://attack.mitre.org/techniques/T1114/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1114.003",
+ "name": "Email Forwarding Rule",
+ "url": "https://attack.mitre.org/techniques/T1114/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1115",
+ "name": "Clipboard Data",
+ "url": "https://attack.mitre.org/techniques/T1115",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1119",
+ "name": "Automated Collection",
+ "url": "https://attack.mitre.org/techniques/T1119",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1120",
+ "name": "Peripheral Device Discovery",
+ "url": "https://attack.mitre.org/techniques/T1120",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1123",
+ "name": "Audio Capture",
+ "url": "https://attack.mitre.org/techniques/T1123",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1124",
+ "name": "System Time Discovery",
+ "url": "https://attack.mitre.org/techniques/T1124",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1125",
+ "name": "Video Capture",
+ "url": "https://attack.mitre.org/techniques/T1125",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1127",
+ "name": "Trusted Developer Utilities Proxy Execution",
+ "url": "https://attack.mitre.org/techniques/T1127",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "execution"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1127.001",
+ "name": "MSBuild",
+ "url": "https://attack.mitre.org/techniques/T1127/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "execution"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1127.002",
+ "name": "ClickOnce",
+ "url": "https://attack.mitre.org/techniques/T1127/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "execution"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1127.003",
+ "name": "JamPlus",
+ "url": "https://attack.mitre.org/techniques/T1127/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "execution"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1129",
+ "name": "Shared Modules",
+ "url": "https://attack.mitre.org/techniques/T1129",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1132",
+ "name": "Data Encoding",
+ "url": "https://attack.mitre.org/techniques/T1132",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1132.001",
+ "name": "Standard Encoding",
+ "url": "https://attack.mitre.org/techniques/T1132/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1132.002",
+ "name": "Non-Standard Encoding",
+ "url": "https://attack.mitre.org/techniques/T1132/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1133",
+ "name": "External Remote Services",
+ "url": "https://attack.mitre.org/techniques/T1133",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence",
+ "initial-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1134",
+ "name": "Access Token Manipulation",
+ "url": "https://attack.mitre.org/techniques/T1134",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1134.001",
+ "name": "Token Impersonation/Theft",
+ "url": "https://attack.mitre.org/techniques/T1134/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1134.002",
+ "name": "Create Process with Token",
+ "url": "https://attack.mitre.org/techniques/T1134/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1134.003",
+ "name": "Make and Impersonate Token",
+ "url": "https://attack.mitre.org/techniques/T1134/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1134.004",
+ "name": "Parent PID Spoofing",
+ "url": "https://attack.mitre.org/techniques/T1134/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1134.005",
+ "name": "SID-History Injection",
+ "url": "https://attack.mitre.org/techniques/T1134/005",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1135",
+ "name": "Network Share Discovery",
+ "url": "https://attack.mitre.org/techniques/T1135",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1136",
+ "name": "Create Account",
+ "url": "https://attack.mitre.org/techniques/T1136",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1136.001",
+ "name": "Local Account",
+ "url": "https://attack.mitre.org/techniques/T1136/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1136.002",
+ "name": "Domain Account",
+ "url": "https://attack.mitre.org/techniques/T1136/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1136.003",
+ "name": "Cloud Account",
+ "url": "https://attack.mitre.org/techniques/T1136/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1137",
+ "name": "Office Application Startup",
+ "url": "https://attack.mitre.org/techniques/T1137",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1137.001",
+ "name": "Office Template Macros",
+ "url": "https://attack.mitre.org/techniques/T1137/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1137.002",
+ "name": "Office Test",
+ "url": "https://attack.mitre.org/techniques/T1137/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1137.003",
+ "name": "Outlook Forms",
+ "url": "https://attack.mitre.org/techniques/T1137/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1137.004",
+ "name": "Outlook Home Page",
+ "url": "https://attack.mitre.org/techniques/T1137/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1137.005",
+ "name": "Outlook Rules",
+ "url": "https://attack.mitre.org/techniques/T1137/005",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1137.006",
+ "name": "Add-ins",
+ "url": "https://attack.mitre.org/techniques/T1137/006",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1140",
+ "name": "Deobfuscate/Decode Files or Information",
+ "url": "https://attack.mitre.org/techniques/T1140",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1176",
+ "name": "Software Extensions",
+ "url": "https://attack.mitre.org/techniques/T1176",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1176.001",
+ "name": "Browser Extensions",
+ "url": "https://attack.mitre.org/techniques/T1176/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1176.002",
+ "name": "IDE Extensions",
+ "url": "https://attack.mitre.org/techniques/T1176/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1185",
+ "name": "Browser Session Hijacking",
+ "url": "https://attack.mitre.org/techniques/T1185",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1187",
+ "name": "Forced Authentication",
+ "url": "https://attack.mitre.org/techniques/T1187",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1189",
+ "name": "Drive-by Compromise",
+ "url": "https://attack.mitre.org/techniques/T1189",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "initial-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1190",
+ "name": "Exploit Public-Facing Application",
+ "url": "https://attack.mitre.org/techniques/T1190",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "initial-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1195",
+ "name": "Supply Chain Compromise",
+ "url": "https://attack.mitre.org/techniques/T1195",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "initial-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1195.001",
+ "name": "Compromise Software Dependencies and Development Tools",
+ "url": "https://attack.mitre.org/techniques/T1195/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "initial-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1195.002",
+ "name": "Compromise Software Supply Chain",
+ "url": "https://attack.mitre.org/techniques/T1195/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "initial-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1195.003",
+ "name": "Compromise Hardware Supply Chain",
+ "url": "https://attack.mitre.org/techniques/T1195/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "initial-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1197",
+ "name": "BITS Jobs",
+ "url": "https://attack.mitre.org/techniques/T1197",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "persistence",
+ "execution"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1199",
+ "name": "Trusted Relationship",
+ "url": "https://attack.mitre.org/techniques/T1199",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "initial-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1200",
+ "name": "Hardware Additions",
+ "url": "https://attack.mitre.org/techniques/T1200",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "initial-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1201",
+ "name": "Password Policy Discovery",
+ "url": "https://attack.mitre.org/techniques/T1201",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1202",
+ "name": "Indirect Command Execution",
+ "url": "https://attack.mitre.org/techniques/T1202",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1203",
+ "name": "Exploitation for Client Execution",
+ "url": "https://attack.mitre.org/techniques/T1203",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1204",
+ "name": "User Execution",
+ "url": "https://attack.mitre.org/techniques/T1204",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1204.001",
+ "name": "Malicious Link",
+ "url": "https://attack.mitre.org/techniques/T1204/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1204.002",
+ "name": "Malicious File",
+ "url": "https://attack.mitre.org/techniques/T1204/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1204.003",
+ "name": "Malicious Image",
+ "url": "https://attack.mitre.org/techniques/T1204/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1204.004",
+ "name": "Malicious Copy and Paste",
+ "url": "https://attack.mitre.org/techniques/T1204/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1204.005",
+ "name": "Malicious Library",
+ "url": "https://attack.mitre.org/techniques/T1204/005",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1205",
+ "name": "Traffic Signaling",
+ "url": "https://attack.mitre.org/techniques/T1205",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "persistence",
+ "command-and-control"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1205.001",
+ "name": "Port Knocking",
+ "url": "https://attack.mitre.org/techniques/T1205/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "persistence",
+ "command-and-control"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1205.002",
+ "name": "Socket Filters",
+ "url": "https://attack.mitre.org/techniques/T1205/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "persistence",
+ "command-and-control"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1207",
+ "name": "Rogue Domain Controller",
+ "url": "https://attack.mitre.org/techniques/T1207",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1210",
+ "name": "Exploitation of Remote Services",
+ "url": "https://attack.mitre.org/techniques/T1210",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "lateral-movement"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1211",
+ "name": "Exploitation for Stealth",
+ "url": "https://attack.mitre.org/techniques/T1211",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1212",
+ "name": "Exploitation for Credential Access",
+ "url": "https://attack.mitre.org/techniques/T1212",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1213",
+ "name": "Data from Information Repositories",
+ "url": "https://attack.mitre.org/techniques/T1213",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1213.001",
+ "name": "Confluence",
+ "url": "https://attack.mitre.org/techniques/T1213/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1213.002",
+ "name": "Sharepoint",
+ "url": "https://attack.mitre.org/techniques/T1213/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1213.003",
+ "name": "Code Repositories",
+ "url": "https://attack.mitre.org/techniques/T1213/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1213.004",
+ "name": "Customer Relationship Management Software",
+ "url": "https://attack.mitre.org/techniques/T1213/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1213.005",
+ "name": "Messaging Applications",
+ "url": "https://attack.mitre.org/techniques/T1213/005",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1213.006",
+ "name": "Databases",
+ "url": "https://attack.mitre.org/techniques/T1213/006",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1216",
+ "name": "System Script Proxy Execution",
+ "url": "https://attack.mitre.org/techniques/T1216",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1216.001",
+ "name": "PubPrn",
+ "url": "https://attack.mitre.org/techniques/T1216/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1216.002",
+ "name": "SyncAppvPublishingServer",
+ "url": "https://attack.mitre.org/techniques/T1216/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1217",
+ "name": "Browser Information Discovery",
+ "url": "https://attack.mitre.org/techniques/T1217",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1218",
+ "name": "System Binary Proxy Execution",
+ "url": "https://attack.mitre.org/techniques/T1218",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1218.001",
+ "name": "Compiled HTML File",
+ "url": "https://attack.mitre.org/techniques/T1218/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1218.002",
+ "name": "Control Panel",
+ "url": "https://attack.mitre.org/techniques/T1218/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1218.003",
+ "name": "CMSTP",
+ "url": "https://attack.mitre.org/techniques/T1218/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1218.004",
+ "name": "InstallUtil",
+ "url": "https://attack.mitre.org/techniques/T1218/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1218.005",
+ "name": "Mshta",
+ "url": "https://attack.mitre.org/techniques/T1218/005",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1218.007",
+ "name": "Msiexec",
+ "url": "https://attack.mitre.org/techniques/T1218/007",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1218.008",
+ "name": "Odbcconf",
+ "url": "https://attack.mitre.org/techniques/T1218/008",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1218.009",
+ "name": "Regsvcs/Regasm",
+ "url": "https://attack.mitre.org/techniques/T1218/009",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1218.010",
+ "name": "Regsvr32",
+ "url": "https://attack.mitre.org/techniques/T1218/010",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1218.011",
+ "name": "Rundll32",
+ "url": "https://attack.mitre.org/techniques/T1218/011",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1218.012",
+ "name": "Verclsid",
+ "url": "https://attack.mitre.org/techniques/T1218/012",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1218.013",
+ "name": "Mavinject",
+ "url": "https://attack.mitre.org/techniques/T1218/013",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1218.014",
+ "name": "MMC",
+ "url": "https://attack.mitre.org/techniques/T1218/014",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1218.015",
+ "name": "Electron Applications",
+ "url": "https://attack.mitre.org/techniques/T1218/015",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1219",
+ "name": "Remote Access Tools",
+ "url": "https://attack.mitre.org/techniques/T1219",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1219.001",
+ "name": "IDE Tunneling",
+ "url": "https://attack.mitre.org/techniques/T1219/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1219.002",
+ "name": "Remote Desktop Software",
+ "url": "https://attack.mitre.org/techniques/T1219/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1219.003",
+ "name": "Remote Access Hardware",
+ "url": "https://attack.mitre.org/techniques/T1219/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1220",
+ "name": "XSL Script Processing",
+ "url": "https://attack.mitre.org/techniques/T1220",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1221",
+ "name": "Template Injection",
+ "url": "https://attack.mitre.org/techniques/T1221",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1222",
+ "name": "File and Directory Permissions Modification",
+ "url": "https://attack.mitre.org/techniques/T1222",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1222.001",
+ "name": "Windows Permissions",
+ "url": "https://attack.mitre.org/techniques/T1222/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1222.002",
+ "name": "Linux and Mac Permissions",
+ "url": "https://attack.mitre.org/techniques/T1222/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1398",
+ "name": "Boot or Logon Initialization Scripts",
+ "url": "https://attack.mitre.org/techniques/T1398",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "persistence"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1404",
+ "name": "Exploitation for Privilege Escalation",
+ "url": "https://attack.mitre.org/techniques/T1404",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "privilege-escalation"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1406",
+ "name": "Obfuscated Files or Information",
+ "url": "https://attack.mitre.org/techniques/T1406",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "defense-evasion"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1406.001",
+ "name": "Steganography",
+ "url": "https://attack.mitre.org/techniques/T1406/001",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "defense-evasion"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1406.002",
+ "name": "Software Packing",
+ "url": "https://attack.mitre.org/techniques/T1406/002",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "defense-evasion"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1407",
+ "name": "Download New Code at Runtime",
+ "url": "https://attack.mitre.org/techniques/T1407",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "defense-evasion"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1409",
+ "name": "Stored Application Data",
+ "url": "https://attack.mitre.org/techniques/T1409",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1414",
+ "name": "Clipboard Data",
+ "url": "https://attack.mitre.org/techniques/T1414",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "collection",
+ "credential-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1417",
+ "name": "Input Capture",
+ "url": "https://attack.mitre.org/techniques/T1417",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "collection",
+ "credential-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1417.001",
+ "name": "Keylogging",
+ "url": "https://attack.mitre.org/techniques/T1417/001",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "collection",
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1417.002",
+ "name": "GUI Input Capture",
+ "url": "https://attack.mitre.org/techniques/T1417/002",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "credential-access",
+ "collection"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1418",
+ "name": "Software Discovery",
+ "url": "https://attack.mitre.org/techniques/T1418",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1418.001",
+ "name": "Security Software Discovery",
+ "url": "https://attack.mitre.org/techniques/T1418/001",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1420",
+ "name": "File and Directory Discovery",
+ "url": "https://attack.mitre.org/techniques/T1420",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1421",
+ "name": "System Network Connections Discovery",
+ "url": "https://attack.mitre.org/techniques/T1421",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1422",
+ "name": "System Network Configuration Discovery",
+ "url": "https://attack.mitre.org/techniques/T1422",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1422.001",
+ "name": "Internet Connection Discovery",
+ "url": "https://attack.mitre.org/techniques/T1422/001",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1422.002",
+ "name": "Wi-Fi Discovery",
+ "url": "https://attack.mitre.org/techniques/T1422/002",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1423",
+ "name": "Network Service Scanning",
+ "url": "https://attack.mitre.org/techniques/T1423",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1424",
+ "name": "Process Discovery",
+ "url": "https://attack.mitre.org/techniques/T1424",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1426",
+ "name": "System Information Discovery",
+ "url": "https://attack.mitre.org/techniques/T1426",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1428",
+ "name": "Exploitation of Remote Services",
+ "url": "https://attack.mitre.org/techniques/T1428",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "lateral-movement"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1429",
+ "name": "Audio Capture",
+ "url": "https://attack.mitre.org/techniques/T1429",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1430",
+ "name": "Location Tracking",
+ "url": "https://attack.mitre.org/techniques/T1430",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "collection",
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1430.001",
+ "name": "Remote Device Management Services",
+ "url": "https://attack.mitre.org/techniques/T1430/001",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "collection",
+ "discovery"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1430.002",
+ "name": "Impersonate SS7 Nodes",
+ "url": "https://attack.mitre.org/techniques/T1430/002",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "collection",
+ "discovery"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1437",
+ "name": "Application Layer Protocol",
+ "url": "https://attack.mitre.org/techniques/T1437",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1437.001",
+ "name": "Web Protocols",
+ "url": "https://attack.mitre.org/techniques/T1437/001",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1451",
+ "name": "SIM Card Swap",
+ "url": "https://attack.mitre.org/techniques/T1451",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "initial-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1453",
+ "name": "Abuse Accessibility Features",
+ "url": "https://attack.mitre.org/techniques/T1453",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "collection",
+ "credential-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1456",
+ "name": "Drive-By Compromise",
+ "url": "https://attack.mitre.org/techniques/T1456",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "initial-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1458",
+ "name": "Replication Through Removable Media",
+ "url": "https://attack.mitre.org/techniques/T1458",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "initial-access",
+ "lateral-movement"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1461",
+ "name": "Lockscreen Bypass",
+ "url": "https://attack.mitre.org/techniques/T1461",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "initial-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1464",
+ "name": "Network Denial of Service",
+ "url": "https://attack.mitre.org/techniques/T1464",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1471",
+ "name": "Data Encrypted for Impact",
+ "url": "https://attack.mitre.org/techniques/T1471",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1474",
+ "name": "Supply Chain Compromise",
+ "url": "https://attack.mitre.org/techniques/T1474",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "initial-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1474.001",
+ "name": "Compromise Software Dependencies and Development Tools",
+ "url": "https://attack.mitre.org/techniques/T1474/001",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "initial-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1474.002",
+ "name": "Compromise Hardware Supply Chain",
+ "url": "https://attack.mitre.org/techniques/T1474/002",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "initial-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1474.003",
+ "name": "Compromise Software Supply Chain",
+ "url": "https://attack.mitre.org/techniques/T1474/003",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "initial-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1480",
+ "name": "Execution Guardrails",
+ "url": "https://attack.mitre.org/techniques/T1480",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1480.001",
+ "name": "Environmental Keying",
+ "url": "https://attack.mitre.org/techniques/T1480/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1480.002",
+ "name": "Mutual Exclusion",
+ "url": "https://attack.mitre.org/techniques/T1480/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1481",
+ "name": "Web Service",
+ "url": "https://attack.mitre.org/techniques/T1481",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1481.001",
+ "name": "Dead Drop Resolver",
+ "url": "https://attack.mitre.org/techniques/T1481/001",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1481.002",
+ "name": "Bidirectional Communication",
+ "url": "https://attack.mitre.org/techniques/T1481/002",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1481.003",
+ "name": "One-Way Communication",
+ "url": "https://attack.mitre.org/techniques/T1481/003",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1482",
+ "name": "Domain Trust Discovery",
+ "url": "https://attack.mitre.org/techniques/T1482",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1484",
+ "name": "Domain or Tenant Policy Modification",
+ "url": "https://attack.mitre.org/techniques/T1484",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1484.001",
+ "name": "Group Policy Modification",
+ "url": "https://attack.mitre.org/techniques/T1484/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1484.002",
+ "name": "Trust Modification",
+ "url": "https://attack.mitre.org/techniques/T1484/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1485",
+ "name": "Data Destruction",
+ "url": "https://attack.mitre.org/techniques/T1485",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1485.001",
+ "name": "Lifecycle-Triggered Deletion",
+ "url": "https://attack.mitre.org/techniques/T1485/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1486",
+ "name": "Data Encrypted for Impact",
+ "url": "https://attack.mitre.org/techniques/T1486",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1489",
+ "name": "Service Stop",
+ "url": "https://attack.mitre.org/techniques/T1489",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1490",
+ "name": "Inhibit System Recovery",
+ "url": "https://attack.mitre.org/techniques/T1490",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1491",
+ "name": "Defacement",
+ "url": "https://attack.mitre.org/techniques/T1491",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1491.001",
+ "name": "Internal Defacement",
+ "url": "https://attack.mitre.org/techniques/T1491/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1491.002",
+ "name": "External Defacement",
+ "url": "https://attack.mitre.org/techniques/T1491/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1495",
+ "name": "Firmware Corruption",
+ "url": "https://attack.mitre.org/techniques/T1495",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1496",
+ "name": "Resource Hijacking",
+ "url": "https://attack.mitre.org/techniques/T1496",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1496.001",
+ "name": "Compute Hijacking",
+ "url": "https://attack.mitre.org/techniques/T1496/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1496.002",
+ "name": "Bandwidth Hijacking",
+ "url": "https://attack.mitre.org/techniques/T1496/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1496.003",
+ "name": "SMS Pumping",
+ "url": "https://attack.mitre.org/techniques/T1496/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1496.004",
+ "name": "Cloud Service Hijacking",
+ "url": "https://attack.mitre.org/techniques/T1496/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1497",
+ "name": "Virtualization/Sandbox Evasion",
+ "url": "https://attack.mitre.org/techniques/T1497",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1497.001",
+ "name": "System Checks",
+ "url": "https://attack.mitre.org/techniques/T1497/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "discovery"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1497.002",
+ "name": "User Activity Based Checks",
+ "url": "https://attack.mitre.org/techniques/T1497/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "discovery"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1497.003",
+ "name": "Time Based Checks",
+ "url": "https://attack.mitre.org/techniques/T1497/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "discovery"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1498",
+ "name": "Network Denial of Service",
+ "url": "https://attack.mitre.org/techniques/T1498",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1498.001",
+ "name": "Direct Network Flood",
+ "url": "https://attack.mitre.org/techniques/T1498/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1498.002",
+ "name": "Reflection Amplification",
+ "url": "https://attack.mitre.org/techniques/T1498/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1499",
+ "name": "Endpoint Denial of Service",
+ "url": "https://attack.mitre.org/techniques/T1499",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1499.001",
+ "name": "OS Exhaustion Flood",
+ "url": "https://attack.mitre.org/techniques/T1499/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1499.002",
+ "name": "Service Exhaustion Flood",
+ "url": "https://attack.mitre.org/techniques/T1499/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1499.003",
+ "name": "Application Exhaustion Flood",
+ "url": "https://attack.mitre.org/techniques/T1499/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1499.004",
+ "name": "Application or System Exploitation",
+ "url": "https://attack.mitre.org/techniques/T1499/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1505",
+ "name": "Server Software Component",
+ "url": "https://attack.mitre.org/techniques/T1505",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1505.001",
+ "name": "SQL Stored Procedures",
+ "url": "https://attack.mitre.org/techniques/T1505/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1505.002",
+ "name": "Transport Agent",
+ "url": "https://attack.mitre.org/techniques/T1505/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1505.003",
+ "name": "Web Shell",
+ "url": "https://attack.mitre.org/techniques/T1505/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1505.004",
+ "name": "IIS Components",
+ "url": "https://attack.mitre.org/techniques/T1505/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1505.005",
+ "name": "Terminal Services DLL",
+ "url": "https://attack.mitre.org/techniques/T1505/005",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1505.006",
+ "name": "vSphere Installation Bundles",
+ "url": "https://attack.mitre.org/techniques/T1505/006",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1509",
+ "name": "Non-Standard Port",
+ "url": "https://attack.mitre.org/techniques/T1509",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1512",
+ "name": "Video Capture",
+ "url": "https://attack.mitre.org/techniques/T1512",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1513",
+ "name": "Screen Capture",
+ "url": "https://attack.mitre.org/techniques/T1513",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1516",
+ "name": "Input Injection",
+ "url": "https://attack.mitre.org/techniques/T1516",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "defense-evasion",
+ "impact"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1517",
+ "name": "Access Notifications",
+ "url": "https://attack.mitre.org/techniques/T1517",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "collection",
+ "credential-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1518",
+ "name": "Software Discovery",
+ "url": "https://attack.mitre.org/techniques/T1518",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1518.001",
+ "name": "Security Software Discovery",
+ "url": "https://attack.mitre.org/techniques/T1518/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1518.002",
+ "name": "Backup Software Discovery",
+ "url": "https://attack.mitre.org/techniques/T1518/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1521",
+ "name": "Encrypted Channel",
+ "url": "https://attack.mitre.org/techniques/T1521",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1521.001",
+ "name": "Symmetric Cryptography",
+ "url": "https://attack.mitre.org/techniques/T1521/001",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1521.002",
+ "name": "Asymmetric Cryptography",
+ "url": "https://attack.mitre.org/techniques/T1521/002",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1521.003",
+ "name": "SSL Pinning",
+ "url": "https://attack.mitre.org/techniques/T1521/003",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1525",
+ "name": "Implant Internal Image",
+ "url": "https://attack.mitre.org/techniques/T1525",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1526",
+ "name": "Cloud Service Discovery",
+ "url": "https://attack.mitre.org/techniques/T1526",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1528",
+ "name": "Steal Application Access Token",
+ "url": "https://attack.mitre.org/techniques/T1528",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1529",
+ "name": "System Shutdown/Reboot",
+ "url": "https://attack.mitre.org/techniques/T1529",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1530",
+ "name": "Data from Cloud Storage",
+ "url": "https://attack.mitre.org/techniques/T1530",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1531",
+ "name": "Account Access Removal",
+ "url": "https://attack.mitre.org/techniques/T1531",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1532",
+ "name": "Archive Collected Data",
+ "url": "https://attack.mitre.org/techniques/T1532",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1533",
+ "name": "Data from Local System",
+ "url": "https://attack.mitre.org/techniques/T1533",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1534",
+ "name": "Internal Spearphishing",
+ "url": "https://attack.mitre.org/techniques/T1534",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "lateral-movement"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1535",
+ "name": "Unused/Unsupported Cloud Regions",
+ "url": "https://attack.mitre.org/techniques/T1535",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1537",
+ "name": "Transfer Data to Cloud Account",
+ "url": "https://attack.mitre.org/techniques/T1537",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "exfiltration"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1538",
+ "name": "Cloud Service Dashboard",
+ "url": "https://attack.mitre.org/techniques/T1538",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1539",
+ "name": "Steal Web Session Cookie",
+ "url": "https://attack.mitre.org/techniques/T1539",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1541",
+ "name": "Foreground Persistence",
+ "url": "https://attack.mitre.org/techniques/T1541",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "defense-evasion",
+ "persistence"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1542",
+ "name": "Pre-OS Boot",
+ "url": "https://attack.mitre.org/techniques/T1542",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "persistence"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1542.001",
+ "name": "System Firmware",
+ "url": "https://attack.mitre.org/techniques/T1542/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "persistence"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1542.002",
+ "name": "Component Firmware",
+ "url": "https://attack.mitre.org/techniques/T1542/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "persistence"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1542.003",
+ "name": "Bootkit",
+ "url": "https://attack.mitre.org/techniques/T1542/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "persistence"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1542.004",
+ "name": "ROMMONkit",
+ "url": "https://attack.mitre.org/techniques/T1542/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "persistence"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1542.005",
+ "name": "TFTP Boot",
+ "url": "https://attack.mitre.org/techniques/T1542/005",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "persistence"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1543",
+ "name": "Create or Modify System Process",
+ "url": "https://attack.mitre.org/techniques/T1543",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1543.001",
+ "name": "Launch Agent",
+ "url": "https://attack.mitre.org/techniques/T1543/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1543.002",
+ "name": "Systemd Service",
+ "url": "https://attack.mitre.org/techniques/T1543/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1543.003",
+ "name": "Windows Service",
+ "url": "https://attack.mitre.org/techniques/T1543/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1543.004",
+ "name": "Launch Daemon",
+ "url": "https://attack.mitre.org/techniques/T1543/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1543.005",
+ "name": "Container Service",
+ "url": "https://attack.mitre.org/techniques/T1543/005",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1544",
+ "name": "Ingress Tool Transfer",
+ "url": "https://attack.mitre.org/techniques/T1544",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1546",
+ "name": "Event Triggered Execution",
+ "url": "https://attack.mitre.org/techniques/T1546",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "privilege-escalation",
+ "persistence"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1546.001",
+ "name": "Change Default File Association",
+ "url": "https://attack.mitre.org/techniques/T1546/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "privilege-escalation",
+ "persistence"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1546.002",
+ "name": "Screensaver",
+ "url": "https://attack.mitre.org/techniques/T1546/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "privilege-escalation",
+ "persistence"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1546.003",
+ "name": "Windows Management Instrumentation Event Subscription",
+ "url": "https://attack.mitre.org/techniques/T1546/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "privilege-escalation",
+ "persistence"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1546.004",
+ "name": "Unix Shell Configuration Modification",
+ "url": "https://attack.mitre.org/techniques/T1546/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "privilege-escalation",
+ "persistence"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1546.005",
+ "name": "Trap",
+ "url": "https://attack.mitre.org/techniques/T1546/005",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "privilege-escalation",
+ "persistence"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1546.006",
+ "name": "LC_LOAD_DYLIB Addition",
+ "url": "https://attack.mitre.org/techniques/T1546/006",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "privilege-escalation",
+ "persistence"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1546.007",
+ "name": "Netsh Helper DLL",
+ "url": "https://attack.mitre.org/techniques/T1546/007",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "privilege-escalation",
+ "persistence"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1546.008",
+ "name": "Accessibility Features",
+ "url": "https://attack.mitre.org/techniques/T1546/008",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "privilege-escalation",
+ "persistence"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1546.009",
+ "name": "AppCert DLLs",
+ "url": "https://attack.mitre.org/techniques/T1546/009",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "privilege-escalation",
+ "persistence"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1546.010",
+ "name": "AppInit DLLs",
+ "url": "https://attack.mitre.org/techniques/T1546/010",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "privilege-escalation",
+ "persistence"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1546.011",
+ "name": "Application Shimming",
+ "url": "https://attack.mitre.org/techniques/T1546/011",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "privilege-escalation",
+ "persistence"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1546.012",
+ "name": "Image File Execution Options Injection",
+ "url": "https://attack.mitre.org/techniques/T1546/012",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "privilege-escalation",
+ "persistence"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1546.013",
+ "name": "PowerShell Profile",
+ "url": "https://attack.mitre.org/techniques/T1546/013",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "privilege-escalation",
+ "persistence"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1546.014",
+ "name": "Emond",
+ "url": "https://attack.mitre.org/techniques/T1546/014",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "privilege-escalation",
+ "persistence"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1546.015",
+ "name": "Component Object Model Hijacking",
+ "url": "https://attack.mitre.org/techniques/T1546/015",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "privilege-escalation",
+ "persistence"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1546.016",
+ "name": "Installer Packages",
+ "url": "https://attack.mitre.org/techniques/T1546/016",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "privilege-escalation",
+ "persistence"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1546.017",
+ "name": "Udev Rules",
+ "url": "https://attack.mitre.org/techniques/T1546/017",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1546.018",
+ "name": "Python Startup Hooks",
+ "url": "https://attack.mitre.org/techniques/T1546/018",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1547",
+ "name": "Boot or Logon Autostart Execution",
+ "url": "https://attack.mitre.org/techniques/T1547",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1547.001",
+ "name": "Registry Run Keys / Startup Folder",
+ "url": "https://attack.mitre.org/techniques/T1547/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1547.002",
+ "name": "Authentication Package",
+ "url": "https://attack.mitre.org/techniques/T1547/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1547.003",
+ "name": "Time Providers",
+ "url": "https://attack.mitre.org/techniques/T1547/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1547.004",
+ "name": "Winlogon Helper DLL",
+ "url": "https://attack.mitre.org/techniques/T1547/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1547.005",
+ "name": "Security Support Provider",
+ "url": "https://attack.mitre.org/techniques/T1547/005",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1547.006",
+ "name": "Kernel Modules and Extensions",
+ "url": "https://attack.mitre.org/techniques/T1547/006",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1547.007",
+ "name": "Re-opened Applications",
+ "url": "https://attack.mitre.org/techniques/T1547/007",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1547.008",
+ "name": "LSASS Driver",
+ "url": "https://attack.mitre.org/techniques/T1547/008",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1547.009",
+ "name": "Shortcut Modification",
+ "url": "https://attack.mitre.org/techniques/T1547/009",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1547.010",
+ "name": "Port Monitors",
+ "url": "https://attack.mitre.org/techniques/T1547/010",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1547.012",
+ "name": "Print Processors",
+ "url": "https://attack.mitre.org/techniques/T1547/012",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1547.013",
+ "name": "XDG Autostart Entries",
+ "url": "https://attack.mitre.org/techniques/T1547/013",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1547.014",
+ "name": "Active Setup",
+ "url": "https://attack.mitre.org/techniques/T1547/014",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1547.015",
+ "name": "Login Items",
+ "url": "https://attack.mitre.org/techniques/T1547/015",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1548",
+ "name": "Abuse Elevation Control Mechanism",
+ "url": "https://attack.mitre.org/techniques/T1548",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "privilege-escalation"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1548.001",
+ "name": "Setuid and Setgid",
+ "url": "https://attack.mitre.org/techniques/T1548/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1548.002",
+ "name": "Bypass User Account Control",
+ "url": "https://attack.mitre.org/techniques/T1548/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1548.003",
+ "name": "Sudo and Sudo Caching",
+ "url": "https://attack.mitre.org/techniques/T1548/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1548.004",
+ "name": "Elevated Execution with Prompt",
+ "url": "https://attack.mitre.org/techniques/T1548/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1548.005",
+ "name": "Temporary Elevated Cloud Access",
+ "url": "https://attack.mitre.org/techniques/T1548/005",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1548.006",
+ "name": "TCC Manipulation",
+ "url": "https://attack.mitre.org/techniques/T1548/006",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1550",
+ "name": "Use Alternate Authentication Material",
+ "url": "https://attack.mitre.org/techniques/T1550",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "lateral-movement"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1550.001",
+ "name": "Application Access Token",
+ "url": "https://attack.mitre.org/techniques/T1550/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "lateral-movement"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1550.002",
+ "name": "Pass the Hash",
+ "url": "https://attack.mitre.org/techniques/T1550/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "lateral-movement"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1550.003",
+ "name": "Pass the Ticket",
+ "url": "https://attack.mitre.org/techniques/T1550/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "lateral-movement"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1550.004",
+ "name": "Web Session Cookie",
+ "url": "https://attack.mitre.org/techniques/T1550/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "lateral-movement"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1552",
+ "name": "Unsecured Credentials",
+ "url": "https://attack.mitre.org/techniques/T1552",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1552.001",
+ "name": "Credentials In Files",
+ "url": "https://attack.mitre.org/techniques/T1552/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1552.002",
+ "name": "Credentials in Registry",
+ "url": "https://attack.mitre.org/techniques/T1552/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1552.003",
+ "name": "Shell History",
+ "url": "https://attack.mitre.org/techniques/T1552/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1552.004",
+ "name": "Private Keys",
+ "url": "https://attack.mitre.org/techniques/T1552/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1552.005",
+ "name": "Cloud Instance Metadata API",
+ "url": "https://attack.mitre.org/techniques/T1552/005",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1552.006",
+ "name": "Group Policy Preferences",
+ "url": "https://attack.mitre.org/techniques/T1552/006",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1552.007",
+ "name": "Container API",
+ "url": "https://attack.mitre.org/techniques/T1552/007",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1552.008",
+ "name": "Chat Messages",
+ "url": "https://attack.mitre.org/techniques/T1552/008",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1553",
+ "name": "Subvert Trust Controls",
+ "url": "https://attack.mitre.org/techniques/T1553",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1553.001",
+ "name": "Gatekeeper Bypass",
+ "url": "https://attack.mitre.org/techniques/T1553/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1553.002",
+ "name": "Code Signing",
+ "url": "https://attack.mitre.org/techniques/T1553/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1553.003",
+ "name": "SIP and Trust Provider Hijacking",
+ "url": "https://attack.mitre.org/techniques/T1553/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1553.004",
+ "name": "Install Root Certificate",
+ "url": "https://attack.mitre.org/techniques/T1553/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1553.005",
+ "name": "Mark-of-the-Web Bypass",
+ "url": "https://attack.mitre.org/techniques/T1553/005",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1553.006",
+ "name": "Code Signing Policy Modification",
+ "url": "https://attack.mitre.org/techniques/T1553/006",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1554",
+ "name": "Compromise Host Software Binary",
+ "url": "https://attack.mitre.org/techniques/T1554",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1555",
+ "name": "Credentials from Password Stores",
+ "url": "https://attack.mitre.org/techniques/T1555",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1555.001",
+ "name": "Keychain",
+ "url": "https://attack.mitre.org/techniques/T1555/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1555.002",
+ "name": "Securityd Memory",
+ "url": "https://attack.mitre.org/techniques/T1555/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1555.003",
+ "name": "Credentials from Web Browsers",
+ "url": "https://attack.mitre.org/techniques/T1555/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1555.004",
+ "name": "Windows Credential Manager",
+ "url": "https://attack.mitre.org/techniques/T1555/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1555.005",
+ "name": "Password Managers",
+ "url": "https://attack.mitre.org/techniques/T1555/005",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1555.006",
+ "name": "Cloud Secrets Management Stores",
+ "url": "https://attack.mitre.org/techniques/T1555/006",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1556",
+ "name": "Modify Authentication Process",
+ "url": "https://attack.mitre.org/techniques/T1556",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment",
+ "persistence",
+ "credential-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1556.001",
+ "name": "Domain Controller Authentication",
+ "url": "https://attack.mitre.org/techniques/T1556/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment",
+ "persistence",
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1556.002",
+ "name": "Password Filter DLL",
+ "url": "https://attack.mitre.org/techniques/T1556/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment",
+ "persistence",
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1556.003",
+ "name": "Pluggable Authentication Modules",
+ "url": "https://attack.mitre.org/techniques/T1556/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment",
+ "persistence",
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1556.004",
+ "name": "Network Device Authentication",
+ "url": "https://attack.mitre.org/techniques/T1556/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment",
+ "persistence",
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1556.005",
+ "name": "Reversible Encryption",
+ "url": "https://attack.mitre.org/techniques/T1556/005",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment",
+ "persistence",
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1556.006",
+ "name": "Multi-Factor Authentication",
+ "url": "https://attack.mitre.org/techniques/T1556/006",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment",
+ "persistence",
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1556.007",
+ "name": "Hybrid Identity",
+ "url": "https://attack.mitre.org/techniques/T1556/007",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment",
+ "persistence",
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1556.008",
+ "name": "Network Provider DLL",
+ "url": "https://attack.mitre.org/techniques/T1556/008",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment",
+ "persistence",
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1556.009",
+ "name": "Conditional Access Policies",
+ "url": "https://attack.mitre.org/techniques/T1556/009",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment",
+ "persistence",
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1557",
+ "name": "Adversary-in-the-Middle",
+ "url": "https://attack.mitre.org/techniques/T1557",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access",
+ "collection"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1557.001",
+ "name": "Name Resolution Poisoning and SMB Relay",
+ "url": "https://attack.mitre.org/techniques/T1557/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access",
+ "collection"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1557.002",
+ "name": "ARP Cache Poisoning",
+ "url": "https://attack.mitre.org/techniques/T1557/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access",
+ "collection"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1557.003",
+ "name": "DHCP Spoofing",
+ "url": "https://attack.mitre.org/techniques/T1557/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access",
+ "collection"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1557.004",
+ "name": "Evil Twin",
+ "url": "https://attack.mitre.org/techniques/T1557/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access",
+ "collection"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1558",
+ "name": "Steal or Forge Kerberos Tickets",
+ "url": "https://attack.mitre.org/techniques/T1558",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1558.001",
+ "name": "Golden Ticket",
+ "url": "https://attack.mitre.org/techniques/T1558/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1558.002",
+ "name": "Silver Ticket",
+ "url": "https://attack.mitre.org/techniques/T1558/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1558.003",
+ "name": "Kerberoasting",
+ "url": "https://attack.mitre.org/techniques/T1558/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1558.004",
+ "name": "AS-REP Roasting",
+ "url": "https://attack.mitre.org/techniques/T1558/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1558.005",
+ "name": "Ccache Files",
+ "url": "https://attack.mitre.org/techniques/T1558/005",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1559",
+ "name": "Inter-Process Communication",
+ "url": "https://attack.mitre.org/techniques/T1559",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1559.001",
+ "name": "Component Object Model",
+ "url": "https://attack.mitre.org/techniques/T1559/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1559.002",
+ "name": "Dynamic Data Exchange",
+ "url": "https://attack.mitre.org/techniques/T1559/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1559.003",
+ "name": "XPC Services",
+ "url": "https://attack.mitre.org/techniques/T1559/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1560",
+ "name": "Archive Collected Data",
+ "url": "https://attack.mitre.org/techniques/T1560",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1560.001",
+ "name": "Archive via Utility",
+ "url": "https://attack.mitre.org/techniques/T1560/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1560.002",
+ "name": "Archive via Library",
+ "url": "https://attack.mitre.org/techniques/T1560/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1560.003",
+ "name": "Archive via Custom Method",
+ "url": "https://attack.mitre.org/techniques/T1560/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1561",
+ "name": "Disk Wipe",
+ "url": "https://attack.mitre.org/techniques/T1561",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1561.001",
+ "name": "Disk Content Wipe",
+ "url": "https://attack.mitre.org/techniques/T1561/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1561.002",
+ "name": "Disk Structure Wipe",
+ "url": "https://attack.mitre.org/techniques/T1561/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1563",
+ "name": "Remote Service Session Hijacking",
+ "url": "https://attack.mitre.org/techniques/T1563",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "lateral-movement"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1563.001",
+ "name": "SSH Hijacking",
+ "url": "https://attack.mitre.org/techniques/T1563/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "lateral-movement"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1563.002",
+ "name": "RDP Hijacking",
+ "url": "https://attack.mitre.org/techniques/T1563/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "lateral-movement"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1564",
+ "name": "Hide Artifacts",
+ "url": "https://attack.mitre.org/techniques/T1564",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1564.001",
+ "name": "Hidden Files and Directories",
+ "url": "https://attack.mitre.org/techniques/T1564/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1564.002",
+ "name": "Hidden Users",
+ "url": "https://attack.mitre.org/techniques/T1564/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1564.003",
+ "name": "Hidden Window",
+ "url": "https://attack.mitre.org/techniques/T1564/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1564.004",
+ "name": "NTFS File Attributes",
+ "url": "https://attack.mitre.org/techniques/T1564/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1564.005",
+ "name": "Hidden File System",
+ "url": "https://attack.mitre.org/techniques/T1564/005",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1564.006",
+ "name": "Run Virtual Instance",
+ "url": "https://attack.mitre.org/techniques/T1564/006",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1564.007",
+ "name": "VBA Stomping",
+ "url": "https://attack.mitre.org/techniques/T1564/007",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1564.008",
+ "name": "Email Hiding Rules",
+ "url": "https://attack.mitre.org/techniques/T1564/008",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1564.009",
+ "name": "Resource Forking",
+ "url": "https://attack.mitre.org/techniques/T1564/009",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1564.010",
+ "name": "Process Argument Spoofing",
+ "url": "https://attack.mitre.org/techniques/T1564/010",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1564.011",
+ "name": "Ignore Process Interrupts",
+ "url": "https://attack.mitre.org/techniques/T1564/011",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1564.012",
+ "name": "File/Path Exclusions",
+ "url": "https://attack.mitre.org/techniques/T1564/012",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1564.013",
+ "name": "Bind Mounts",
+ "url": "https://attack.mitre.org/techniques/T1564/013",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1564.014",
+ "name": "Extended Attributes",
+ "url": "https://attack.mitre.org/techniques/T1564/014",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1565",
+ "name": "Data Manipulation",
+ "url": "https://attack.mitre.org/techniques/T1565",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1565.001",
+ "name": "Stored Data Manipulation",
+ "url": "https://attack.mitre.org/techniques/T1565/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1565.002",
+ "name": "Transmitted Data Manipulation",
+ "url": "https://attack.mitre.org/techniques/T1565/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1565.003",
+ "name": "Runtime Data Manipulation",
+ "url": "https://attack.mitre.org/techniques/T1565/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1566",
+ "name": "Phishing",
+ "url": "https://attack.mitre.org/techniques/T1566",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "initial-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1566.001",
+ "name": "Spearphishing Attachment",
+ "url": "https://attack.mitre.org/techniques/T1566/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "initial-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1566.002",
+ "name": "Spearphishing Link",
+ "url": "https://attack.mitre.org/techniques/T1566/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "initial-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1566.003",
+ "name": "Spearphishing via Service",
+ "url": "https://attack.mitre.org/techniques/T1566/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "initial-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1566.004",
+ "name": "Spearphishing Voice",
+ "url": "https://attack.mitre.org/techniques/T1566/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "initial-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1567",
+ "name": "Exfiltration Over Web Service",
+ "url": "https://attack.mitre.org/techniques/T1567",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "exfiltration"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1567.001",
+ "name": "Exfiltration to Code Repository",
+ "url": "https://attack.mitre.org/techniques/T1567/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "exfiltration"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1567.002",
+ "name": "Exfiltration to Cloud Storage",
+ "url": "https://attack.mitre.org/techniques/T1567/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "exfiltration"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1567.003",
+ "name": "Exfiltration to Text Storage Sites",
+ "url": "https://attack.mitre.org/techniques/T1567/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "exfiltration"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1567.004",
+ "name": "Exfiltration Over Webhook",
+ "url": "https://attack.mitre.org/techniques/T1567/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "exfiltration"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1568",
+ "name": "Dynamic Resolution",
+ "url": "https://attack.mitre.org/techniques/T1568",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1568.001",
+ "name": "Fast Flux DNS",
+ "url": "https://attack.mitre.org/techniques/T1568/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1568.002",
+ "name": "Domain Generation Algorithms",
+ "url": "https://attack.mitre.org/techniques/T1568/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1568.003",
+ "name": "DNS Calculation",
+ "url": "https://attack.mitre.org/techniques/T1568/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1569",
+ "name": "System Services",
+ "url": "https://attack.mitre.org/techniques/T1569",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1569.001",
+ "name": "Launchctl",
+ "url": "https://attack.mitre.org/techniques/T1569/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1569.002",
+ "name": "Service Execution",
+ "url": "https://attack.mitre.org/techniques/T1569/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1569.003",
+ "name": "Systemctl",
+ "url": "https://attack.mitre.org/techniques/T1569/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1570",
+ "name": "Lateral Tool Transfer",
+ "url": "https://attack.mitre.org/techniques/T1570",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "lateral-movement"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1571",
+ "name": "Non-Standard Port",
+ "url": "https://attack.mitre.org/techniques/T1571",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1572",
+ "name": "Protocol Tunneling",
+ "url": "https://attack.mitre.org/techniques/T1572",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1573",
+ "name": "Encrypted Channel",
+ "url": "https://attack.mitre.org/techniques/T1573",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1573.001",
+ "name": "Symmetric Cryptography",
+ "url": "https://attack.mitre.org/techniques/T1573/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1573.002",
+ "name": "Asymmetric Cryptography",
+ "url": "https://attack.mitre.org/techniques/T1573/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1574",
+ "name": "Hijack Execution Flow",
+ "url": "https://attack.mitre.org/techniques/T1574",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "execution"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1574.001",
+ "name": "DLL",
+ "url": "https://attack.mitre.org/techniques/T1574/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "execution"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1574.004",
+ "name": "Dylib Hijacking",
+ "url": "https://attack.mitre.org/techniques/T1574/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "execution"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1574.005",
+ "name": "Executable Installer File Permissions Weakness",
+ "url": "https://attack.mitre.org/techniques/T1574/005",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "execution"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1574.006",
+ "name": "Dynamic Linker Hijacking",
+ "url": "https://attack.mitre.org/techniques/T1574/006",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "execution"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1574.007",
+ "name": "Path Interception by PATH Environment Variable",
+ "url": "https://attack.mitre.org/techniques/T1574/007",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "execution"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1574.008",
+ "name": "Path Interception by Search Order Hijacking",
+ "url": "https://attack.mitre.org/techniques/T1574/008",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "execution"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1574.009",
+ "name": "Path Interception by Unquoted Path",
+ "url": "https://attack.mitre.org/techniques/T1574/009",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "execution"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1574.010",
+ "name": "Services File Permissions Weakness",
+ "url": "https://attack.mitre.org/techniques/T1574/010",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "execution"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1574.011",
+ "name": "Services Registry Permissions Weakness",
+ "url": "https://attack.mitre.org/techniques/T1574/011",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "execution"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1574.012",
+ "name": "COR_PROFILER",
+ "url": "https://attack.mitre.org/techniques/T1574/012",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "execution"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1574.013",
+ "name": "KernelCallbackTable",
+ "url": "https://attack.mitre.org/techniques/T1574/013",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "execution"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1574.014",
+ "name": "AppDomainManager",
+ "url": "https://attack.mitre.org/techniques/T1574/014",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "execution"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1575",
+ "name": "Native API",
+ "url": "https://attack.mitre.org/techniques/T1575",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "defense-evasion",
+ "execution"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1577",
+ "name": "Compromise Application Executable",
+ "url": "https://attack.mitre.org/techniques/T1577",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "persistence"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1578",
+ "name": "Modify Cloud Compute Infrastructure",
+ "url": "https://attack.mitre.org/techniques/T1578",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1578.001",
+ "name": "Create Snapshot",
+ "url": "https://attack.mitre.org/techniques/T1578/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1578.002",
+ "name": "Create Cloud Instance",
+ "url": "https://attack.mitre.org/techniques/T1578/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1578.003",
+ "name": "Delete Cloud Instance",
+ "url": "https://attack.mitre.org/techniques/T1578/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1578.004",
+ "name": "Revert Cloud Instance",
+ "url": "https://attack.mitre.org/techniques/T1578/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1578.005",
+ "name": "Modify Cloud Compute Configurations",
+ "url": "https://attack.mitre.org/techniques/T1578/005",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1580",
+ "name": "Cloud Infrastructure Discovery",
+ "url": "https://attack.mitre.org/techniques/T1580",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1582",
+ "name": "SMS Control",
+ "url": "https://attack.mitre.org/techniques/T1582",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1583",
+ "name": "Acquire Infrastructure",
+ "url": "https://attack.mitre.org/techniques/T1583",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1583.001",
+ "name": "Domains",
+ "url": "https://attack.mitre.org/techniques/T1583/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1583.002",
+ "name": "DNS Server",
+ "url": "https://attack.mitre.org/techniques/T1583/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1583.003",
+ "name": "Virtual Private Server",
+ "url": "https://attack.mitre.org/techniques/T1583/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1583.004",
+ "name": "Server",
+ "url": "https://attack.mitre.org/techniques/T1583/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1583.005",
+ "name": "Botnet",
+ "url": "https://attack.mitre.org/techniques/T1583/005",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1583.006",
+ "name": "Web Services",
+ "url": "https://attack.mitre.org/techniques/T1583/006",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1583.007",
+ "name": "Serverless",
+ "url": "https://attack.mitre.org/techniques/T1583/007",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1583.008",
+ "name": "Malvertising",
+ "url": "https://attack.mitre.org/techniques/T1583/008",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1584",
+ "name": "Compromise Infrastructure",
+ "url": "https://attack.mitre.org/techniques/T1584",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1584.001",
+ "name": "Domains",
+ "url": "https://attack.mitre.org/techniques/T1584/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1584.002",
+ "name": "DNS Server",
+ "url": "https://attack.mitre.org/techniques/T1584/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1584.003",
+ "name": "Virtual Private Server",
+ "url": "https://attack.mitre.org/techniques/T1584/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1584.004",
+ "name": "Server",
+ "url": "https://attack.mitre.org/techniques/T1584/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1584.005",
+ "name": "Botnet",
+ "url": "https://attack.mitre.org/techniques/T1584/005",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1584.006",
+ "name": "Web Services",
+ "url": "https://attack.mitre.org/techniques/T1584/006",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1584.007",
+ "name": "Serverless",
+ "url": "https://attack.mitre.org/techniques/T1584/007",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1584.008",
+ "name": "Network Devices",
+ "url": "https://attack.mitre.org/techniques/T1584/008",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1585",
+ "name": "Establish Accounts",
+ "url": "https://attack.mitre.org/techniques/T1585",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1585.001",
+ "name": "Social Media Accounts",
+ "url": "https://attack.mitre.org/techniques/T1585/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1585.002",
+ "name": "Email Accounts",
+ "url": "https://attack.mitre.org/techniques/T1585/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1585.003",
+ "name": "Cloud Accounts",
+ "url": "https://attack.mitre.org/techniques/T1585/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1586",
+ "name": "Compromise Accounts",
+ "url": "https://attack.mitre.org/techniques/T1586",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1586.001",
+ "name": "Social Media Accounts",
+ "url": "https://attack.mitre.org/techniques/T1586/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1586.002",
+ "name": "Email Accounts",
+ "url": "https://attack.mitre.org/techniques/T1586/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1586.003",
+ "name": "Cloud Accounts",
+ "url": "https://attack.mitre.org/techniques/T1586/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1587",
+ "name": "Develop Capabilities",
+ "url": "https://attack.mitre.org/techniques/T1587",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1587.001",
+ "name": "Malware",
+ "url": "https://attack.mitre.org/techniques/T1587/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1587.002",
+ "name": "Code Signing Certificates",
+ "url": "https://attack.mitre.org/techniques/T1587/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1587.003",
+ "name": "Digital Certificates",
+ "url": "https://attack.mitre.org/techniques/T1587/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1587.004",
+ "name": "Exploits",
+ "url": "https://attack.mitre.org/techniques/T1587/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1588",
+ "name": "Obtain Capabilities",
+ "url": "https://attack.mitre.org/techniques/T1588",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1588.001",
+ "name": "Malware",
+ "url": "https://attack.mitre.org/techniques/T1588/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1588.002",
+ "name": "Tool",
+ "url": "https://attack.mitre.org/techniques/T1588/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1588.003",
+ "name": "Code Signing Certificates",
+ "url": "https://attack.mitre.org/techniques/T1588/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1588.004",
+ "name": "Digital Certificates",
+ "url": "https://attack.mitre.org/techniques/T1588/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1588.005",
+ "name": "Exploits",
+ "url": "https://attack.mitre.org/techniques/T1588/005",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1588.006",
+ "name": "Vulnerabilities",
+ "url": "https://attack.mitre.org/techniques/T1588/006",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1588.007",
+ "name": "Artificial Intelligence",
+ "url": "https://attack.mitre.org/techniques/T1588/007",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1589",
+ "name": "Gather Victim Identity Information",
+ "url": "https://attack.mitre.org/techniques/T1589",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1589.001",
+ "name": "Credentials",
+ "url": "https://attack.mitre.org/techniques/T1589/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1589.002",
+ "name": "Email Addresses",
+ "url": "https://attack.mitre.org/techniques/T1589/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1589.003",
+ "name": "Employee Names",
+ "url": "https://attack.mitre.org/techniques/T1589/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1590",
+ "name": "Gather Victim Network Information",
+ "url": "https://attack.mitre.org/techniques/T1590",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1590.001",
+ "name": "Domain Properties",
+ "url": "https://attack.mitre.org/techniques/T1590/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1590.002",
+ "name": "DNS",
+ "url": "https://attack.mitre.org/techniques/T1590/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1590.003",
+ "name": "Network Trust Dependencies",
+ "url": "https://attack.mitre.org/techniques/T1590/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1590.004",
+ "name": "Network Topology",
+ "url": "https://attack.mitre.org/techniques/T1590/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1590.005",
+ "name": "IP Addresses",
+ "url": "https://attack.mitre.org/techniques/T1590/005",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1590.006",
+ "name": "Network Security Appliances",
+ "url": "https://attack.mitre.org/techniques/T1590/006",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1591",
+ "name": "Gather Victim Org Information",
+ "url": "https://attack.mitre.org/techniques/T1591",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1591.001",
+ "name": "Determine Physical Locations",
+ "url": "https://attack.mitre.org/techniques/T1591/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1591.002",
+ "name": "Business Relationships",
+ "url": "https://attack.mitre.org/techniques/T1591/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1591.003",
+ "name": "Identify Business Tempo",
+ "url": "https://attack.mitre.org/techniques/T1591/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1591.004",
+ "name": "Identify Roles",
+ "url": "https://attack.mitre.org/techniques/T1591/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1592",
+ "name": "Gather Victim Host Information",
+ "url": "https://attack.mitre.org/techniques/T1592",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1592.001",
+ "name": "Hardware",
+ "url": "https://attack.mitre.org/techniques/T1592/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1592.002",
+ "name": "Software",
+ "url": "https://attack.mitre.org/techniques/T1592/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1592.003",
+ "name": "Firmware",
+ "url": "https://attack.mitre.org/techniques/T1592/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1592.004",
+ "name": "Client Configurations",
+ "url": "https://attack.mitre.org/techniques/T1592/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1593",
+ "name": "Search Open Websites/Domains",
+ "url": "https://attack.mitre.org/techniques/T1593",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1593.001",
+ "name": "Social Media",
+ "url": "https://attack.mitre.org/techniques/T1593/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1593.002",
+ "name": "Search Engines",
+ "url": "https://attack.mitre.org/techniques/T1593/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1593.003",
+ "name": "Code Repositories",
+ "url": "https://attack.mitre.org/techniques/T1593/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1594",
+ "name": "Search Victim-Owned Websites",
+ "url": "https://attack.mitre.org/techniques/T1594",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1595",
+ "name": "Active Scanning",
+ "url": "https://attack.mitre.org/techniques/T1595",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1595.001",
+ "name": "Scanning IP Blocks",
+ "url": "https://attack.mitre.org/techniques/T1595/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1595.002",
+ "name": "Vulnerability Scanning",
+ "url": "https://attack.mitre.org/techniques/T1595/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1595.003",
+ "name": "Wordlist Scanning",
+ "url": "https://attack.mitre.org/techniques/T1595/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1596",
+ "name": "Search Open Technical Databases",
+ "url": "https://attack.mitre.org/techniques/T1596",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1596.001",
+ "name": "DNS/Passive DNS",
+ "url": "https://attack.mitre.org/techniques/T1596/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1596.002",
+ "name": "WHOIS",
+ "url": "https://attack.mitre.org/techniques/T1596/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1596.003",
+ "name": "Digital Certificates",
+ "url": "https://attack.mitre.org/techniques/T1596/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1596.004",
+ "name": "CDNs",
+ "url": "https://attack.mitre.org/techniques/T1596/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1596.005",
+ "name": "Scan Databases",
+ "url": "https://attack.mitre.org/techniques/T1596/005",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1597",
+ "name": "Search Closed Sources",
+ "url": "https://attack.mitre.org/techniques/T1597",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1597.001",
+ "name": "Threat Intel Vendors",
+ "url": "https://attack.mitre.org/techniques/T1597/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1597.002",
+ "name": "Purchase Technical Data",
+ "url": "https://attack.mitre.org/techniques/T1597/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1598",
+ "name": "Phishing for Information",
+ "url": "https://attack.mitre.org/techniques/T1598",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1598.001",
+ "name": "Spearphishing Service",
+ "url": "https://attack.mitre.org/techniques/T1598/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1598.002",
+ "name": "Spearphishing Attachment",
+ "url": "https://attack.mitre.org/techniques/T1598/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1598.003",
+ "name": "Spearphishing Link",
+ "url": "https://attack.mitre.org/techniques/T1598/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1598.004",
+ "name": "Spearphishing Voice",
+ "url": "https://attack.mitre.org/techniques/T1598/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1599",
+ "name": "Network Boundary Bridging",
+ "url": "https://attack.mitre.org/techniques/T1599",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1599.001",
+ "name": "Network Address Translation Traversal",
+ "url": "https://attack.mitre.org/techniques/T1599/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1600",
+ "name": "Weaken Encryption",
+ "url": "https://attack.mitre.org/techniques/T1600",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1600.001",
+ "name": "Reduce Key Space",
+ "url": "https://attack.mitre.org/techniques/T1600/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1600.002",
+ "name": "Disable Crypto Hardware",
+ "url": "https://attack.mitre.org/techniques/T1600/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1601",
+ "name": "Modify System Image",
+ "url": "https://attack.mitre.org/techniques/T1601",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1601.001",
+ "name": "Patch System Image",
+ "url": "https://attack.mitre.org/techniques/T1601/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1601.002",
+ "name": "Downgrade System Image",
+ "url": "https://attack.mitre.org/techniques/T1601/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1602",
+ "name": "Data from Configuration Repository",
+ "url": "https://attack.mitre.org/techniques/T1602",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1602.001",
+ "name": "SNMP (MIB Dump)",
+ "url": "https://attack.mitre.org/techniques/T1602/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1602.002",
+ "name": "Network Device Configuration Dump",
+ "url": "https://attack.mitre.org/techniques/T1602/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1603",
+ "name": "Scheduled Task/Job",
+ "url": "https://attack.mitre.org/techniques/T1603",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "execution",
+ "persistence"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1604",
+ "name": "Proxy Through Victim",
+ "url": "https://attack.mitre.org/techniques/T1604",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "defense-evasion"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1606",
+ "name": "Forge Web Credentials",
+ "url": "https://attack.mitre.org/techniques/T1606",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1606.001",
+ "name": "Web Cookies",
+ "url": "https://attack.mitre.org/techniques/T1606/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1606.002",
+ "name": "SAML Tokens",
+ "url": "https://attack.mitre.org/techniques/T1606/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1608",
+ "name": "Stage Capabilities",
+ "url": "https://attack.mitre.org/techniques/T1608",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1608.001",
+ "name": "Upload Malware",
+ "url": "https://attack.mitre.org/techniques/T1608/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1608.002",
+ "name": "Upload Tool",
+ "url": "https://attack.mitre.org/techniques/T1608/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1608.003",
+ "name": "Install Digital Certificate",
+ "url": "https://attack.mitre.org/techniques/T1608/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1608.004",
+ "name": "Drive-by Target",
+ "url": "https://attack.mitre.org/techniques/T1608/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1608.005",
+ "name": "Link Target",
+ "url": "https://attack.mitre.org/techniques/T1608/005",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1608.006",
+ "name": "SEO Poisoning",
+ "url": "https://attack.mitre.org/techniques/T1608/006",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1609",
+ "name": "Container Administration Command",
+ "url": "https://attack.mitre.org/techniques/T1609",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1610",
+ "name": "Deploy Container",
+ "url": "https://attack.mitre.org/techniques/T1610",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1611",
+ "name": "Escape to Host",
+ "url": "https://attack.mitre.org/techniques/T1611",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "privilege-escalation"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1612",
+ "name": "Build Image on Host",
+ "url": "https://attack.mitre.org/techniques/T1612",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1613",
+ "name": "Container and Resource Discovery",
+ "url": "https://attack.mitre.org/techniques/T1613",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1614",
+ "name": "System Location Discovery",
+ "url": "https://attack.mitre.org/techniques/T1614",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1614.001",
+ "name": "System Language Discovery",
+ "url": "https://attack.mitre.org/techniques/T1614/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1615",
+ "name": "Group Policy Discovery",
+ "url": "https://attack.mitre.org/techniques/T1615",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1616",
+ "name": "Call Control",
+ "url": "https://attack.mitre.org/techniques/T1616",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "collection",
+ "impact",
+ "command-and-control"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1617",
+ "name": "Hooking",
+ "url": "https://attack.mitre.org/techniques/T1617",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "defense-evasion"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1619",
+ "name": "Cloud Storage Object Discovery",
+ "url": "https://attack.mitre.org/techniques/T1619",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1620",
+ "name": "Reflective Code Loading",
+ "url": "https://attack.mitre.org/techniques/T1620",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1621",
+ "name": "Multi-Factor Authentication Request Generation",
+ "url": "https://attack.mitre.org/techniques/T1621",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1622",
+ "name": "Debugger Evasion",
+ "url": "https://attack.mitre.org/techniques/T1622",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth",
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1623",
+ "name": "Command and Scripting Interpreter",
+ "url": "https://attack.mitre.org/techniques/T1623",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1623.001",
+ "name": "Unix Shell",
+ "url": "https://attack.mitre.org/techniques/T1623/001",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1624",
+ "name": "Event Triggered Execution",
+ "url": "https://attack.mitre.org/techniques/T1624",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "persistence"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1624.001",
+ "name": "Broadcast Receivers",
+ "url": "https://attack.mitre.org/techniques/T1624/001",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "persistence"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1625",
+ "name": "Hijack Execution Flow",
+ "url": "https://attack.mitre.org/techniques/T1625",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "persistence"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1625.001",
+ "name": "System Runtime API Hijacking",
+ "url": "https://attack.mitre.org/techniques/T1625/001",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "persistence"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1626",
+ "name": "Abuse Elevation Control Mechanism",
+ "url": "https://attack.mitre.org/techniques/T1626",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "privilege-escalation"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1626.001",
+ "name": "Device Administrator Permissions",
+ "url": "https://attack.mitre.org/techniques/T1626/001",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1627",
+ "name": "Execution Guardrails",
+ "url": "https://attack.mitre.org/techniques/T1627",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "defense-evasion"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1627.001",
+ "name": "Geofencing",
+ "url": "https://attack.mitre.org/techniques/T1627/001",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "defense-evasion"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1628",
+ "name": "Hide Artifacts",
+ "url": "https://attack.mitre.org/techniques/T1628",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "defense-evasion"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1628.001",
+ "name": "Suppress Application Icon",
+ "url": "https://attack.mitre.org/techniques/T1628/001",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "defense-evasion"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1628.002",
+ "name": "User Evasion",
+ "url": "https://attack.mitre.org/techniques/T1628/002",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "defense-evasion"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1628.003",
+ "name": "Conceal Multimedia Files",
+ "url": "https://attack.mitre.org/techniques/T1628/003",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "defense-evasion"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1629",
+ "name": "Impair Defenses",
+ "url": "https://attack.mitre.org/techniques/T1629",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "defense-evasion"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1629.001",
+ "name": "Prevent Application Removal",
+ "url": "https://attack.mitre.org/techniques/T1629/001",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "defense-evasion"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1629.002",
+ "name": "Device Lockout",
+ "url": "https://attack.mitre.org/techniques/T1629/002",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "defense-evasion"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1629.003",
+ "name": "Disable or Modify Tools",
+ "url": "https://attack.mitre.org/techniques/T1629/003",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "defense-evasion"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1630",
+ "name": "Indicator Removal on Host",
+ "url": "https://attack.mitre.org/techniques/T1630",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "defense-evasion"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1630.001",
+ "name": "Uninstall Malicious Application",
+ "url": "https://attack.mitre.org/techniques/T1630/001",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "defense-evasion"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1630.002",
+ "name": "File Deletion",
+ "url": "https://attack.mitre.org/techniques/T1630/002",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "defense-evasion"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1630.003",
+ "name": "Disguise Root/Jailbreak Indicators",
+ "url": "https://attack.mitre.org/techniques/T1630/003",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "defense-evasion"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1631",
+ "name": "Process Injection",
+ "url": "https://attack.mitre.org/techniques/T1631",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "defense-evasion",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1631.001",
+ "name": "Ptrace System Calls",
+ "url": "https://attack.mitre.org/techniques/T1631/001",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "defense-evasion",
+ "privilege-escalation"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1632",
+ "name": "Subvert Trust Controls",
+ "url": "https://attack.mitre.org/techniques/T1632",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "defense-evasion"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1632.001",
+ "name": "Code Signing Policy Modification",
+ "url": "https://attack.mitre.org/techniques/T1632/001",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "defense-evasion"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1633",
+ "name": "Virtualization/Sandbox Evasion",
+ "url": "https://attack.mitre.org/techniques/T1633",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "defense-evasion"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1633.001",
+ "name": "System Checks",
+ "url": "https://attack.mitre.org/techniques/T1633/001",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "defense-evasion"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1634",
+ "name": "Credentials from Password Store",
+ "url": "https://attack.mitre.org/techniques/T1634",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1634.001",
+ "name": "Keychain",
+ "url": "https://attack.mitre.org/techniques/T1634/001",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1635",
+ "name": "Steal Application Access Token",
+ "url": "https://attack.mitre.org/techniques/T1635",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1635.001",
+ "name": "URI Hijacking",
+ "url": "https://attack.mitre.org/techniques/T1635/001",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1636",
+ "name": "Protected User Data",
+ "url": "https://attack.mitre.org/techniques/T1636",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1636.001",
+ "name": "Calendar Entries",
+ "url": "https://attack.mitre.org/techniques/T1636/001",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1636.002",
+ "name": "Call Log",
+ "url": "https://attack.mitre.org/techniques/T1636/002",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1636.003",
+ "name": "Contact List",
+ "url": "https://attack.mitre.org/techniques/T1636/003",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1636.004",
+ "name": "SMS Messages",
+ "url": "https://attack.mitre.org/techniques/T1636/004",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1636.005",
+ "name": "Accounts",
+ "url": "https://attack.mitre.org/techniques/T1636/005",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1637",
+ "name": "Dynamic Resolution",
+ "url": "https://attack.mitre.org/techniques/T1637",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1637.001",
+ "name": "Domain Generation Algorithms",
+ "url": "https://attack.mitre.org/techniques/T1637/001",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1638",
+ "name": "Adversary-in-the-Middle",
+ "url": "https://attack.mitre.org/techniques/T1638",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "collection"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1639",
+ "name": "Exfiltration Over Alternative Protocol",
+ "url": "https://attack.mitre.org/techniques/T1639",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "exfiltration"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1639.001",
+ "name": "Exfiltration Over Unencrypted Non-C2 Protocol",
+ "url": "https://attack.mitre.org/techniques/T1639/001",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "exfiltration"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1640",
+ "name": "Account Access Removal",
+ "url": "https://attack.mitre.org/techniques/T1640",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1641",
+ "name": "Data Manipulation",
+ "url": "https://attack.mitre.org/techniques/T1641",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1641.001",
+ "name": "Transmitted Data Manipulation",
+ "url": "https://attack.mitre.org/techniques/T1641/001",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1642",
+ "name": "Endpoint Denial of Service",
+ "url": "https://attack.mitre.org/techniques/T1642",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1643",
+ "name": "Generate Traffic from Victim",
+ "url": "https://attack.mitre.org/techniques/T1643",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1644",
+ "name": "Out of Band Data",
+ "url": "https://attack.mitre.org/techniques/T1644",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1645",
+ "name": "Compromise Client Software Binary",
+ "url": "https://attack.mitre.org/techniques/T1645",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "persistence"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1646",
+ "name": "Exfiltration Over C2 Channel",
+ "url": "https://attack.mitre.org/techniques/T1646",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "exfiltration"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1647",
+ "name": "Plist File Modification",
+ "url": "https://attack.mitre.org/techniques/T1647",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1648",
+ "name": "Serverless Execution",
+ "url": "https://attack.mitre.org/techniques/T1648",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1649",
+ "name": "Steal or Forge Authentication Certificates",
+ "url": "https://attack.mitre.org/techniques/T1649",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "credential-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1650",
+ "name": "Acquire Access",
+ "url": "https://attack.mitre.org/techniques/T1650",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1651",
+ "name": "Cloud Administration Command",
+ "url": "https://attack.mitre.org/techniques/T1651",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1652",
+ "name": "Device Driver Discovery",
+ "url": "https://attack.mitre.org/techniques/T1652",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1653",
+ "name": "Power Settings",
+ "url": "https://attack.mitre.org/techniques/T1653",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1654",
+ "name": "Log Enumeration",
+ "url": "https://attack.mitre.org/techniques/T1654",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1655",
+ "name": "Masquerading",
+ "url": "https://attack.mitre.org/techniques/T1655",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "defense-evasion"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1655.001",
+ "name": "Match Legitimate Name or Location",
+ "url": "https://attack.mitre.org/techniques/T1655/001",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "defense-evasion"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1657",
+ "name": "Financial Theft",
+ "url": "https://attack.mitre.org/techniques/T1657",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1658",
+ "name": "Exploitation for Client Execution",
+ "url": "https://attack.mitre.org/techniques/T1658",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1659",
+ "name": "Content Injection",
+ "url": "https://attack.mitre.org/techniques/T1659",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "initial-access",
+ "command-and-control"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1660",
+ "name": "Phishing",
+ "url": "https://attack.mitre.org/techniques/T1660",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "initial-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1661",
+ "name": "Application Versioning",
+ "url": "https://attack.mitre.org/techniques/T1661",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "initial-access",
+ "defense-evasion"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1662",
+ "name": "Data Destruction",
+ "url": "https://attack.mitre.org/techniques/T1662",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1663",
+ "name": "Remote Access Software",
+ "url": "https://attack.mitre.org/techniques/T1663",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1664",
+ "name": "Exploitation for Initial Access",
+ "url": "https://attack.mitre.org/techniques/T1664",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "initial-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1665",
+ "name": "Hide Infrastructure",
+ "url": "https://attack.mitre.org/techniques/T1665",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "command-and-control"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1666",
+ "name": "Modify Cloud Resource Hierarchy",
+ "url": "https://attack.mitre.org/techniques/T1666",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1667",
+ "name": "Email Bombing",
+ "url": "https://attack.mitre.org/techniques/T1667",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "impact"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1668",
+ "name": "Exclusive Control",
+ "url": "https://attack.mitre.org/techniques/T1668",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1669",
+ "name": "Wi-Fi Networks",
+ "url": "https://attack.mitre.org/techniques/T1669",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "initial-access"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1670",
+ "name": "Virtualization Solution",
+ "url": "https://attack.mitre.org/techniques/T1670",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "defense-evasion"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1671",
+ "name": "Cloud Application Integration",
+ "url": "https://attack.mitre.org/techniques/T1671",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "persistence"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1673",
+ "name": "Virtual Machine Discovery",
+ "url": "https://attack.mitre.org/techniques/T1673",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1674",
+ "name": "Input Injection",
+ "url": "https://attack.mitre.org/techniques/T1674",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1675",
+ "name": "ESXi Administration Command",
+ "url": "https://attack.mitre.org/techniques/T1675",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1676",
+ "name": "Linked Devices",
+ "url": "https://attack.mitre.org/techniques/T1676",
+ "domains": [
+ "mobile"
+ ],
+ "tactics": [
+ "collection",
+ "persistence"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1677",
+ "name": "Poisoned Pipeline Execution",
+ "url": "https://attack.mitre.org/techniques/T1677",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "execution"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1678",
+ "name": "Delay Execution",
+ "url": "https://attack.mitre.org/techniques/T1678",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1679",
+ "name": "Selective Exclusion",
+ "url": "https://attack.mitre.org/techniques/T1679",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1680",
+ "name": "Local Storage Discovery",
+ "url": "https://attack.mitre.org/techniques/T1680",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "discovery"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1681",
+ "name": "Search Threat Vendor Data",
+ "url": "https://attack.mitre.org/techniques/T1681",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1682",
+ "name": "Query Public AI Services",
+ "url": "https://attack.mitre.org/techniques/T1682",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "reconnaissance"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1683",
+ "name": "Generate Content",
+ "url": "https://attack.mitre.org/techniques/T1683",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1683.001",
+ "name": "Written Content",
+ "url": "https://attack.mitre.org/techniques/T1683/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1683.002",
+ "name": "Audio-Visual Content",
+ "url": "https://attack.mitre.org/techniques/T1683/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "resource-development"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1684",
+ "name": "Social Engineering",
+ "url": "https://attack.mitre.org/techniques/T1684",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1684.001",
+ "name": "Impersonation",
+ "url": "https://attack.mitre.org/techniques/T1684/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1684.002",
+ "name": "Email Spoofing",
+ "url": "https://attack.mitre.org/techniques/T1684/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "stealth"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1685",
+ "name": "Disable or Modify Tools",
+ "url": "https://attack.mitre.org/techniques/T1685",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1685.001",
+ "name": "Disable or Modify Windows Event Log",
+ "url": "https://attack.mitre.org/techniques/T1685/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1685.002",
+ "name": "Disable or Modify Cloud Log",
+ "url": "https://attack.mitre.org/techniques/T1685/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1685.003",
+ "name": "Modify or Spoof Tool UI",
+ "url": "https://attack.mitre.org/techniques/T1685/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1685.004",
+ "name": "Disable or Modify Linux Audit System Log",
+ "url": "https://attack.mitre.org/techniques/T1685/004",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1685.005",
+ "name": "Clear Windows Event Logs",
+ "url": "https://attack.mitre.org/techniques/T1685/005",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1685.006",
+ "name": "Clear Linux or Mac System Logs",
+ "url": "https://attack.mitre.org/techniques/T1685/006",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1686",
+ "name": "Disable or Modify System Firewall",
+ "url": "https://attack.mitre.org/techniques/T1686",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1686.001",
+ "name": "Cloud Firewall",
+ "url": "https://attack.mitre.org/techniques/T1686/001",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1686.002",
+ "name": "Network Device Firewall",
+ "url": "https://attack.mitre.org/techniques/T1686/002",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1686.003",
+ "name": "Windows Host Firewall",
+ "url": "https://attack.mitre.org/techniques/T1686/003",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1687",
+ "name": "Exploitation for Defense Impairment",
+ "url": "https://attack.mitre.org/techniques/T1687",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1688",
+ "name": "Safe Mode Boot",
+ "url": "https://attack.mitre.org/techniques/T1688",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1689",
+ "name": "Downgrade Attack",
+ "url": "https://attack.mitre.org/techniques/T1689",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1690",
+ "name": "Prevent Command History Logging",
+ "url": "https://attack.mitre.org/techniques/T1690",
+ "domains": [
+ "enterprise"
+ ],
+ "tactics": [
+ "defense-impairment"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1691",
+ "name": "Block Operational Technology Message",
+ "url": "https://attack.mitre.org/techniques/T1691",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "inhibit-response-function"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1691.001",
+ "name": "Command Message",
+ "url": "https://attack.mitre.org/techniques/T1691/001",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "inhibit-response-function"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1691.002",
+ "name": "Reporting Message",
+ "url": "https://attack.mitre.org/techniques/T1691/002",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "inhibit-response-function"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1692",
+ "name": "Unauthorized Message",
+ "url": "https://attack.mitre.org/techniques/T1692",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "evasion",
+ "impair-process-control"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1692.001",
+ "name": "Command Message",
+ "url": "https://attack.mitre.org/techniques/T1692/001",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "evasion",
+ "impair-process-control"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1692.002",
+ "name": "Reporting Message",
+ "url": "https://attack.mitre.org/techniques/T1692/002",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "evasion",
+ "impair-process-control"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1693",
+ "name": "Modify Firmware",
+ "url": "https://attack.mitre.org/techniques/T1693",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "persistence",
+ "inhibit-response-function",
+ "impair-process-control"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1693.001",
+ "name": "System Firmware",
+ "url": "https://attack.mitre.org/techniques/T1693/001",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "persistence",
+ "inhibit-response-function",
+ "impair-process-control"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1693.002",
+ "name": "Module Firmware",
+ "url": "https://attack.mitre.org/techniques/T1693/002",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "persistence",
+ "inhibit-response-function",
+ "impair-process-control"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1694",
+ "name": "Insecure Credentials",
+ "url": "https://attack.mitre.org/techniques/T1694",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "persistence",
+ "lateral-movement"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1694.001",
+ "name": "Default Credentials",
+ "url": "https://attack.mitre.org/techniques/T1694/001",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "persistence",
+ "lateral-movement"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1694.002",
+ "name": "Hardcoded Credentials",
+ "url": "https://attack.mitre.org/techniques/T1694/002",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "persistence",
+ "lateral-movement"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1695",
+ "name": "Block Communications",
+ "url": "https://attack.mitre.org/techniques/T1695",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "inhibit-response-function"
+ ],
+ "isSubtechnique": false
+ },
+ {
+ "id": "T1695.001",
+ "name": "Serial COM",
+ "url": "https://attack.mitre.org/techniques/T1695/001",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "inhibit-response-function"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1695.002",
+ "name": "Ethernet",
+ "url": "https://attack.mitre.org/techniques/T1695/002",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "inhibit-response-function"
+ ],
+ "isSubtechnique": true
+ },
+ {
+ "id": "T1695.003",
+ "name": "Wi-Fi",
+ "url": "https://attack.mitre.org/techniques/T1695/003",
+ "domains": [
+ "ics"
+ ],
+ "tactics": [
+ "inhibit-response-function"
+ ],
+ "isSubtechnique": true
+ }
+ ]
+}
diff --git a/app/playbooks/network/pb-dns-attacks.json b/app/playbooks/network/pb-dns-attacks.json
new file mode 100644
index 0000000..5f53dce
--- /dev/null
+++ b/app/playbooks/network/pb-dns-attacks.json
@@ -0,0 +1,212 @@
+{
+ "id": "pb-dns",
+ "num": 37,
+ "name": "DNS Attacks",
+ "fullName": "DNS Attacks (Tunnelling, DGA, Amplification)",
+ "type": "Network – DNS Abuse",
+ "severity": "Medium to High",
+ "priority": "High",
+ "detection": "sourcetype=dns, sourcetype=firewall, sourcetype=netflow",
+ "scenario": "DNS-based attack patterns including tunnelling for C2/exfiltration, DGA/fast-flux for malware C2, and DNS amplification for DDoS.",
+ "mitre": "T1071.004, T1048.003, T1568.002, T1498",
+ "tools": "",
+ "sev": "high",
+ "cat": "Network",
+ "source": "library",
+ "detSteps": [
+ {
+ "title": "Look for high query volume per domain from a single host",
+ "detail": "Threshold typically >300 queries/hour. Look for single internal hosts making abnormally high numbers of queries to a single external domain.",
+ "queries": {
+ "splunk": "index=network sourcetype=dns | stats count by src_ip, query | where count > 300 | sort -count",
+ "kql": null,
+ "qradar": null,
+ "sigma": null,
+ "velociraptor": "SELECT Laddr, Lport, Raddr, Rport, State, Pid, Name, Ctime FROM netstat() WHERE Rport IN (22,53,80,443,8080,8443) AND Name =~ '(?i)(powershell|cmd|wscript|cscript|rundll32|mshta|curl|wget)' ORDER BY Ctime DESC LIMIT 200",
+ "carbon_black": "netconn_count:[10 TO *] AND NOT (process_name:chrome.exe OR process_name:msedge.exe OR process_name:firefox.exe OR process_name:outlook.exe OR process_name:teams.exe OR process_name:OneDrive.exe)",
+ "sysmon": "powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe . powershell.exe . powershell.exe . powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe . powershell.exe . powershell.exe . powershell.exe . \\\\Run\\\\;\\\\RunOnce\\\\;\\\\Policies\\\\Explorer\\\\Run powershell.exe . powershell.exe . powershell.exe . 21;22;23;25;53;80;110;139;143;389;443;445;3389;8080;8443 nmap;masscan;zmap;scanner arpspoof;ettercap;bettercap;mitmf;responder '\n| where TimeGenerated > ago(24h)\n| summarize Events=count(), EventTypes=make_set(DeviceEventClassID) by SourceIP, SourceMACAddress, DeviceVendor\n| order by Events desc",
+ "qradar": "SELECT sourceip, \"Source MAC\" as mac, username, QIDNAME(qid) as event, starttime FROM events WHERE sourceip = '' ORDER BY starttime DESC LAST 24 HOURS",
+ "sigma": null,
+ "velociraptor": "SELECT InterfaceName, HardwareAddress, IPAddress, MTU\nFROM interfaces()\nUNION ALL\nSELECT * FROM execve(argv=['ipconfig', '/all'])",
+ "carbon_black": "hostname: AND netconn_count:[1 TO *]",
+ "sysmon": null
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Isolate the rogue device at the network switch level",
+ "detail": "Work with network engineering to shut down or VLAN-isolate the switch port associated with the rogue host. If the device is wireless, deauthenticate it and block its MAC on the wireless controller. Apply a firewall ACL to block all traffic from the source IP. If the host is a known asset that appears compromised, trigger the standard endpoint isolation procedure.",
+ "queries": {
+ "splunk": "index=network sourcetype=firewall src_ip=[rogue_ip] | timechart count span=5m",
+ "kql": "CommonSecurityLog\n| where SourceIP == ''\n| where TimeGenerated > ago(4h)\n| summarize TrafficVolume=count() by bin(TimeGenerated, 5m), SourceIP, DestinationIP\n| order by TimeGenerated desc",
+ "qradar": "SELECT destinationip, destinationport, sum(eventcount) as total FROM events WHERE sourceip = '' GROUP BY destinationip, destinationport ORDER BY total DESC LAST 2 HOURS",
+ "sigma": null,
+ "velociraptor": null,
+ "carbon_black": "hostname: AND netconn_count:[1 TO *]",
+ "sysmon": null
+ }
+ },
+ {
+ "title": "Flush ARP caches on affected network segments",
+ "detail": "Coordinate with server and workstation teams to flush ARP caches on all hosts in the affected VLAN. On Windows hosts, run 'arp -d *'. On network equipment, clear dynamic ARP entries. Enable Dynamic ARP Inspection (DAI) on the affected VLAN if not already configured. On managed switches, review and lock down port-to-MAC mappings.",
+ "queries": {
+ "splunk": "index=network sourcetype=zeek_arp | stats dc(mac) as mac_count values(mac) as macs by ip | where mac_count > 1",
+ "kql": "CommonSecurityLog\n| where Activity contains 'ARP'\n| where TimeGenerated > ago(2h)\n| summarize count() by SourceIP, DestinationIP\n| order by count_ desc",
+ "qradar": "SELECT sourceip, destinationip, QIDNAME(qid) as event FROM events WHERE QIDNAME(qid) ILIKE '%ARP%' ORDER BY starttime DESC LAST 2 HOURS",
+ "sigma": null,
+ "velociraptor": "SELECT * FROM execve(argv=['arp', '-a'])",
+ "carbon_black": null,
+ "sysmon": null
+ }
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove attacker tooling from compromised host",
+ "detail": "If the scanning or ARP spoofing originated from a compromised internal host, run the full endpoint investigation and remove any network attack tools (nmap, Responder, Bettercap, Ettercap, arpspoof). Check for persistence via scheduled tasks, services, or startup items. Re-image if the scope of compromise is unclear.",
+ "queries": {
+ "splunk": "index=wineventlog EventCode=4688 ComputerName=[compromised_host] | search NewProcessName IN (\"*nmap*\",\"*responder*\",\"*bettercap*\",\"*ettercap*\",\"*arpspoof*\") | table _time, AccountName, NewProcessName, CommandLine",
+ "kql": "DeviceProcessEvents\n| where DeviceName =~ ''\n| where FileName in~ ('nmap','nmap.exe','responder','bettercap','ettercap','arpspoof')\n| project TimeGenerated, FileName, ProcessCommandLine, AccountName\n| order by TimeGenerated desc",
+ "qradar": "SELECT sourceip, \"Process Name\" as process, \"Command Line\" as cmdline FROM events WHERE sourceip = '' AND (\"Process Name\" ILIKE '%nmap%' OR \"Process Name\" ILIKE '%responder%' OR \"Process Name\" ILIKE '%ettercap%') ORDER BY starttime DESC LAST 24 HOURS",
+ "sigma": null,
+ "velociraptor": "SELECT FullPath, Size, Mtime, hash(path=FullPath) as Hash\nFROM glob(globs=['C:/Users/*/Desktop/*', 'C:/Users/*/Downloads/*', 'C:/ProgramData/*'])\nWHERE FullPath =~ '(?i)(nmap|responder|bettercap|ettercap|arpspoof|masscan)'\nORDER BY Mtime DESC",
+ "carbon_black": "hostname: AND (process_name:nmap.exe OR process_name:responder.exe OR process_name:bettercap OR cmdline:arpspoof)",
+ "sysmon": "nmap;responder;bettercap;ettercap;arpspoof;masscan powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 lsass.exe 0x1fffff;0x1010 powershell.exe . powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe lsass.exe 0x1fffff;0x1010 lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;wscript.exe;cscript.exe lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe lsass.exe 0x1fffff;0x1010 kernel32.dll;ntdll.dll powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe \\\\Run\\\\;\\\\RunOnce\\\\;\\\\Policies\\\\Explorer\\\\Run powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe 135;139;445;3389 powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 \\\\Run\\\\;\\\\RunOnce\\\\;\\\\Policies\\\\Explorer\\\\Run \\\\Run\\\\;\\\\RunOnce\\\\;\\\\Policies\\\\Explorer\\\\Run powershell.exe;cmd.exe;wscript.exe;cscript.exe \\\\Run\\\\;\\\\RunOnce\\\\;\\\\Policies\\\\Explorer\\\\Run powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 kernel32.dll;ntdll.dll powershell.exe -enc;-nop;IEX;DownloadString lsass.exe 0x1fffff;0x1010 kernel32.dll;ntdll.dll lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe -enc;-nop;IEX;DownloadString powershell.exe -enc;-nop;IEX;DownloadString powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 powershell.exe;cmd.exe;curl.exe;rclone.exe 53;80;443;8080;8443 lsass.exe 0x1fffff;0x1010 powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe .locked;.encrypted;.crypt;README powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe powershell.exe;cmd.exe;wscript.exe;cscript.exe \n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Axiom (G0001) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1189 OR T1190 OR T1566 OR T1203 OR T1546.008 OR T1003 OR T1021.001 OR T1563.002 OR T1005 OR T1560 OR T1001.002 OR T1553 OR T1583.002 OR T1583.003 OR T1584.005) OR threat.technique.id:(T1078 OR T1189 OR T1190 OR T1566 OR T1203 OR T1546.008 OR T1003 OR T1021.001 OR T1563.002 OR T1005 OR T1560 OR T1001.002 OR T1553 OR T1583.002 OR T1583.003 OR T1584.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Axiom with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1189 OR T1190 OR T1566 OR T1203 OR T1546.008 OR T1003 OR T1021.001 OR T1563.002 OR T1005 OR T1560 OR T1001.002 OR T1553 OR T1583.002 OR T1583.003 OR T1584.005) OR threat.technique.id:(T1078 OR T1189 OR T1190 OR T1566 OR T1203 OR T1546.008 OR T1003 OR T1021.001 OR T1563.002 OR T1005 OR T1560 OR T1001.002 OR T1553 OR T1583.002 OR T1583.003 OR T1584.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566\"\n[[rule.threat.technique]]\nid = \"T1203\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566\"\n[[rule.threat.technique]]\nid = \"T1203\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566\"\n[[rule.threat.technique]]\nid = \"T1203\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566\"\n[[rule.threat.technique]]\nid = \"T1203\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0002-moafee.json b/app/playbooks/threat-groups/apt-g0002-moafee.json
new file mode 100644
index 0000000..efffd74
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0002-moafee.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0002",
+ "num": 44,
+ "name": "MITRE ATT&CK Group — Moafee",
+ "fullName": "Moafee (G0002) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Moafee](https://attack.mitre.org/groups/G0002) is a threat group that appears to operate from the Guandong Province of China. Due to overlapping TTPs, including similar custom tools, Moafee is thought to have a direct or indirect relationship with the threat group [DragonOK](https://attack.mitre.org/groups/G0017). This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Moafee.",
+ "mitre": "T1027.001",
+ "aliases": [
+ "Moafee"
+ ],
+ "mitreGroupId": "G0002",
+ "mitreUrl": "https://attack.mitre.org/groups/G0002",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Moafee with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0002. Aliases: Moafee. Primary mapped tactics: Stealth. Mapped techniques: T1027.001 Binary Padding. Source: https://attack.mitre.org/groups/G0002. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Moafee (G0002) ATT&CK technique pivots\n(rule.threat.technique.id:(T1027.001) OR threat.technique.id:(T1027.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Moafee (G0002) ATT&CK technique pivots\n(rule.threat.technique.id:(T1027.001) OR threat.technique.id:(T1027.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Moafee with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1027.001) OR threat.technique.id:(T1027.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1027.001\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1027.001\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1027.001\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1027.001\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0003-cleaver.json b/app/playbooks/threat-groups/apt-g0003-cleaver.json
new file mode 100644
index 0000000..662258b
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0003-cleaver.json
@@ -0,0 +1,118 @@
+{
+ "id": "apt-g0003",
+ "num": 45,
+ "name": "MITRE ATT&CK Group — Cleaver",
+ "fullName": "Cleaver (G0003) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Cleaver](https://attack.mitre.org/groups/G0003) is a threat group that has been attributed to Iranian actors and is responsible for activity tracked as Operation Cleaver. Strong circumstantial evidence suggests Cleaver is linked to Threat Group 2889 (TG-2889). This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Cleaver.",
+ "mitre": "T1003.001, T1557.002, T1585.001, T1587.001, T1588.002",
+ "aliases": [
+ "Cleaver",
+ "Threat Group 2889",
+ "TG-2889"
+ ],
+ "mitreGroupId": "G0003",
+ "mitreUrl": "https://attack.mitre.org/groups/G0003",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Cleaver with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0003. Aliases: Cleaver, Threat Group 2889, TG-2889. Primary mapped tactics: Credential Access, Collection, Resource Development. Mapped techniques: T1003.001 LSASS Memory, T1557.002 ARP Cache Poisoning, T1585.001 Social Media Accounts, T1587.001 Malware, T1588.002 Tool. Source: https://attack.mitre.org/groups/G0003. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Cleaver (G0003) ATT&CK technique pivots\n(rule.threat.technique.id:(T1003.001 OR T1557.002 OR T1585.001 OR T1587.001 OR T1588.002) OR threat.technique.id:(T1003.001 OR T1557.002 OR T1585.001 OR T1587.001 OR T1588.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Cleaver (G0003) ATT&CK technique pivots\n(rule.threat.technique.id:(T1003.001 OR T1557.002 OR T1585.001 OR T1587.001 OR T1588.002) OR threat.technique.id:(T1003.001 OR T1557.002 OR T1585.001 OR T1587.001 OR T1588.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Cleaver with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1003.001 OR T1557.002 OR T1585.001 OR T1587.001 OR T1588.002) OR threat.technique.id:(T1003.001 OR T1557.002 OR T1585.001 OR T1587.001 OR T1588.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1003.001\"\n[[rule.threat.technique]]\nid = \"T1557.002\"\n[[rule.threat.technique]]\nid = \"T1585.001\"\n[[rule.threat.technique]]\nid = \"T1587.001\"\n[[rule.threat.technique]]\nid = \"T1588.002\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1003.001\"\n[[rule.threat.technique]]\nid = \"T1557.002\"\n[[rule.threat.technique]]\nid = \"T1585.001\"\n[[rule.threat.technique]]\nid = \"T1587.001\"\n[[rule.threat.technique]]\nid = \"T1588.002\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1003.001\"\n[[rule.threat.technique]]\nid = \"T1557.002\"\n[[rule.threat.technique]]\nid = \"T1585.001\"\n[[rule.threat.technique]]\nid = \"T1587.001\"\n[[rule.threat.technique]]\nid = \"T1588.002\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1003.001\"\n[[rule.threat.technique]]\nid = \"T1557.002\"\n[[rule.threat.technique]]\nid = \"T1585.001\"\n[[rule.threat.technique]]\nid = \"T1587.001\"\n[[rule.threat.technique]]\nid = \"T1588.002\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0004-ke3chang.json b/app/playbooks/threat-groups/apt-g0004-ke3chang.json
new file mode 100644
index 0000000..a395e61
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0004-ke3chang.json
@@ -0,0 +1,124 @@
+{
+ "id": "apt-g0004",
+ "num": 46,
+ "name": "MITRE ATT&CK Group — Ke3chang",
+ "fullName": "Ke3chang (G0004) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Ke3chang](https://attack.mitre.org/groups/G0004) is a threat group attributed to actors operating out of China. [Ke3chang](https://attack.mitre.org/groups/G0004) has targeted oil, government, diplomatic, military, and NGOs in Central and South America, the Caribbean, Europe, and North America since at least 2010. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Ke3chang.",
+ "mitre": "T1078, T1078.004, T1133, T1190, T1059, T1059.003, T1569.002, T1543.003, T1547.001, T1003.001, T1003.002, T1003.003, T1003.004, T1056.001, T1558.001, T1007, T1016, T1018, T1033, T1049, T1057, T1069.002, T1082, T1083",
+ "aliases": [
+ "Ke3chang",
+ "APT15",
+ "Mirage",
+ "Vixen Panda",
+ "GREF",
+ "Playful Dragon",
+ "RoyalAPT",
+ "NICKEL",
+ "Nylon Typhoon"
+ ],
+ "mitreGroupId": "G0004",
+ "mitreUrl": "https://attack.mitre.org/groups/G0004",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Ke3chang with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0004. Aliases: Ke3chang, APT15, Mirage, Vixen Panda, GREF, Playful Dragon, RoyalAPT, NICKEL, Nylon Typhoon. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Resource Development, Stealth. Mapped techniques: T1078 Valid Accounts, T1078.004 Cloud Accounts, T1133 External Remote Services, T1190 Exploit Public-Facing Application, T1059 Command and Scripting Interpreter, T1059.003 Windows Command Shell, T1569.002 Service Execution, T1543.003 Windows Service, T1547.001 Registry Run Keys / Startup Folder, T1003.001 LSASS Memory, T1003.002 Security Account Manager, T1003.003 NTDS, plus 34 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0004. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Ke3chang (G0004) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1078.004 OR T1133 OR T1190 OR T1059 OR T1059.003 OR T1569.002 OR T1543.003 OR T1547.001 OR T1003.001 OR T1003.002 OR T1003.003 OR T1003.004 OR T1056.001 OR T1558.001 OR T1007 OR T1016 OR T1018 OR T1033 OR T1049) OR threat.technique.id:(T1078 OR T1078.004 OR T1133 OR T1190 OR T1059 OR T1059.003 OR T1569.002 OR T1543.003 OR T1547.001 OR T1003.001 OR T1003.002 OR T1003.003 OR T1003.004 OR T1056.001 OR T1558.001 OR T1007 OR T1016 OR T1018 OR T1033 OR T1049) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Ke3chang (G0004) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1078.004 OR T1133 OR T1190 OR T1059 OR T1059.003 OR T1569.002 OR T1543.003 OR T1547.001 OR T1003.001 OR T1003.002 OR T1003.003 OR T1003.004 OR T1056.001 OR T1558.001 OR T1007 OR T1016 OR T1018 OR T1033 OR T1049) OR threat.technique.id:(T1078 OR T1078.004 OR T1133 OR T1190 OR T1059 OR T1059.003 OR T1569.002 OR T1543.003 OR T1547.001 OR T1003.001 OR T1003.002 OR T1003.003 OR T1003.004 OR T1056.001 OR T1558.001 OR T1007 OR T1016 OR T1018 OR T1033 OR T1049) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Ke3chang with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1078.004 OR T1133 OR T1190 OR T1059 OR T1059.003 OR T1569.002 OR T1543.003 OR T1547.001 OR T1003.001 OR T1003.002 OR T1003.003 OR T1003.004 OR T1056.001 OR T1558.001 OR T1007 OR T1016 OR T1018 OR T1033 OR T1049) OR threat.technique.id:(T1078 OR T1078.004 OR T1133 OR T1190 OR T1059 OR T1059.003 OR T1569.002 OR T1543.003 OR T1547.001 OR T1003.001 OR T1003.002 OR T1003.003 OR T1003.004 OR T1056.001 OR T1558.001 OR T1007 OR T1016 OR T1018 OR T1033 OR T1049) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.004\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1059\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.004\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1059\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.004\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1059\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.004\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1059\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0005-apt12.json b/app/playbooks/threat-groups/apt-g0005-apt12.json
new file mode 100644
index 0000000..f6007a0
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0005-apt12.json
@@ -0,0 +1,120 @@
+{
+ "id": "apt-g0005",
+ "num": 47,
+ "name": "MITRE ATT&CK Group — APT12",
+ "fullName": "APT12 (G0005) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[APT12](https://attack.mitre.org/groups/G0005) is a threat group that has been attributed to China. The group has targeted a variety of victims including but not limited to media outlets, high-tech companies, and multiple governments. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with APT12.",
+ "mitre": "T1566.001, T1203, T1204.002, T1102.002, T1568.003",
+ "aliases": [
+ "APT12",
+ "IXESHE",
+ "DynCalc",
+ "Numbered Panda",
+ "DNSCALC"
+ ],
+ "mitreGroupId": "G0005",
+ "mitreUrl": "https://attack.mitre.org/groups/G0005",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile APT12 with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0005. Aliases: APT12, IXESHE, DynCalc, Numbered Panda, DNSCALC. Primary mapped tactics: Initial Access, Execution, Command and Control. Mapped techniques: T1566.001 Spearphishing Attachment, T1203 Exploitation for Client Execution, T1204.002 Malicious File, T1102.002 Bidirectional Communication, T1568.003 DNS Calculation. Source: https://attack.mitre.org/groups/G0005. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - APT12 (G0005) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1203 OR T1204.002 OR T1102.002 OR T1568.003) OR threat.technique.id:(T1566.001 OR T1203 OR T1204.002 OR T1102.002 OR T1568.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - APT12 (G0005) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1203 OR T1204.002 OR T1102.002 OR T1568.003) OR threat.technique.id:(T1566.001 OR T1203 OR T1204.002 OR T1102.002 OR T1568.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile APT12 with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1566.001 OR T1203 OR T1204.002 OR T1102.002 OR T1568.003) OR threat.technique.id:(T1566.001 OR T1203 OR T1204.002 OR T1102.002 OR T1568.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1102.002\"\n[[rule.threat.technique]]\nid = \"T1568.003\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1102.002\"\n[[rule.threat.technique]]\nid = \"T1568.003\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1102.002\"\n[[rule.threat.technique]]\nid = \"T1568.003\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1102.002\"\n[[rule.threat.technique]]\nid = \"T1568.003\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0006-apt1.json b/app/playbooks/threat-groups/apt-g0006-apt1.json
new file mode 100644
index 0000000..b7afc71
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0006-apt1.json
@@ -0,0 +1,119 @@
+{
+ "id": "apt-g0006",
+ "num": 48,
+ "name": "MITRE ATT&CK Group — APT1",
+ "fullName": "APT1 (G0006) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[APT1](https://attack.mitre.org/groups/G0006) is a Chinese threat group that has been attributed to the 2nd Bureau of the People’s Liberation Army (PLA) General Staff Department’s (GSD) 3rd Department, commonly known by its Military Unit Cover Designator (MUCD) as Unit 61398. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with APT1.",
+ "mitre": "T1566.001, T1566.002, T1059.003, T1003.001, T1007, T1016, T1049, T1057, T1087.001, T1135, T1021.001, T1550.002, T1005, T1114.001, T1114.002, T1119, T1560.001, T1583.001, T1584.001, T1585.002, T1588.001, T1588.002, T1036.005",
+ "aliases": [
+ "APT1",
+ "Comment Crew",
+ "Comment Group",
+ "Comment Panda"
+ ],
+ "mitreGroupId": "G0006",
+ "mitreUrl": "https://attack.mitre.org/groups/G0006",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile APT1 with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0006. Aliases: APT1, Comment Crew, Comment Group, Comment Panda. Primary mapped tactics: Initial Access, Execution, Credential Access, Discovery, Lateral Movement, Collection, Resource Development, Stealth. Mapped techniques: T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link, T1059.003 Windows Command Shell, T1003.001 LSASS Memory, T1007 System Service Discovery, T1016 System Network Configuration Discovery, T1049 System Network Connections Discovery, T1057 Process Discovery, T1087.001 Local Account, T1135 Network Share Discovery, T1021.001 Remote Desktop Protocol, T1550.002 Pass the Hash, plus 11 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0006. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - APT1 (G0006) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1566.002 OR T1059.003 OR T1003.001 OR T1007 OR T1016 OR T1049 OR T1057 OR T1087.001 OR T1135 OR T1021.001 OR T1550.002 OR T1005 OR T1114.001 OR T1114.002 OR T1119 OR T1560.001 OR T1583.001 OR T1584.001 OR T1585.002) OR threat.technique.id:(T1566.001 OR T1566.002 OR T1059.003 OR T1003.001 OR T1007 OR T1016 OR T1049 OR T1057 OR T1087.001 OR T1135 OR T1021.001 OR T1550.002 OR T1005 OR T1114.001 OR T1114.002 OR T1119 OR T1560.001 OR T1583.001 OR T1584.001 OR T1585.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - APT1 (G0006) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1566.002 OR T1059.003 OR T1003.001 OR T1007 OR T1016 OR T1049 OR T1057 OR T1087.001 OR T1135 OR T1021.001 OR T1550.002 OR T1005 OR T1114.001 OR T1114.002 OR T1119 OR T1560.001 OR T1583.001 OR T1584.001 OR T1585.002) OR threat.technique.id:(T1566.001 OR T1566.002 OR T1059.003 OR T1003.001 OR T1007 OR T1016 OR T1049 OR T1057 OR T1087.001 OR T1135 OR T1021.001 OR T1550.002 OR T1005 OR T1114.001 OR T1114.002 OR T1119 OR T1560.001 OR T1583.001 OR T1584.001 OR T1585.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile APT1 with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1566.001 OR T1566.002 OR T1059.003 OR T1003.001 OR T1007 OR T1016 OR T1049 OR T1057 OR T1087.001 OR T1135 OR T1021.001 OR T1550.002 OR T1005 OR T1114.001 OR T1114.002 OR T1119 OR T1560.001 OR T1583.001 OR T1584.001 OR T1585.002) OR threat.technique.id:(T1566.001 OR T1566.002 OR T1059.003 OR T1003.001 OR T1007 OR T1016 OR T1049 OR T1057 OR T1087.001 OR T1135 OR T1021.001 OR T1550.002 OR T1005 OR T1114.001 OR T1114.002 OR T1119 OR T1560.001 OR T1583.001 OR T1584.001 OR T1585.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1003.001\"\n[[rule.threat.technique]]\nid = \"T1007\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1003.001\"\n[[rule.threat.technique]]\nid = \"T1007\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1003.001\"\n[[rule.threat.technique]]\nid = \"T1007\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1003.001\"\n[[rule.threat.technique]]\nid = \"T1007\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0007-apt28.json b/app/playbooks/threat-groups/apt-g0007-apt28.json
new file mode 100644
index 0000000..4ef2ed6
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0007-apt28.json
@@ -0,0 +1,131 @@
+{
+ "id": "apt-g0007",
+ "num": 49,
+ "name": "MITRE ATT&CK Group — APT28",
+ "fullName": "APT28 (G0007) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[APT28](https://attack.mitre.org/groups/G0007) is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165. This group has been active since at least 2004. [APT28](https://attack.mitre.org/groups/G0007) reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election. In 2018, the US indicted five GRU Unit 26165 officers associated with [APT28](https://attack.mitre.org/groups/G0007) for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations. Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as [Sandworm Team](https://attack.mitre.org/groups/G0034). This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with APT28.",
+ "mitre": "T1078, T1078.004, T1091, T1133, T1189, T1190, T1199, T1566.001, T1669, T1059.001, T1059.003, T1203, T1204.001, T1204.002, T1559.002, T1037.001, T1098.002, T1137.002, T1505.003, T1542.003, T1546.015, T1547.001, T1068, T1134.001",
+ "aliases": [
+ "APT28",
+ "IRON TWILIGHT",
+ "SNAKEMACKEREL",
+ "Swallowtail",
+ "Group 74",
+ "Sednit",
+ "Sofacy",
+ "Pawn Storm",
+ "Fancy Bear",
+ "STRONTIUM",
+ "Tsar Team",
+ "Threat Group-4127",
+ "TG-4127",
+ "Forest Blizzard",
+ "FROZENLAKE",
+ "GruesomeLarch"
+ ],
+ "mitreGroupId": "G0007",
+ "mitreUrl": "https://attack.mitre.org/groups/G0007",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile APT28 with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0007. Aliases: APT28, IRON TWILIGHT, SNAKEMACKEREL, Swallowtail, Group 74, Sednit, Sofacy, Pawn Storm, Fancy Bear, STRONTIUM, Tsar Team, Threat Group-4127. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact, Defense Impairment, Reconnaissance, Resource Development, Stealth. Mapped techniques: T1078 Valid Accounts, T1078.004 Cloud Accounts, T1091 Replication Through Removable Media, T1133 External Remote Services, T1189 Drive-by Compromise, T1190 Exploit Public-Facing Application, T1199 Trusted Relationship, T1566.001 Spearphishing Attachment, T1669 Wi-Fi Networks, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1203 Exploitation for Client Execution, plus 81 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0007. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - APT28 (G0007) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1078.004 OR T1091 OR T1133 OR T1189 OR T1190 OR T1199 OR T1566.001 OR T1669 OR T1059.001 OR T1059.003 OR T1203 OR T1204.001 OR T1204.002 OR T1559.002 OR T1037.001 OR T1098.002 OR T1137.002 OR T1505.003 OR T1542.003) OR threat.technique.id:(T1078 OR T1078.004 OR T1091 OR T1133 OR T1189 OR T1190 OR T1199 OR T1566.001 OR T1669 OR T1059.001 OR T1059.003 OR T1203 OR T1204.001 OR T1204.002 OR T1559.002 OR T1037.001 OR T1098.002 OR T1137.002 OR T1505.003 OR T1542.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - APT28 (G0007) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1078.004 OR T1091 OR T1133 OR T1189 OR T1190 OR T1199 OR T1566.001 OR T1669 OR T1059.001 OR T1059.003 OR T1203 OR T1204.001 OR T1204.002 OR T1559.002 OR T1037.001 OR T1098.002 OR T1137.002 OR T1505.003 OR T1542.003) OR threat.technique.id:(T1078 OR T1078.004 OR T1091 OR T1133 OR T1189 OR T1190 OR T1199 OR T1566.001 OR T1669 OR T1059.001 OR T1059.003 OR T1203 OR T1204.001 OR T1204.002 OR T1559.002 OR T1037.001 OR T1098.002 OR T1137.002 OR T1505.003 OR T1542.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile APT28 with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1078.004 OR T1091 OR T1133 OR T1189 OR T1190 OR T1199 OR T1566.001 OR T1669 OR T1059.001 OR T1059.003 OR T1203 OR T1204.001 OR T1204.002 OR T1559.002 OR T1037.001 OR T1098.002 OR T1137.002 OR T1505.003 OR T1542.003) OR threat.technique.id:(T1078 OR T1078.004 OR T1091 OR T1133 OR T1189 OR T1190 OR T1199 OR T1566.001 OR T1669 OR T1059.001 OR T1059.003 OR T1203 OR T1204.001 OR T1204.002 OR T1559.002 OR T1037.001 OR T1098.002 OR T1137.002 OR T1505.003 OR T1542.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.004\"\n[[rule.threat.technique]]\nid = \"T1091\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1189\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.004\"\n[[rule.threat.technique]]\nid = \"T1091\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1189\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.004\"\n[[rule.threat.technique]]\nid = \"T1091\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1189\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.004\"\n[[rule.threat.technique]]\nid = \"T1091\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1189\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0008-carbanak.json b/app/playbooks/threat-groups/apt-g0008-carbanak.json
new file mode 100644
index 0000000..e06641b
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0008-carbanak.json
@@ -0,0 +1,117 @@
+{
+ "id": "apt-g0008",
+ "num": 50,
+ "name": "MITRE ATT&CK Group — Carbanak",
+ "fullName": "Carbanak (G0008) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Carbanak](https://attack.mitre.org/groups/G0008) is a cybercriminal group that has used [Carbanak](https://attack.mitre.org/software/S0030) malware to target financial institutions since at least 2013. [Carbanak](https://attack.mitre.org/groups/G0008) may be linked to groups tracked separately as [Cobalt Group](https://attack.mitre.org/groups/G0080) and [FIN7](https://attack.mitre.org/groups/G0046) that have also used [Carbanak](https://attack.mitre.org/software/S0030) malware. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Carbanak.",
+ "mitre": "T1078, T1543.003, T1102.002, T1219, T1686, T1588.002, T1036.004, T1036.005, T1218.011",
+ "aliases": [
+ "Carbanak",
+ "Anunak"
+ ],
+ "mitreGroupId": "G0008",
+ "mitreUrl": "https://attack.mitre.org/groups/G0008",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Carbanak with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0008. Aliases: Carbanak, Anunak. Primary mapped tactics: Initial Access, Persistence, Privilege Escalation, Command and Control, Defense Impairment, Resource Development, Stealth. Mapped techniques: T1078 Valid Accounts, T1543.003 Windows Service, T1102.002 Bidirectional Communication, T1219 Remote Access Tools, T1686 Disable or Modify System Firewall, T1588.002 Tool, T1036.004 Masquerade Task or Service, T1036.005 Match Legitimate Resource Name or Location, T1218.011 Rundll32. Source: https://attack.mitre.org/groups/G0008. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Carbanak (G0008) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1543.003 OR T1102.002 OR T1219 OR T1686 OR T1588.002 OR T1036.004 OR T1036.005 OR T1218.011) OR threat.technique.id:(T1078 OR T1543.003 OR T1102.002 OR T1219 OR T1686 OR T1588.002 OR T1036.004 OR T1036.005 OR T1218.011) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Carbanak (G0008) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1543.003 OR T1102.002 OR T1219 OR T1686 OR T1588.002 OR T1036.004 OR T1036.005 OR T1218.011) OR threat.technique.id:(T1078 OR T1543.003 OR T1102.002 OR T1219 OR T1686 OR T1588.002 OR T1036.004 OR T1036.005 OR T1218.011) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Carbanak with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1543.003 OR T1102.002 OR T1219 OR T1686 OR T1588.002 OR T1036.004 OR T1036.005 OR T1218.011) OR threat.technique.id:(T1078 OR T1543.003 OR T1102.002 OR T1219 OR T1686 OR T1588.002 OR T1036.004 OR T1036.005 OR T1218.011) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1543.003\"\n[[rule.threat.technique]]\nid = \"T1102.002\"\n[[rule.threat.technique]]\nid = \"T1219\"\n[[rule.threat.technique]]\nid = \"T1686\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1543.003\"\n[[rule.threat.technique]]\nid = \"T1102.002\"\n[[rule.threat.technique]]\nid = \"T1219\"\n[[rule.threat.technique]]\nid = \"T1686\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1543.003\"\n[[rule.threat.technique]]\nid = \"T1102.002\"\n[[rule.threat.technique]]\nid = \"T1219\"\n[[rule.threat.technique]]\nid = \"T1686\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1543.003\"\n[[rule.threat.technique]]\nid = \"T1102.002\"\n[[rule.threat.technique]]\nid = \"T1219\"\n[[rule.threat.technique]]\nid = \"T1686\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0009-deep-panda.json b/app/playbooks/threat-groups/apt-g0009-deep-panda.json
new file mode 100644
index 0000000..463440a
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0009-deep-panda.json
@@ -0,0 +1,121 @@
+{
+ "id": "apt-g0009",
+ "num": 51,
+ "name": "MITRE ATT&CK Group — Deep Panda",
+ "fullName": "Deep Panda (G0009) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Deep Panda](https://attack.mitre.org/groups/G0009) is a suspected Chinese threat group known to target many industries, including government, defense, financial, and telecommunications. The intrusion into healthcare company Anthem has been attributed to [Deep Panda](https://attack.mitre.org/groups/G0009). This group is also known as Shell Crew, WebMasters, KungFu Kittens, and PinkPanther. [Deep Panda](https://attack.mitre.org/groups/G0009) also appears to be known as Black Vine based on the attribution of both group names to the Anthem intrusion. Some analysts track [Deep Panda](https://attack.mitre.org/groups/G0009) and [APT19](https://attack.mitre.org/groups/G0073) as the same group, but it is unclear from open source information if the groups are the same. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Deep Panda.",
+ "mitre": "T1047, T1059.001, T1505.003, T1546.008, T1018, T1057, T1021.002, T1027.005, T1218.010, T1564.003",
+ "aliases": [
+ "Deep Panda",
+ "Shell Crew",
+ "WebMasters",
+ "KungFu Kittens",
+ "PinkPanther",
+ "Black Vine"
+ ],
+ "mitreGroupId": "G0009",
+ "mitreUrl": "https://attack.mitre.org/groups/G0009",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Deep Panda with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0009. Aliases: Deep Panda, Shell Crew, WebMasters, KungFu Kittens, PinkPanther, Black Vine. Primary mapped tactics: Execution, Persistence, Privilege Escalation, Discovery, Lateral Movement, Stealth. Mapped techniques: T1047 Windows Management Instrumentation, T1059.001 PowerShell, T1505.003 Web Shell, T1546.008 Accessibility Features, T1018 Remote System Discovery, T1057 Process Discovery, T1021.002 SMB/Windows Admin Shares, T1027.005 Indicator Removal from Tools, T1218.010 Regsvr32, T1564.003 Hidden Window. Source: https://attack.mitre.org/groups/G0009. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Deep Panda (G0009) ATT&CK technique pivots\n(rule.threat.technique.id:(T1047 OR T1059.001 OR T1505.003 OR T1546.008 OR T1018 OR T1057 OR T1021.002 OR T1027.005 OR T1218.010 OR T1564.003) OR threat.technique.id:(T1047 OR T1059.001 OR T1505.003 OR T1546.008 OR T1018 OR T1057 OR T1021.002 OR T1027.005 OR T1218.010 OR T1564.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Deep Panda (G0009) ATT&CK technique pivots\n(rule.threat.technique.id:(T1047 OR T1059.001 OR T1505.003 OR T1546.008 OR T1018 OR T1057 OR T1021.002 OR T1027.005 OR T1218.010 OR T1564.003) OR threat.technique.id:(T1047 OR T1059.001 OR T1505.003 OR T1546.008 OR T1018 OR T1057 OR T1021.002 OR T1027.005 OR T1218.010 OR T1564.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Deep Panda with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1047 OR T1059.001 OR T1505.003 OR T1546.008 OR T1018 OR T1057 OR T1021.002 OR T1027.005 OR T1218.010 OR T1564.003) OR threat.technique.id:(T1047 OR T1059.001 OR T1505.003 OR T1546.008 OR T1018 OR T1057 OR T1021.002 OR T1027.005 OR T1218.010 OR T1564.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1505.003\"\n[[rule.threat.technique]]\nid = \"T1546.008\"\n[[rule.threat.technique]]\nid = \"T1018\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1505.003\"\n[[rule.threat.technique]]\nid = \"T1546.008\"\n[[rule.threat.technique]]\nid = \"T1018\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1505.003\"\n[[rule.threat.technique]]\nid = \"T1546.008\"\n[[rule.threat.technique]]\nid = \"T1018\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1505.003\"\n[[rule.threat.technique]]\nid = \"T1546.008\"\n[[rule.threat.technique]]\nid = \"T1018\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0010-turla.json b/app/playbooks/threat-groups/apt-g0010-turla.json
new file mode 100644
index 0000000..a24ac55
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0010-turla.json
@@ -0,0 +1,125 @@
+{
+ "id": "apt-g0010",
+ "num": 52,
+ "name": "MITRE ATT&CK Group — Turla",
+ "fullName": "Turla (G0010) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Turla](https://attack.mitre.org/groups/G0010) is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. [Turla](https://attack.mitre.org/groups/G0010) is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as [Uroburos](https://attack.mitre.org/software/S0022). This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Turla.",
+ "mitre": "T1078.003, T1189, T1566.002, T1059.001, T1059.003, T1059.005, T1059.006, T1059.007, T1106, T1204.001, T1112, T1546.003, T1546.013, T1547.001, T1547.004, T1055, T1055.001, T1068, T1134.002, T1110, T1555.004, T1007, T1012, T1016",
+ "aliases": [
+ "Turla",
+ "IRON HUNTER",
+ "Group 88",
+ "Waterbug",
+ "WhiteBear",
+ "Snake",
+ "Krypton",
+ "Venomous Bear",
+ "Secret Blizzard",
+ "BELUGASTURGEON"
+ ],
+ "mitreGroupId": "G0010",
+ "mitreUrl": "https://attack.mitre.org/groups/G0010",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Turla with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0010. Aliases: Turla, IRON HUNTER, Group 88, Waterbug, WhiteBear, Snake, Krypton, Venomous Bear, Secret Blizzard, BELUGASTURGEON. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Defense Impairment, Resource Development, Stealth. Mapped techniques: T1078.003 Local Accounts, T1189 Drive-by Compromise, T1566.002 Spearphishing Link, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1059.005 Visual Basic, T1059.006 Python, T1059.007 JavaScript, T1106 Native API, T1204.001 Malicious Link, T1112 Modify Registry, T1546.003 Windows Management Instrumentation Event Subscription, plus 56 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0010. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Turla (G0010) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078.003 OR T1189 OR T1566.002 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.006 OR T1059.007 OR T1106 OR T1204.001 OR T1112 OR T1546.003 OR T1546.013 OR T1547.001 OR T1547.004 OR T1055 OR T1055.001 OR T1068 OR T1134.002 OR T1110) OR threat.technique.id:(T1078.003 OR T1189 OR T1566.002 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.006 OR T1059.007 OR T1106 OR T1204.001 OR T1112 OR T1546.003 OR T1546.013 OR T1547.001 OR T1547.004 OR T1055 OR T1055.001 OR T1068 OR T1134.002 OR T1110) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Turla (G0010) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078.003 OR T1189 OR T1566.002 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.006 OR T1059.007 OR T1106 OR T1204.001 OR T1112 OR T1546.003 OR T1546.013 OR T1547.001 OR T1547.004 OR T1055 OR T1055.001 OR T1068 OR T1134.002 OR T1110) OR threat.technique.id:(T1078.003 OR T1189 OR T1566.002 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.006 OR T1059.007 OR T1106 OR T1204.001 OR T1112 OR T1546.003 OR T1546.013 OR T1547.001 OR T1547.004 OR T1055 OR T1055.001 OR T1068 OR T1134.002 OR T1110) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Turla with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078.003 OR T1189 OR T1566.002 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.006 OR T1059.007 OR T1106 OR T1204.001 OR T1112 OR T1546.003 OR T1546.013 OR T1547.001 OR T1547.004 OR T1055 OR T1055.001 OR T1068 OR T1134.002 OR T1110) OR threat.technique.id:(T1078.003 OR T1189 OR T1566.002 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.006 OR T1059.007 OR T1106 OR T1204.001 OR T1112 OR T1546.003 OR T1546.013 OR T1547.001 OR T1547.004 OR T1055 OR T1055.001 OR T1068 OR T1134.002 OR T1110) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0011-pittytiger.json b/app/playbooks/threat-groups/apt-g0011-pittytiger.json
new file mode 100644
index 0000000..ac0322f
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0011-pittytiger.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0011",
+ "num": 53,
+ "name": "MITRE ATT&CK Group — PittyTiger",
+ "fullName": "PittyTiger (G0011) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[PittyTiger](https://attack.mitre.org/groups/G0011) is a threat group believed to operate out of China that uses multiple different types of malware to maintain command and control. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with PittyTiger.",
+ "mitre": "T1078, T1588.002",
+ "aliases": [
+ "PittyTiger"
+ ],
+ "mitreGroupId": "G0011",
+ "mitreUrl": "https://attack.mitre.org/groups/G0011",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile PittyTiger with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0011. Aliases: PittyTiger. Primary mapped tactics: Initial Access, Persistence, Privilege Escalation, Resource Development, Stealth. Mapped techniques: T1078 Valid Accounts, T1588.002 Tool. Source: https://attack.mitre.org/groups/G0011. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - PittyTiger (G0011) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1588.002) OR threat.technique.id:(T1078 OR T1588.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - PittyTiger (G0011) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1588.002) OR threat.technique.id:(T1078 OR T1588.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile PittyTiger with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1588.002) OR threat.technique.id:(T1078 OR T1588.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1588.002\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1588.002\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1588.002\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1588.002\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0012-darkhotel.json b/app/playbooks/threat-groups/apt-g0012-darkhotel.json
new file mode 100644
index 0000000..11f6223
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0012-darkhotel.json
@@ -0,0 +1,118 @@
+{
+ "id": "apt-g0012",
+ "num": 54,
+ "name": "MITRE ATT&CK Group — Darkhotel",
+ "fullName": "Darkhotel (G0012) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Darkhotel](https://attack.mitre.org/groups/G0012) is a suspected South Korean threat group that has targeted victims primarily in East Asia since at least 2004. The group's name is based on cyber espionage operations conducted via hotel Internet networks against traveling executives and other select guests. [Darkhotel](https://attack.mitre.org/groups/G0012) has also conducted spearphishing campaigns and infected victims through peer-to-peer and file sharing networks. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Darkhotel.",
+ "mitre": "T1091, T1189, T1566.001, T1059.003, T1203, T1204.002, T1547.001, T1056.001, T1016, T1057, T1082, T1083, T1124, T1497, T1497.001, T1497.002, T1518.001, T1080, T1105, T1573.001, T1553.002, T1027.013, T1036.005, T1140",
+ "aliases": [
+ "Darkhotel",
+ "DUBNIUM",
+ "Zigzag Hail"
+ ],
+ "mitreGroupId": "G0012",
+ "mitreUrl": "https://attack.mitre.org/groups/G0012",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Darkhotel with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0012. Aliases: Darkhotel, DUBNIUM, Zigzag Hail. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Defense Impairment, Stealth. Mapped techniques: T1091 Replication Through Removable Media, T1189 Drive-by Compromise, T1566.001 Spearphishing Attachment, T1059.003 Windows Command Shell, T1203 Exploitation for Client Execution, T1204.002 Malicious File, T1547.001 Registry Run Keys / Startup Folder, T1056.001 Keylogging, T1016 System Network Configuration Discovery, T1057 Process Discovery, T1082 System Information Discovery, T1083 File and Directory Discovery, plus 12 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0012. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Darkhotel (G0012) ATT&CK technique pivots\n(rule.threat.technique.id:(T1091 OR T1189 OR T1566.001 OR T1059.003 OR T1203 OR T1204.002 OR T1547.001 OR T1056.001 OR T1016 OR T1057 OR T1082 OR T1083 OR T1124 OR T1497 OR T1497.001 OR T1497.002 OR T1518.001 OR T1080 OR T1105 OR T1573.001) OR threat.technique.id:(T1091 OR T1189 OR T1566.001 OR T1059.003 OR T1203 OR T1204.002 OR T1547.001 OR T1056.001 OR T1016 OR T1057 OR T1082 OR T1083 OR T1124 OR T1497 OR T1497.001 OR T1497.002 OR T1518.001 OR T1080 OR T1105 OR T1573.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Darkhotel (G0012) ATT&CK technique pivots\n(rule.threat.technique.id:(T1091 OR T1189 OR T1566.001 OR T1059.003 OR T1203 OR T1204.002 OR T1547.001 OR T1056.001 OR T1016 OR T1057 OR T1082 OR T1083 OR T1124 OR T1497 OR T1497.001 OR T1497.002 OR T1518.001 OR T1080 OR T1105 OR T1573.001) OR threat.technique.id:(T1091 OR T1189 OR T1566.001 OR T1059.003 OR T1203 OR T1204.002 OR T1547.001 OR T1056.001 OR T1016 OR T1057 OR T1082 OR T1083 OR T1124 OR T1497 OR T1497.001 OR T1497.002 OR T1518.001 OR T1080 OR T1105 OR T1573.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Darkhotel with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1091 OR T1189 OR T1566.001 OR T1059.003 OR T1203 OR T1204.002 OR T1547.001 OR T1056.001 OR T1016 OR T1057 OR T1082 OR T1083 OR T1124 OR T1497 OR T1497.001 OR T1497.002 OR T1518.001 OR T1080 OR T1105 OR T1573.001) OR threat.technique.id:(T1091 OR T1189 OR T1566.001 OR T1059.003 OR T1203 OR T1204.002 OR T1547.001 OR T1056.001 OR T1016 OR T1057 OR T1082 OR T1083 OR T1124 OR T1497 OR T1497.001 OR T1497.002 OR T1518.001 OR T1080 OR T1105 OR T1573.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1091\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1203\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1091\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1203\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1091\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1203\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1091\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1203\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0013-apt30.json b/app/playbooks/threat-groups/apt-g0013-apt30.json
new file mode 100644
index 0000000..933d170
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0013-apt30.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0013",
+ "num": 55,
+ "name": "MITRE ATT&CK Group — APT30",
+ "fullName": "APT30 (G0013) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[APT30](https://attack.mitre.org/groups/G0013) is a threat group suspected to be associated with the Chinese government. While [Naikon](https://attack.mitre.org/groups/G0019) shares some characteristics with [APT30](https://attack.mitre.org/groups/G0013), the two groups do not appear to be exact matches. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with APT30.",
+ "mitre": "T1566.001, T1204.002",
+ "aliases": [
+ "APT30"
+ ],
+ "mitreGroupId": "G0013",
+ "mitreUrl": "https://attack.mitre.org/groups/G0013",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile APT30 with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0013. Aliases: APT30. Primary mapped tactics: Initial Access, Execution. Mapped techniques: T1566.001 Spearphishing Attachment, T1204.002 Malicious File. Source: https://attack.mitre.org/groups/G0013. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - APT30 (G0013) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1204.002) OR threat.technique.id:(T1566.001 OR T1204.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - APT30 (G0013) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1204.002) OR threat.technique.id:(T1566.001 OR T1204.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile APT30 with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1566.001 OR T1204.002) OR threat.technique.id:(T1566.001 OR T1204.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1204.002\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1204.002\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1204.002\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1204.002\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0016-apt29.json b/app/playbooks/threat-groups/apt-g0016-apt29.json
new file mode 100644
index 0000000..f8a7771
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0016-apt29.json
@@ -0,0 +1,130 @@
+{
+ "id": "apt-g0016",
+ "num": 56,
+ "name": "MITRE ATT&CK Group — APT29",
+ "fullName": "APT29 (G0016) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[APT29](https://attack.mitre.org/groups/G0016) is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR). They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. [APT29](https://attack.mitre.org/groups/G0016) reportedly compromised the Democratic National Committee starting in the summer of 2015. In April 2021, the US and UK governments attributed the [SolarWinds Compromise](https://attack.mitre.org/campaigns/C0024) to the SVR; public statements included citations to [APT29](https://attack.mitre.org/groups/G0016), Cozy Bear, and The Dukes. Industry reporting also referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with APT29.",
+ "mitre": "T1078, T1078.003, T1078.004, T1133, T1190, T1199, T1566.001, T1566.002, T1566.003, T1047, T1053.005, T1059.001, T1059.006, T1059.009, T1203, T1204.001, T1204.002, T1651, T1037, T1037.004, T1098.002, T1098.005, T1136.003, T1505.003",
+ "aliases": [
+ "APT29",
+ "IRON RITUAL",
+ "IRON HEMLOCK",
+ "NobleBaron",
+ "Dark Halo",
+ "NOBELIUM",
+ "UNC2452",
+ "YTTRIUM",
+ "The Dukes",
+ "Cozy Bear",
+ "CozyDuke",
+ "SolarStorm",
+ "Blue Kitsune",
+ "UNC3524",
+ "Midnight Blizzard"
+ ],
+ "mitreGroupId": "G0016",
+ "mitreUrl": "https://attack.mitre.org/groups/G0016",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile APT29 with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0016. Aliases: APT29, IRON RITUAL, IRON HEMLOCK, NobleBaron, Dark Halo, NOBELIUM, UNC2452, YTTRIUM, The Dukes, Cozy Bear, CozyDuke, SolarStorm. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Defense Impairment, Reconnaissance, Resource Development, Stealth. Mapped techniques: T1078 Valid Accounts, T1078.003 Local Accounts, T1078.004 Cloud Accounts, T1133 External Remote Services, T1190 Exploit Public-Facing Application, T1199 Trusted Relationship, T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link, T1566.003 Spearphishing via Service, T1047 Windows Management Instrumentation, T1053.005 Scheduled Task, T1059.001 PowerShell, plus 54 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0016. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - APT29 (G0016) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1078.003 OR T1078.004 OR T1133 OR T1190 OR T1199 OR T1566.001 OR T1566.002 OR T1566.003 OR T1047 OR T1053.005 OR T1059.001 OR T1059.006 OR T1059.009 OR T1203 OR T1204.001 OR T1204.002 OR T1651 OR T1037 OR T1037.004) OR threat.technique.id:(T1078 OR T1078.003 OR T1078.004 OR T1133 OR T1190 OR T1199 OR T1566.001 OR T1566.002 OR T1566.003 OR T1047 OR T1053.005 OR T1059.001 OR T1059.006 OR T1059.009 OR T1203 OR T1204.001 OR T1204.002 OR T1651 OR T1037 OR T1037.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - APT29 (G0016) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1078.003 OR T1078.004 OR T1133 OR T1190 OR T1199 OR T1566.001 OR T1566.002 OR T1566.003 OR T1047 OR T1053.005 OR T1059.001 OR T1059.006 OR T1059.009 OR T1203 OR T1204.001 OR T1204.002 OR T1651 OR T1037 OR T1037.004) OR threat.technique.id:(T1078 OR T1078.003 OR T1078.004 OR T1133 OR T1190 OR T1199 OR T1566.001 OR T1566.002 OR T1566.003 OR T1047 OR T1053.005 OR T1059.001 OR T1059.006 OR T1059.009 OR T1203 OR T1204.001 OR T1204.002 OR T1651 OR T1037 OR T1037.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile APT29 with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1078.003 OR T1078.004 OR T1133 OR T1190 OR T1199 OR T1566.001 OR T1566.002 OR T1566.003 OR T1047 OR T1053.005 OR T1059.001 OR T1059.006 OR T1059.009 OR T1203 OR T1204.001 OR T1204.002 OR T1651 OR T1037 OR T1037.004) OR threat.technique.id:(T1078 OR T1078.003 OR T1078.004 OR T1133 OR T1190 OR T1199 OR T1566.001 OR T1566.002 OR T1566.003 OR T1047 OR T1053.005 OR T1059.001 OR T1059.006 OR T1059.009 OR T1203 OR T1204.001 OR T1204.002 OR T1651 OR T1037 OR T1037.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1078.004\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1078.004\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1078.004\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1078.004\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0017-dragonok.json b/app/playbooks/threat-groups/apt-g0017-dragonok.json
new file mode 100644
index 0000000..e6e4f98
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0017-dragonok.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0017",
+ "num": 57,
+ "name": "MITRE ATT&CK Group — DragonOK",
+ "fullName": "DragonOK (G0017) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[DragonOK](https://attack.mitre.org/groups/G0017) is a threat group that has targeted Japanese organizations with phishing emails. Due to overlapping TTPs, including similar custom tools, [DragonOK](https://attack.mitre.org/groups/G0017) is thought to have a direct or indirect relationship with the threat group [Moafee](https://attack.mitre.org/groups/G0002). It is known to use a variety of malware, including Sysget/HelloBridge, PlugX, PoisonIvy, FormerFirstRat, NFlog, and NewCT. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with DragonOK.",
+ "mitre": "",
+ "aliases": [
+ "DragonOK"
+ ],
+ "mitreGroupId": "G0017",
+ "mitreUrl": "https://attack.mitre.org/groups/G0017",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile DragonOK with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0017. Aliases: DragonOK. Primary mapped tactics: No explicit tactics mapped. Mapped techniques: No ATT&CK techniques are currently mapped in MITRE CTI for this group.. Source: https://attack.mitre.org/groups/G0017. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - DragonOK (G0017) ATT&CK technique pivots\n(rule.threat.technique.id:(Gxxxx) OR threat.technique.id:(Gxxxx) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - DragonOK (G0017) ATT&CK technique pivots\n(rule.threat.technique.id:(Gxxxx) OR threat.technique.id:(Gxxxx) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile DragonOK with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(Gxxxx) OR threat.technique.id:(Gxxxx) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''"
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''"
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''"
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''"
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0018-admin-338.json b/app/playbooks/threat-groups/apt-g0018-admin-338.json
new file mode 100644
index 0000000..48f78b7
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0018-admin-338.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0018",
+ "num": 58,
+ "name": "MITRE ATT&CK Group — admin@338",
+ "fullName": "admin@338 (G0018) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[admin@338](https://attack.mitre.org/groups/G0018) is a China-based cyber threat group. It has previously used newsworthy events as lures to deliver malware and has primarily targeted organizations involved in financial, economic, and trade policy, typically using publicly available RATs such as [PoisonIvy](https://attack.mitre.org/software/S0012), as well as some non-public backdoors. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with admin@338.",
+ "mitre": "T1566.001, T1059.003, T1203, T1204.002, T1007, T1016, T1049, T1069.001, T1082, T1083, T1087.001, T1036.005",
+ "aliases": [
+ "admin@338"
+ ],
+ "mitreGroupId": "G0018",
+ "mitreUrl": "https://attack.mitre.org/groups/G0018",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile admin@338 with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0018. Aliases: admin@338. Primary mapped tactics: Initial Access, Execution, Discovery, Stealth. Mapped techniques: T1566.001 Spearphishing Attachment, T1059.003 Windows Command Shell, T1203 Exploitation for Client Execution, T1204.002 Malicious File, T1007 System Service Discovery, T1016 System Network Configuration Discovery, T1049 System Network Connections Discovery, T1069.001 Local Groups, T1082 System Information Discovery, T1083 File and Directory Discovery, T1087.001 Local Account, T1036.005 Match Legitimate Resource Name or Location. Source: https://attack.mitre.org/groups/G0018. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - admin@338 (G0018) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1059.003 OR T1203 OR T1204.002 OR T1007 OR T1016 OR T1049 OR T1069.001 OR T1082 OR T1083 OR T1087.001 OR T1036.005) OR threat.technique.id:(T1566.001 OR T1059.003 OR T1203 OR T1204.002 OR T1007 OR T1016 OR T1049 OR T1069.001 OR T1082 OR T1083 OR T1087.001 OR T1036.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - admin@338 (G0018) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1059.003 OR T1203 OR T1204.002 OR T1007 OR T1016 OR T1049 OR T1069.001 OR T1082 OR T1083 OR T1087.001 OR T1036.005) OR threat.technique.id:(T1566.001 OR T1059.003 OR T1203 OR T1204.002 OR T1007 OR T1016 OR T1049 OR T1069.001 OR T1082 OR T1083 OR T1087.001 OR T1036.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile admin@338 with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1566.001 OR T1059.003 OR T1203 OR T1204.002 OR T1007 OR T1016 OR T1049 OR T1069.001 OR T1082 OR T1083 OR T1087.001 OR T1036.005) OR threat.technique.id:(T1566.001 OR T1059.003 OR T1203 OR T1204.002 OR T1007 OR T1016 OR T1049 OR T1069.001 OR T1082 OR T1083 OR T1087.001 OR T1036.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1007\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1007\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1007\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1007\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0019-naikon.json b/app/playbooks/threat-groups/apt-g0019-naikon.json
new file mode 100644
index 0000000..074f3d4
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0019-naikon.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0019",
+ "num": 59,
+ "name": "MITRE ATT&CK Group — Naikon",
+ "fullName": "Naikon (G0019) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Naikon](https://attack.mitre.org/groups/G0019) is assessed to be a state-sponsored cyber espionage group attributed to the Chinese People’s Liberation Army’s (PLA) Chengdu Military Region Second Technical Reconnaissance Bureau (Military Unit Cover Designator 78020). Active since at least 2010, [Naikon](https://attack.mitre.org/groups/G0019) has primarily conducted operations against government, military, and civil organizations in Southeast Asia, as well as against international bodies such as the United Nations Development Programme (UNDP) and the Association of Southeast Asian Nations (ASEAN). While [Naikon](https://attack.mitre.org/groups/G0019) shares some characteristics with [APT30](https://attack.mitre.org/groups/G0013), the two groups do not appear to be exact matches. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Naikon.",
+ "mitre": "T1078.002, T1566.001, T1047, T1053.005, T1204.002, T1574.001, T1137.006, T1547.001, T1016, T1018, T1046, T1518.001, T1036.004, T1036.005",
+ "aliases": [
+ "Naikon"
+ ],
+ "mitreGroupId": "G0019",
+ "mitreUrl": "https://attack.mitre.org/groups/G0019",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Naikon with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0019. Aliases: Naikon. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Discovery, Stealth. Mapped techniques: T1078.002 Domain Accounts, T1566.001 Spearphishing Attachment, T1047 Windows Management Instrumentation, T1053.005 Scheduled Task, T1204.002 Malicious File, T1574.001 DLL, T1137.006 Add-ins, T1547.001 Registry Run Keys / Startup Folder, T1016 System Network Configuration Discovery, T1018 Remote System Discovery, T1046 Network Service Discovery, T1518.001 Security Software Discovery, plus 2 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0019. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Naikon (G0019) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078.002 OR T1566.001 OR T1047 OR T1053.005 OR T1204.002 OR T1574.001 OR T1137.006 OR T1547.001 OR T1016 OR T1018 OR T1046 OR T1518.001 OR T1036.004 OR T1036.005) OR threat.technique.id:(T1078.002 OR T1566.001 OR T1047 OR T1053.005 OR T1204.002 OR T1574.001 OR T1137.006 OR T1547.001 OR T1016 OR T1018 OR T1046 OR T1518.001 OR T1036.004 OR T1036.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Naikon (G0019) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078.002 OR T1566.001 OR T1047 OR T1053.005 OR T1204.002 OR T1574.001 OR T1137.006 OR T1547.001 OR T1016 OR T1018 OR T1046 OR T1518.001 OR T1036.004 OR T1036.005) OR threat.technique.id:(T1078.002 OR T1566.001 OR T1047 OR T1053.005 OR T1204.002 OR T1574.001 OR T1137.006 OR T1547.001 OR T1016 OR T1018 OR T1046 OR T1518.001 OR T1036.004 OR T1036.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Naikon with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078.002 OR T1566.001 OR T1047 OR T1053.005 OR T1204.002 OR T1574.001 OR T1137.006 OR T1547.001 OR T1016 OR T1018 OR T1046 OR T1518.001 OR T1036.004 OR T1036.005) OR threat.technique.id:(T1078.002 OR T1566.001 OR T1047 OR T1053.005 OR T1204.002 OR T1574.001 OR T1137.006 OR T1547.001 OR T1016 OR T1018 OR T1046 OR T1518.001 OR T1036.004 OR T1036.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1204.002\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1204.002\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1204.002\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1204.002\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0020-equation.json b/app/playbooks/threat-groups/apt-g0020-equation.json
new file mode 100644
index 0000000..06a9751
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0020-equation.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0020",
+ "num": 60,
+ "name": "MITRE ATT&CK Group — Equation",
+ "fullName": "Equation (G0020) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Equation](https://attack.mitre.org/groups/G0020) is a sophisticated threat group that employs multiple remote access tools. The group is known to use zero-day exploits and has developed the capability to overwrite the firmware of hard disk drives. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Equation.",
+ "mitre": "T1542.002, T1120, T1480.001, T1564.005",
+ "aliases": [
+ "Equation"
+ ],
+ "mitreGroupId": "G0020",
+ "mitreUrl": "https://attack.mitre.org/groups/G0020",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Equation with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0020. Aliases: Equation. Primary mapped tactics: Persistence, Discovery, Stealth. Mapped techniques: T1542.002 Component Firmware, T1120 Peripheral Device Discovery, T1480.001 Environmental Keying, T1564.005 Hidden File System. Source: https://attack.mitre.org/groups/G0020. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Equation (G0020) ATT&CK technique pivots\n(rule.threat.technique.id:(T1542.002 OR T1120 OR T1480.001 OR T1564.005) OR threat.technique.id:(T1542.002 OR T1120 OR T1480.001 OR T1564.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Equation (G0020) ATT&CK technique pivots\n(rule.threat.technique.id:(T1542.002 OR T1120 OR T1480.001 OR T1564.005) OR threat.technique.id:(T1542.002 OR T1120 OR T1480.001 OR T1564.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Equation with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1542.002 OR T1120 OR T1480.001 OR T1564.005) OR threat.technique.id:(T1542.002 OR T1120 OR T1480.001 OR T1564.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1542.002\"\n[[rule.threat.technique]]\nid = \"T1120\"\n[[rule.threat.technique]]\nid = \"T1480.001\"\n[[rule.threat.technique]]\nid = \"T1564.005\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1542.002\"\n[[rule.threat.technique]]\nid = \"T1120\"\n[[rule.threat.technique]]\nid = \"T1480.001\"\n[[rule.threat.technique]]\nid = \"T1564.005\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1542.002\"\n[[rule.threat.technique]]\nid = \"T1120\"\n[[rule.threat.technique]]\nid = \"T1480.001\"\n[[rule.threat.technique]]\nid = \"T1564.005\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1542.002\"\n[[rule.threat.technique]]\nid = \"T1120\"\n[[rule.threat.technique]]\nid = \"T1480.001\"\n[[rule.threat.technique]]\nid = \"T1564.005\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0021-molerats.json b/app/playbooks/threat-groups/apt-g0021-molerats.json
new file mode 100644
index 0000000..e891ed6
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0021-molerats.json
@@ -0,0 +1,118 @@
+{
+ "id": "apt-g0021",
+ "num": 61,
+ "name": "MITRE ATT&CK Group — Molerats",
+ "fullName": "Molerats (G0021) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Molerats](https://attack.mitre.org/groups/G0021) is an Arabic-speaking, politically-motivated threat group that has been operating since 2012. The group's victims have primarily been in the Middle East, Europe, and the United States. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Molerats.",
+ "mitre": "T1566.001, T1566.002, T1053.005, T1059.001, T1059.005, T1059.007, T1204.001, T1204.002, T1547.001, T1555.003, T1057, T1105, T1553.002, T1027.015, T1140, T1218.007",
+ "aliases": [
+ "Molerats",
+ "Operation Molerats",
+ "Gaza Cybergang"
+ ],
+ "mitreGroupId": "G0021",
+ "mitreUrl": "https://attack.mitre.org/groups/G0021",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Molerats with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0021. Aliases: Molerats, Operation Molerats, Gaza Cybergang. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Command and Control, Defense Impairment, Stealth. Mapped techniques: T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link, T1053.005 Scheduled Task, T1059.001 PowerShell, T1059.005 Visual Basic, T1059.007 JavaScript, T1204.001 Malicious Link, T1204.002 Malicious File, T1547.001 Registry Run Keys / Startup Folder, T1555.003 Credentials from Web Browsers, T1057 Process Discovery, T1105 Ingress Tool Transfer, plus 4 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0021. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Molerats (G0021) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.005 OR T1059.007 OR T1204.001 OR T1204.002 OR T1547.001 OR T1555.003 OR T1057 OR T1105 OR T1553.002 OR T1027.015 OR T1140 OR T1218.007) OR threat.technique.id:(T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.005 OR T1059.007 OR T1204.001 OR T1204.002 OR T1547.001 OR T1555.003 OR T1057 OR T1105 OR T1553.002 OR T1027.015 OR T1140 OR T1218.007) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Molerats (G0021) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.005 OR T1059.007 OR T1204.001 OR T1204.002 OR T1547.001 OR T1555.003 OR T1057 OR T1105 OR T1553.002 OR T1027.015 OR T1140 OR T1218.007) OR threat.technique.id:(T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.005 OR T1059.007 OR T1204.001 OR T1204.002 OR T1547.001 OR T1555.003 OR T1057 OR T1105 OR T1553.002 OR T1027.015 OR T1140 OR T1218.007) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Molerats with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.005 OR T1059.007 OR T1204.001 OR T1204.002 OR T1547.001 OR T1555.003 OR T1057 OR T1105 OR T1553.002 OR T1027.015 OR T1140 OR T1218.007) OR threat.technique.id:(T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.005 OR T1059.007 OR T1204.001 OR T1204.002 OR T1547.001 OR T1555.003 OR T1057 OR T1105 OR T1553.002 OR T1027.015 OR T1140 OR T1218.007) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.005\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.005\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.005\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.005\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0022-apt3.json b/app/playbooks/threat-groups/apt-g0022-apt3.json
new file mode 100644
index 0000000..77faa31
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0022-apt3.json
@@ -0,0 +1,122 @@
+{
+ "id": "apt-g0022",
+ "num": 62,
+ "name": "MITRE ATT&CK Group — APT3",
+ "fullName": "APT3 (G0022) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[APT3](https://attack.mitre.org/groups/G0022) is a China-based threat group that researchers have attributed to China's Ministry of State Security. This group is responsible for the campaigns known as Operation Clandestine Fox, Operation Clandestine Wolf, and Operation Double Tap. As of June 2015, the group appears to have shifted from targeting primarily US victims to primarily political organizations in Hong Kong. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with APT3.",
+ "mitre": "T1078.002, T1566.002, T1053.005, T1059.001, T1059.003, T1203, T1204.001, T1574.001, T1098.007, T1136.001, T1543.003, T1546.008, T1547.001, T1003.001, T1056.001, T1110.002, T1552.001, T1555.003, T1016, T1018, T1033, T1049, T1057, T1069",
+ "aliases": [
+ "APT3",
+ "Gothic Panda",
+ "Pirpi",
+ "UPS Team",
+ "Buckeye",
+ "Threat Group-0110",
+ "TG-0110"
+ ],
+ "mitreGroupId": "G0022",
+ "mitreUrl": "https://attack.mitre.org/groups/G0022",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile APT3 with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0022. Aliases: APT3, Gothic Panda, Pirpi, UPS Team, Buckeye, Threat Group-0110, TG-0110. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Stealth. Mapped techniques: T1078.002 Domain Accounts, T1566.002 Spearphishing Link, T1053.005 Scheduled Task, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1203 Exploitation for Client Execution, T1204.001 Malicious Link, T1574.001 DLL, T1098.007 Additional Local or Domain Groups, T1136.001 Local Account, T1543.003 Windows Service, T1546.008 Accessibility Features, plus 32 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0022. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - APT3 (G0022) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078.002 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.003 OR T1203 OR T1204.001 OR T1574.001 OR T1098.007 OR T1136.001 OR T1543.003 OR T1546.008 OR T1547.001 OR T1003.001 OR T1056.001 OR T1110.002 OR T1552.001 OR T1555.003 OR T1016 OR T1018) OR threat.technique.id:(T1078.002 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.003 OR T1203 OR T1204.001 OR T1574.001 OR T1098.007 OR T1136.001 OR T1543.003 OR T1546.008 OR T1547.001 OR T1003.001 OR T1056.001 OR T1110.002 OR T1552.001 OR T1555.003 OR T1016 OR T1018) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - APT3 (G0022) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078.002 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.003 OR T1203 OR T1204.001 OR T1574.001 OR T1098.007 OR T1136.001 OR T1543.003 OR T1546.008 OR T1547.001 OR T1003.001 OR T1056.001 OR T1110.002 OR T1552.001 OR T1555.003 OR T1016 OR T1018) OR threat.technique.id:(T1078.002 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.003 OR T1203 OR T1204.001 OR T1574.001 OR T1098.007 OR T1136.001 OR T1543.003 OR T1546.008 OR T1547.001 OR T1003.001 OR T1056.001 OR T1110.002 OR T1552.001 OR T1555.003 OR T1016 OR T1018) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile APT3 with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078.002 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.003 OR T1203 OR T1204.001 OR T1574.001 OR T1098.007 OR T1136.001 OR T1543.003 OR T1546.008 OR T1547.001 OR T1003.001 OR T1056.001 OR T1110.002 OR T1552.001 OR T1555.003 OR T1016 OR T1018) OR threat.technique.id:(T1078.002 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.003 OR T1203 OR T1204.001 OR T1574.001 OR T1098.007 OR T1136.001 OR T1543.003 OR T1546.008 OR T1547.001 OR T1003.001 OR T1056.001 OR T1110.002 OR T1552.001 OR T1555.003 OR T1016 OR T1018) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0023-apt16.json b/app/playbooks/threat-groups/apt-g0023-apt16.json
new file mode 100644
index 0000000..bdb6f2c
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0023-apt16.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0023",
+ "num": 63,
+ "name": "MITRE ATT&CK Group — APT16",
+ "fullName": "APT16 (G0023) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[APT16](https://attack.mitre.org/groups/G0023) is a China-based threat group that has launched spearphishing campaigns targeting Japanese and Taiwanese organizations. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with APT16.",
+ "mitre": "T1584.004",
+ "aliases": [
+ "APT16"
+ ],
+ "mitreGroupId": "G0023",
+ "mitreUrl": "https://attack.mitre.org/groups/G0023",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile APT16 with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0023. Aliases: APT16. Primary mapped tactics: Resource Development. Mapped techniques: T1584.004 Server. Source: https://attack.mitre.org/groups/G0023. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - APT16 (G0023) ATT&CK technique pivots\n(rule.threat.technique.id:(T1584.004) OR threat.technique.id:(T1584.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - APT16 (G0023) ATT&CK technique pivots\n(rule.threat.technique.id:(T1584.004) OR threat.technique.id:(T1584.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile APT16 with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1584.004) OR threat.technique.id:(T1584.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1584.004\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1584.004\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1584.004\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1584.004\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0024-putter-panda.json b/app/playbooks/threat-groups/apt-g0024-putter-panda.json
new file mode 100644
index 0000000..975ef16
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0024-putter-panda.json
@@ -0,0 +1,118 @@
+{
+ "id": "apt-g0024",
+ "num": 64,
+ "name": "MITRE ATT&CK Group — Putter Panda",
+ "fullName": "Putter Panda (G0024) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Putter Panda](https://attack.mitre.org/groups/G0024) is a Chinese threat group that has been attributed to Unit 61486 of the 12th Bureau of the PLA’s 3rd General Staff Department (GSD). This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Putter Panda.",
+ "mitre": "T1547.001, T1055.001, T1685, T1027.013",
+ "aliases": [
+ "Putter Panda",
+ "APT2",
+ "MSUpdater"
+ ],
+ "mitreGroupId": "G0024",
+ "mitreUrl": "https://attack.mitre.org/groups/G0024",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Putter Panda with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0024. Aliases: Putter Panda, APT2, MSUpdater. Primary mapped tactics: Persistence, Privilege Escalation, Defense Impairment, Stealth. Mapped techniques: T1547.001 Registry Run Keys / Startup Folder, T1055.001 Dynamic-link Library Injection, T1685 Disable or Modify Tools, T1027.013 Encrypted/Encoded File. Source: https://attack.mitre.org/groups/G0024. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Putter Panda (G0024) ATT&CK technique pivots\n(rule.threat.technique.id:(T1547.001 OR T1055.001 OR T1685 OR T1027.013) OR threat.technique.id:(T1547.001 OR T1055.001 OR T1685 OR T1027.013) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Putter Panda (G0024) ATT&CK technique pivots\n(rule.threat.technique.id:(T1547.001 OR T1055.001 OR T1685 OR T1027.013) OR threat.technique.id:(T1547.001 OR T1055.001 OR T1685 OR T1027.013) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Putter Panda with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1547.001 OR T1055.001 OR T1685 OR T1027.013) OR threat.technique.id:(T1547.001 OR T1055.001 OR T1685 OR T1027.013) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1547.001\"\n[[rule.threat.technique]]\nid = \"T1055.001\"\n[[rule.threat.technique]]\nid = \"T1685\"\n[[rule.threat.technique]]\nid = \"T1027.013\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1547.001\"\n[[rule.threat.technique]]\nid = \"T1055.001\"\n[[rule.threat.technique]]\nid = \"T1685\"\n[[rule.threat.technique]]\nid = \"T1027.013\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1547.001\"\n[[rule.threat.technique]]\nid = \"T1055.001\"\n[[rule.threat.technique]]\nid = \"T1685\"\n[[rule.threat.technique]]\nid = \"T1027.013\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1547.001\"\n[[rule.threat.technique]]\nid = \"T1055.001\"\n[[rule.threat.technique]]\nid = \"T1685\"\n[[rule.threat.technique]]\nid = \"T1027.013\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0025-apt17.json b/app/playbooks/threat-groups/apt-g0025-apt17.json
new file mode 100644
index 0000000..ce336e1
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0025-apt17.json
@@ -0,0 +1,117 @@
+{
+ "id": "apt-g0025",
+ "num": 65,
+ "name": "MITRE ATT&CK Group — APT17",
+ "fullName": "APT17 (G0025) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[APT17](https://attack.mitre.org/groups/G0025) is a China-based threat group that has conducted network intrusions against U.S. government entities, the defense industry, law firms, information technology companies, mining companies, and non-government organizations. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with APT17.",
+ "mitre": "T1583.006, T1585",
+ "aliases": [
+ "APT17",
+ "Deputy Dog"
+ ],
+ "mitreGroupId": "G0025",
+ "mitreUrl": "https://attack.mitre.org/groups/G0025",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile APT17 with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0025. Aliases: APT17, Deputy Dog. Primary mapped tactics: Resource Development. Mapped techniques: T1583.006 Web Services, T1585 Establish Accounts. Source: https://attack.mitre.org/groups/G0025. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - APT17 (G0025) ATT&CK technique pivots\n(rule.threat.technique.id:(T1583.006 OR T1585) OR threat.technique.id:(T1583.006 OR T1585) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - APT17 (G0025) ATT&CK technique pivots\n(rule.threat.technique.id:(T1583.006 OR T1585) OR threat.technique.id:(T1583.006 OR T1585) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile APT17 with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1583.006 OR T1585) OR threat.technique.id:(T1583.006 OR T1585) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1583.006\"\n[[rule.threat.technique]]\nid = \"T1585\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1583.006\"\n[[rule.threat.technique]]\nid = \"T1585\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1583.006\"\n[[rule.threat.technique]]\nid = \"T1585\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1583.006\"\n[[rule.threat.technique]]\nid = \"T1585\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0026-apt18.json b/app/playbooks/threat-groups/apt-g0026-apt18.json
new file mode 100644
index 0000000..cba8540
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0026-apt18.json
@@ -0,0 +1,119 @@
+{
+ "id": "apt-g0026",
+ "num": 66,
+ "name": "MITRE ATT&CK Group — APT18",
+ "fullName": "APT18 (G0026) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[APT18](https://attack.mitre.org/groups/G0026) is a threat group that has operated since at least 2009 and has targeted a range of industries, including technology, manufacturing, human rights groups, government, and medical. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with APT18.",
+ "mitre": "T1078, T1133, T1053.002, T1059.003, T1547.001, T1082, T1083, T1071.001, T1071.004, T1105, T1027.013, T1070.004",
+ "aliases": [
+ "APT18",
+ "TG-0416",
+ "Dynamite Panda",
+ "Threat Group-0416"
+ ],
+ "mitreGroupId": "G0026",
+ "mitreUrl": "https://attack.mitre.org/groups/G0026",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile APT18 with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0026. Aliases: APT18, TG-0416, Dynamite Panda, Threat Group-0416. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Discovery, Command and Control, Stealth. Mapped techniques: T1078 Valid Accounts, T1133 External Remote Services, T1053.002 At, T1059.003 Windows Command Shell, T1547.001 Registry Run Keys / Startup Folder, T1082 System Information Discovery, T1083 File and Directory Discovery, T1071.001 Web Protocols, T1071.004 DNS, T1105 Ingress Tool Transfer, T1027.013 Encrypted/Encoded File, T1070.004 File Deletion. Source: https://attack.mitre.org/groups/G0026. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - APT18 (G0026) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1133 OR T1053.002 OR T1059.003 OR T1547.001 OR T1082 OR T1083 OR T1071.001 OR T1071.004 OR T1105 OR T1027.013 OR T1070.004) OR threat.technique.id:(T1078 OR T1133 OR T1053.002 OR T1059.003 OR T1547.001 OR T1082 OR T1083 OR T1071.001 OR T1071.004 OR T1105 OR T1027.013 OR T1070.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - APT18 (G0026) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1133 OR T1053.002 OR T1059.003 OR T1547.001 OR T1082 OR T1083 OR T1071.001 OR T1071.004 OR T1105 OR T1027.013 OR T1070.004) OR threat.technique.id:(T1078 OR T1133 OR T1053.002 OR T1059.003 OR T1547.001 OR T1082 OR T1083 OR T1071.001 OR T1071.004 OR T1105 OR T1027.013 OR T1070.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile APT18 with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1133 OR T1053.002 OR T1059.003 OR T1547.001 OR T1082 OR T1083 OR T1071.001 OR T1071.004 OR T1105 OR T1027.013 OR T1070.004) OR threat.technique.id:(T1078 OR T1133 OR T1053.002 OR T1059.003 OR T1547.001 OR T1082 OR T1083 OR T1071.001 OR T1071.004 OR T1105 OR T1027.013 OR T1070.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1053.002\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1547.001\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1053.002\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1547.001\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1053.002\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1547.001\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1053.002\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1547.001\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0027-threat-group-3390.json b/app/playbooks/threat-groups/apt-g0027-threat-group-3390.json
new file mode 100644
index 0000000..0cb6042
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0027-threat-group-3390.json
@@ -0,0 +1,124 @@
+{
+ "id": "apt-g0027",
+ "num": 67,
+ "name": "MITRE ATT&CK Group — Threat Group-3390",
+ "fullName": "Threat Group-3390 (G0027) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Threat Group-3390](https://attack.mitre.org/groups/G0027) is a Chinese threat group that has extensively used strategic Web compromises to target victims. The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Threat Group-3390.",
+ "mitre": "T1078, T1133, T1189, T1190, T1195.002, T1199, T1566.001, T1047, T1053.002, T1059.001, T1059.003, T1203, T1204.002, T1574.001, T1112, T1505.003, T1543.003, T1547.001, T1055.012, T1068, T1548.002, T1003.001, T1003.002, T1003.004",
+ "aliases": [
+ "Threat Group-3390",
+ "Earth Smilodon",
+ "TG-3390",
+ "Emissary Panda",
+ "BRONZE UNION",
+ "APT27",
+ "Iron Tiger",
+ "LuckyMouse",
+ "Linen Typhoon"
+ ],
+ "mitreGroupId": "G0027",
+ "mitreUrl": "https://attack.mitre.org/groups/G0027",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Threat Group-3390 with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0027. Aliases: Threat Group-3390, Earth Smilodon, TG-3390, Emissary Panda, BRONZE UNION, APT27, Iron Tiger, LuckyMouse, Linen Typhoon. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Defense Impairment, Resource Development, Stealth. Mapped techniques: T1078 Valid Accounts, T1133 External Remote Services, T1189 Drive-by Compromise, T1190 Exploit Public-Facing Application, T1195.002 Compromise Software Supply Chain, T1199 Trusted Relationship, T1566.001 Spearphishing Attachment, T1047 Windows Management Instrumentation, T1053.002 At, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1203 Exploitation for Client Execution, plus 45 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0027. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Threat Group-3390 (G0027) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1133 OR T1189 OR T1190 OR T1195.002 OR T1199 OR T1566.001 OR T1047 OR T1053.002 OR T1059.001 OR T1059.003 OR T1203 OR T1204.002 OR T1574.001 OR T1112 OR T1505.003 OR T1543.003 OR T1547.001 OR T1055.012 OR T1068) OR threat.technique.id:(T1078 OR T1133 OR T1189 OR T1190 OR T1195.002 OR T1199 OR T1566.001 OR T1047 OR T1053.002 OR T1059.001 OR T1059.003 OR T1203 OR T1204.002 OR T1574.001 OR T1112 OR T1505.003 OR T1543.003 OR T1547.001 OR T1055.012 OR T1068) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Threat Group-3390 (G0027) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1133 OR T1189 OR T1190 OR T1195.002 OR T1199 OR T1566.001 OR T1047 OR T1053.002 OR T1059.001 OR T1059.003 OR T1203 OR T1204.002 OR T1574.001 OR T1112 OR T1505.003 OR T1543.003 OR T1547.001 OR T1055.012 OR T1068) OR threat.technique.id:(T1078 OR T1133 OR T1189 OR T1190 OR T1195.002 OR T1199 OR T1566.001 OR T1047 OR T1053.002 OR T1059.001 OR T1059.003 OR T1203 OR T1204.002 OR T1574.001 OR T1112 OR T1505.003 OR T1543.003 OR T1547.001 OR T1055.012 OR T1068) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Threat Group-3390 with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1133 OR T1189 OR T1190 OR T1195.002 OR T1199 OR T1566.001 OR T1047 OR T1053.002 OR T1059.001 OR T1059.003 OR T1203 OR T1204.002 OR T1574.001 OR T1112 OR T1505.003 OR T1543.003 OR T1547.001 OR T1055.012 OR T1068) OR threat.technique.id:(T1078 OR T1133 OR T1189 OR T1190 OR T1195.002 OR T1199 OR T1566.001 OR T1047 OR T1053.002 OR T1059.001 OR T1059.003 OR T1203 OR T1204.002 OR T1574.001 OR T1112 OR T1505.003 OR T1543.003 OR T1547.001 OR T1055.012 OR T1068) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1195.002\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1195.002\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1195.002\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1195.002\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0028-threat-group-1314.json b/app/playbooks/threat-groups/apt-g0028-threat-group-1314.json
new file mode 100644
index 0000000..58bfe40
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0028-threat-group-1314.json
@@ -0,0 +1,117 @@
+{
+ "id": "apt-g0028",
+ "num": 68,
+ "name": "MITRE ATT&CK Group — Threat Group-1314",
+ "fullName": "Threat Group-1314 (G0028) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Threat Group-1314](https://attack.mitre.org/groups/G0028) is an unattributed threat group that has used compromised credentials to log into a victim's remote access infrastructure. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Threat Group-1314.",
+ "mitre": "T1078.002, T1059.003, T1072, T1021.002",
+ "aliases": [
+ "Threat Group-1314",
+ "TG-1314"
+ ],
+ "mitreGroupId": "G0028",
+ "mitreUrl": "https://attack.mitre.org/groups/G0028",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Threat Group-1314 with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0028. Aliases: Threat Group-1314, TG-1314. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Lateral Movement, Stealth. Mapped techniques: T1078.002 Domain Accounts, T1059.003 Windows Command Shell, T1072 Software Deployment Tools, T1021.002 SMB/Windows Admin Shares. Source: https://attack.mitre.org/groups/G0028. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Threat Group-1314 (G0028) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078.002 OR T1059.003 OR T1072 OR T1021.002) OR threat.technique.id:(T1078.002 OR T1059.003 OR T1072 OR T1021.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Threat Group-1314 (G0028) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078.002 OR T1059.003 OR T1072 OR T1021.002) OR threat.technique.id:(T1078.002 OR T1059.003 OR T1072 OR T1021.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Threat Group-1314 with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078.002 OR T1059.003 OR T1072 OR T1021.002) OR threat.technique.id:(T1078.002 OR T1059.003 OR T1072 OR T1021.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1072\"\n[[rule.threat.technique]]\nid = \"T1021.002\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1072\"\n[[rule.threat.technique]]\nid = \"T1021.002\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1072\"\n[[rule.threat.technique]]\nid = \"T1021.002\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1072\"\n[[rule.threat.technique]]\nid = \"T1021.002\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0029-scarlet-mimic.json b/app/playbooks/threat-groups/apt-g0029-scarlet-mimic.json
new file mode 100644
index 0000000..b52a61f
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0029-scarlet-mimic.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0029",
+ "num": 69,
+ "name": "MITRE ATT&CK Group — Scarlet Mimic",
+ "fullName": "Scarlet Mimic (G0029) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Scarlet Mimic](https://attack.mitre.org/groups/G0029) is a threat group that has targeted minority rights activists. This group has not been directly linked to a government source, but the group's motivations appear to overlap with those of the Chinese government. While there is some overlap between IP addresses used by [Scarlet Mimic](https://attack.mitre.org/groups/G0029) and [Putter Panda](https://attack.mitre.org/groups/G0024), it has not been concluded that the groups are the same. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Scarlet Mimic.",
+ "mitre": "T1036.002",
+ "aliases": [
+ "Scarlet Mimic"
+ ],
+ "mitreGroupId": "G0029",
+ "mitreUrl": "https://attack.mitre.org/groups/G0029",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Scarlet Mimic with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0029. Aliases: Scarlet Mimic. Primary mapped tactics: Stealth. Mapped techniques: T1036.002 Right-to-Left Override. Source: https://attack.mitre.org/groups/G0029. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Scarlet Mimic (G0029) ATT&CK technique pivots\n(rule.threat.technique.id:(T1036.002) OR threat.technique.id:(T1036.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Scarlet Mimic (G0029) ATT&CK technique pivots\n(rule.threat.technique.id:(T1036.002) OR threat.technique.id:(T1036.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Scarlet Mimic with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1036.002) OR threat.technique.id:(T1036.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1036.002\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1036.002\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1036.002\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1036.002\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0030-lotus-blossom.json b/app/playbooks/threat-groups/apt-g0030-lotus-blossom.json
new file mode 100644
index 0000000..185c5e0
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0030-lotus-blossom.json
@@ -0,0 +1,122 @@
+{
+ "id": "apt-g0030",
+ "num": 70,
+ "name": "MITRE ATT&CK Group — Lotus Blossom",
+ "fullName": "Lotus Blossom (G0030) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Lotus Blossom](https://attack.mitre.org/groups/G0030) is a long-standing threat group largely targeting various entities in Asia since at least 2009. In addition to government and related targets, [Lotus Blossom](https://attack.mitre.org/groups/G0030) has also targeted entities such as digital certificate issuers. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Lotus Blossom.",
+ "mitre": "T1047, T1112, T1543.003, T1134, T1539, T1012, T1016, T1016.001, T1018, T1046, T1049, T1083, T1087.001, T1087.002, T1482, T1074.001, T1560.001, T1560.003, T1090.001, T1090.003, T1588.002",
+ "aliases": [
+ "Lotus Blossom",
+ "DRAGONFISH",
+ "Spring Dragon",
+ "RADIUM",
+ "Raspberry Typhoon",
+ "Bilbug",
+ "Thrip"
+ ],
+ "mitreGroupId": "G0030",
+ "mitreUrl": "https://attack.mitre.org/groups/G0030",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Lotus Blossom with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0030. Aliases: Lotus Blossom, DRAGONFISH, Spring Dragon, RADIUM, Raspberry Typhoon, Bilbug, Thrip. Primary mapped tactics: Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Collection, Command and Control, Defense Impairment, Resource Development, Stealth. Mapped techniques: T1047 Windows Management Instrumentation, T1112 Modify Registry, T1543.003 Windows Service, T1134 Access Token Manipulation, T1539 Steal Web Session Cookie, T1012 Query Registry, T1016 System Network Configuration Discovery, T1016.001 Internet Connection Discovery, T1018 Remote System Discovery, T1046 Network Service Discovery, T1049 System Network Connections Discovery, T1083 File and Directory Discovery, plus 9 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0030. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Lotus Blossom (G0030) ATT&CK technique pivots\n(rule.threat.technique.id:(T1047 OR T1112 OR T1543.003 OR T1134 OR T1539 OR T1012 OR T1016 OR T1016.001 OR T1018 OR T1046 OR T1049 OR T1083 OR T1087.001 OR T1087.002 OR T1482 OR T1074.001 OR T1560.001 OR T1560.003 OR T1090.001 OR T1090.003) OR threat.technique.id:(T1047 OR T1112 OR T1543.003 OR T1134 OR T1539 OR T1012 OR T1016 OR T1016.001 OR T1018 OR T1046 OR T1049 OR T1083 OR T1087.001 OR T1087.002 OR T1482 OR T1074.001 OR T1560.001 OR T1560.003 OR T1090.001 OR T1090.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Lotus Blossom (G0030) ATT&CK technique pivots\n(rule.threat.technique.id:(T1047 OR T1112 OR T1543.003 OR T1134 OR T1539 OR T1012 OR T1016 OR T1016.001 OR T1018 OR T1046 OR T1049 OR T1083 OR T1087.001 OR T1087.002 OR T1482 OR T1074.001 OR T1560.001 OR T1560.003 OR T1090.001 OR T1090.003) OR threat.technique.id:(T1047 OR T1112 OR T1543.003 OR T1134 OR T1539 OR T1012 OR T1016 OR T1016.001 OR T1018 OR T1046 OR T1049 OR T1083 OR T1087.001 OR T1087.002 OR T1482 OR T1074.001 OR T1560.001 OR T1560.003 OR T1090.001 OR T1090.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Lotus Blossom with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1047 OR T1112 OR T1543.003 OR T1134 OR T1539 OR T1012 OR T1016 OR T1016.001 OR T1018 OR T1046 OR T1049 OR T1083 OR T1087.001 OR T1087.002 OR T1482 OR T1074.001 OR T1560.001 OR T1560.003 OR T1090.001 OR T1090.003) OR threat.technique.id:(T1047 OR T1112 OR T1543.003 OR T1134 OR T1539 OR T1012 OR T1016 OR T1016.001 OR T1018 OR T1046 OR T1049 OR T1083 OR T1087.001 OR T1087.002 OR T1482 OR T1074.001 OR T1560.001 OR T1560.003 OR T1090.001 OR T1090.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1112\"\n[[rule.threat.technique]]\nid = \"T1543.003\"\n[[rule.threat.technique]]\nid = \"T1134\"\n[[rule.threat.technique]]\nid = \"T1539\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1112\"\n[[rule.threat.technique]]\nid = \"T1543.003\"\n[[rule.threat.technique]]\nid = \"T1134\"\n[[rule.threat.technique]]\nid = \"T1539\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1112\"\n[[rule.threat.technique]]\nid = \"T1543.003\"\n[[rule.threat.technique]]\nid = \"T1134\"\n[[rule.threat.technique]]\nid = \"T1539\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1112\"\n[[rule.threat.technique]]\nid = \"T1543.003\"\n[[rule.threat.technique]]\nid = \"T1134\"\n[[rule.threat.technique]]\nid = \"T1539\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0032-lazarus-group.json b/app/playbooks/threat-groups/apt-g0032-lazarus-group.json
new file mode 100644
index 0000000..2ee9f37
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0032-lazarus-group.json
@@ -0,0 +1,122 @@
+{
+ "id": "apt-g0032",
+ "num": 71,
+ "name": "MITRE ATT&CK Group — Lazarus Group",
+ "fullName": "Lazarus Group (G0032) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Lazarus Group](https://attack.mitre.org/groups/G0032) is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). [Lazarus Group](https://attack.mitre.org/groups/G0032) has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by [Lazarus Group](https://attack.mitre.org/groups/G0032) correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain. North Korea’s cyber operations have shown a consistent pattern of adaptation, forming and reorganizing units as national priorities shift. These units frequently share personnel, infrastructure, malware, and tradecraft, making it difficult to attribute specific operations with high confidence. Public reporting often uses “Lazarus Group” as an umbrella term for multiple North Korean cyber operators conducting espionage, destructive attacks, and financially motivated campaigns. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Lazarus Group.",
+ "mitre": "T1078, T1189, T1566.001, T1566.002, T1566.003, T1047, T1053.005, T1059.001, T1059.003, T1059.005, T1106, T1203, T1204.002, T1574.001, T1574.013, T1098, T1542.003, T1543.003, T1547.001, T1547.009, T1055.001, T1134.002, T1056.001, T1110.003",
+ "aliases": [
+ "Lazarus Group",
+ "Labyrinth Chollima",
+ "HIDDEN COBRA",
+ "Guardians of Peace",
+ "ZINC",
+ "NICKEL ACADEMY",
+ "Diamond Sleet"
+ ],
+ "mitreGroupId": "G0032",
+ "mitreUrl": "https://attack.mitre.org/groups/G0032",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Lazarus Group with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0032. Aliases: Lazarus Group, Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, ZINC, NICKEL ACADEMY, Diamond Sleet. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact, Defense Impairment, Reconnaissance, Resource Development, Stealth. Mapped techniques: T1078 Valid Accounts, T1189 Drive-by Compromise, T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link, T1566.003 Spearphishing via Service, T1047 Windows Management Instrumentation, T1053.005 Scheduled Task, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1059.005 Visual Basic, T1106 Native API, T1203 Exploitation for Client Execution, plus 81 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0032. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Lazarus Group (G0032) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1189 OR T1566.001 OR T1566.002 OR T1566.003 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1106 OR T1203 OR T1204.002 OR T1574.001 OR T1574.013 OR T1098 OR T1542.003 OR T1543.003 OR T1547.001 OR T1547.009) OR threat.technique.id:(T1078 OR T1189 OR T1566.001 OR T1566.002 OR T1566.003 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1106 OR T1203 OR T1204.002 OR T1574.001 OR T1574.013 OR T1098 OR T1542.003 OR T1543.003 OR T1547.001 OR T1547.009) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Lazarus Group (G0032) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1189 OR T1566.001 OR T1566.002 OR T1566.003 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1106 OR T1203 OR T1204.002 OR T1574.001 OR T1574.013 OR T1098 OR T1542.003 OR T1543.003 OR T1547.001 OR T1547.009) OR threat.technique.id:(T1078 OR T1189 OR T1566.001 OR T1566.002 OR T1566.003 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1106 OR T1203 OR T1204.002 OR T1574.001 OR T1574.013 OR T1098 OR T1542.003 OR T1543.003 OR T1547.001 OR T1547.009) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Lazarus Group with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1189 OR T1566.001 OR T1566.002 OR T1566.003 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1106 OR T1203 OR T1204.002 OR T1574.001 OR T1574.013 OR T1098 OR T1542.003 OR T1543.003 OR T1547.001 OR T1547.009) OR threat.technique.id:(T1078 OR T1189 OR T1566.001 OR T1566.002 OR T1566.003 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1106 OR T1203 OR T1204.002 OR T1574.001 OR T1574.013 OR T1098 OR T1542.003 OR T1543.003 OR T1547.001 OR T1547.009) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1566.003\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1566.003\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1566.003\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1566.003\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0033-poseidon-group.json b/app/playbooks/threat-groups/apt-g0033-poseidon-group.json
new file mode 100644
index 0000000..d2846c4
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0033-poseidon-group.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0033",
+ "num": 72,
+ "name": "MITRE ATT&CK Group — Poseidon Group",
+ "fullName": "Poseidon Group (G0033) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Poseidon Group](https://attack.mitre.org/groups/G0033) is a Portuguese-speaking threat group that has been active since at least 2005. The group has a history of using information exfiltrated from victims to blackmail victim companies into contracting the [Poseidon Group](https://attack.mitre.org/groups/G0033) as a security firm. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Poseidon Group.",
+ "mitre": "T1059.001, T1003, T1007, T1049, T1057, T1087.001, T1087.002, T1036.005",
+ "aliases": [
+ "Poseidon Group"
+ ],
+ "mitreGroupId": "G0033",
+ "mitreUrl": "https://attack.mitre.org/groups/G0033",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Poseidon Group with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0033. Aliases: Poseidon Group. Primary mapped tactics: Execution, Credential Access, Discovery, Stealth. Mapped techniques: T1059.001 PowerShell, T1003 OS Credential Dumping, T1007 System Service Discovery, T1049 System Network Connections Discovery, T1057 Process Discovery, T1087.001 Local Account, T1087.002 Domain Account, T1036.005 Match Legitimate Resource Name or Location. Source: https://attack.mitre.org/groups/G0033. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Poseidon Group (G0033) ATT&CK technique pivots\n(rule.threat.technique.id:(T1059.001 OR T1003 OR T1007 OR T1049 OR T1057 OR T1087.001 OR T1087.002 OR T1036.005) OR threat.technique.id:(T1059.001 OR T1003 OR T1007 OR T1049 OR T1057 OR T1087.001 OR T1087.002 OR T1036.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Poseidon Group (G0033) ATT&CK technique pivots\n(rule.threat.technique.id:(T1059.001 OR T1003 OR T1007 OR T1049 OR T1057 OR T1087.001 OR T1087.002 OR T1036.005) OR threat.technique.id:(T1059.001 OR T1003 OR T1007 OR T1049 OR T1057 OR T1087.001 OR T1087.002 OR T1036.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Poseidon Group with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1059.001 OR T1003 OR T1007 OR T1049 OR T1057 OR T1087.001 OR T1087.002 OR T1036.005) OR threat.technique.id:(T1059.001 OR T1003 OR T1007 OR T1049 OR T1057 OR T1087.001 OR T1087.002 OR T1036.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1003\"\n[[rule.threat.technique]]\nid = \"T1007\"\n[[rule.threat.technique]]\nid = \"T1049\"\n[[rule.threat.technique]]\nid = \"T1057\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1003\"\n[[rule.threat.technique]]\nid = \"T1007\"\n[[rule.threat.technique]]\nid = \"T1049\"\n[[rule.threat.technique]]\nid = \"T1057\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1003\"\n[[rule.threat.technique]]\nid = \"T1007\"\n[[rule.threat.technique]]\nid = \"T1049\"\n[[rule.threat.technique]]\nid = \"T1057\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1003\"\n[[rule.threat.technique]]\nid = \"T1007\"\n[[rule.threat.technique]]\nid = \"T1049\"\n[[rule.threat.technique]]\nid = \"T1057\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0034-sandworm-team.json b/app/playbooks/threat-groups/apt-g0034-sandworm-team.json
new file mode 100644
index 0000000..14d187e
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0034-sandworm-team.json
@@ -0,0 +1,126 @@
+{
+ "id": "apt-g0034",
+ "num": 73,
+ "name": "MITRE ATT&CK Group — Sandworm Team",
+ "fullName": "Sandworm Team (G0034) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Sandworm Team](https://attack.mitre.org/groups/G0034) is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455. This group has been active since at least 2009. In October 2020, the US indicted six GRU Unit 74455 officers associated with [Sandworm Team](https://attack.mitre.org/groups/G0034) for the following cyber operations: the 2015 and 2016 attacks against Ukrainian electrical companies and government organizations, the 2017 worldwide [NotPetya](https://attack.mitre.org/software/S0368) attack, targeting of the 2017 French presidential campaign, the 2018 [Olympic Destroyer](https://attack.mitre.org/software/S0365) attack against the Winter Olympic Games, the 2018 operation against the Organisation for the Prohibition of Chemical Weapons, and attacks against the country of Georgia in 2018 and 2019. Some of these were conducted with the assistance of GRU Unit 26165, which is also referred to as [APT28](https://attack.mitre.org/groups/G0007). This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Sandworm Team.",
+ "mitre": "T1078, T1078.002, T1133, T1190, T1195, T1195.002, T1199, T1566.001, T1566.002, T1047, T1053.005, T1059.001, T1059.005, T1072, T1106, T1203, T1204.001, T1204.002, T1505.003, T1003.001, T1003.003, T1040, T1056.001, T1539",
+ "aliases": [
+ "Sandworm Team",
+ "ELECTRUM",
+ "Telebots",
+ "IRON VIKING",
+ "BlackEnergy (Group)",
+ "Quedagh",
+ "Voodoo Bear",
+ "IRIDIUM",
+ "Seashell Blizzard",
+ "FROZENBARENTS",
+ "APT44"
+ ],
+ "mitreGroupId": "G0034",
+ "mitreUrl": "https://attack.mitre.org/groups/G0034",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Sandworm Team with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0034. Aliases: Sandworm Team, ELECTRUM, Telebots, IRON VIKING, BlackEnergy (Group), Quedagh, Voodoo Bear, IRIDIUM, Seashell Blizzard, FROZENBARENTS, APT44. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact, Reconnaissance, Resource Development, Stealth. Mapped techniques: T1078 Valid Accounts, T1078.002 Domain Accounts, T1133 External Remote Services, T1190 Exploit Public-Facing Application, T1195 Supply Chain Compromise, T1195.002 Compromise Software Supply Chain, T1199 Trusted Relationship, T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link, T1047 Windows Management Instrumentation, T1053.005 Scheduled Task, T1059.001 PowerShell, plus 67 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0034. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Sandworm Team (G0034) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1078.002 OR T1133 OR T1190 OR T1195 OR T1195.002 OR T1199 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.005 OR T1072 OR T1106 OR T1203 OR T1204.001 OR T1204.002 OR T1505.003 OR T1003.001) OR threat.technique.id:(T1078 OR T1078.002 OR T1133 OR T1190 OR T1195 OR T1195.002 OR T1199 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.005 OR T1072 OR T1106 OR T1203 OR T1204.001 OR T1204.002 OR T1505.003 OR T1003.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Sandworm Team (G0034) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1078.002 OR T1133 OR T1190 OR T1195 OR T1195.002 OR T1199 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.005 OR T1072 OR T1106 OR T1203 OR T1204.001 OR T1204.002 OR T1505.003 OR T1003.001) OR threat.technique.id:(T1078 OR T1078.002 OR T1133 OR T1190 OR T1195 OR T1195.002 OR T1199 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.005 OR T1072 OR T1106 OR T1203 OR T1204.001 OR T1204.002 OR T1505.003 OR T1003.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Sandworm Team with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1078.002 OR T1133 OR T1190 OR T1195 OR T1195.002 OR T1199 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.005 OR T1072 OR T1106 OR T1203 OR T1204.001 OR T1204.002 OR T1505.003 OR T1003.001) OR threat.technique.id:(T1078 OR T1078.002 OR T1133 OR T1190 OR T1195 OR T1195.002 OR T1199 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.005 OR T1072 OR T1106 OR T1203 OR T1204.001 OR T1204.002 OR T1505.003 OR T1003.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1195\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1195\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1195\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1195\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0035-dragonfly.json b/app/playbooks/threat-groups/apt-g0035-dragonfly.json
new file mode 100644
index 0000000..5586c92
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0035-dragonfly.json
@@ -0,0 +1,125 @@
+{
+ "id": "apt-g0035",
+ "num": 74,
+ "name": "MITRE ATT&CK Group — Dragonfly",
+ "fullName": "Dragonfly (G0035) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Dragonfly](https://attack.mitre.org/groups/G0035) is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16. Active since at least 2010, [Dragonfly](https://attack.mitre.org/groups/G0035) has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Dragonfly.",
+ "mitre": "T1078, T1133, T1189, T1190, T1195.002, T1566.001, T1053.005, T1059, T1059.001, T1059.003, T1059.006, T1203, T1204.002, T1098.007, T1112, T1136.001, T1505.003, T1547.001, T1003.002, T1003.003, T1003.004, T1110, T1110.002, T1187",
+ "aliases": [
+ "Dragonfly",
+ "TEMP.Isotope",
+ "DYMALLOY",
+ "Berserk Bear",
+ "TG-4192",
+ "Crouching Yeti",
+ "IRON LIBERTY",
+ "Energetic Bear",
+ "Ghost Blizzard",
+ "BROMINE"
+ ],
+ "mitreGroupId": "G0035",
+ "mitreUrl": "https://attack.mitre.org/groups/G0035",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Dragonfly with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0035. Aliases: Dragonfly, TEMP.Isotope, DYMALLOY, Berserk Bear, TG-4192, Crouching Yeti, IRON LIBERTY, Energetic Bear, Ghost Blizzard, BROMINE. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Defense Impairment, Reconnaissance, Resource Development, Stealth. Mapped techniques: T1078 Valid Accounts, T1133 External Remote Services, T1189 Drive-by Compromise, T1190 Exploit Public-Facing Application, T1195.002 Compromise Software Supply Chain, T1566.001 Spearphishing Attachment, T1053.005 Scheduled Task, T1059 Command and Scripting Interpreter, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1059.006 Python, T1203 Exploitation for Client Execution, plus 44 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0035. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Dragonfly (G0035) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1133 OR T1189 OR T1190 OR T1195.002 OR T1566.001 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.006 OR T1203 OR T1204.002 OR T1098.007 OR T1112 OR T1136.001 OR T1505.003 OR T1547.001 OR T1003.002 OR T1003.003) OR threat.technique.id:(T1078 OR T1133 OR T1189 OR T1190 OR T1195.002 OR T1566.001 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.006 OR T1203 OR T1204.002 OR T1098.007 OR T1112 OR T1136.001 OR T1505.003 OR T1547.001 OR T1003.002 OR T1003.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Dragonfly (G0035) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1133 OR T1189 OR T1190 OR T1195.002 OR T1566.001 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.006 OR T1203 OR T1204.002 OR T1098.007 OR T1112 OR T1136.001 OR T1505.003 OR T1547.001 OR T1003.002 OR T1003.003) OR threat.technique.id:(T1078 OR T1133 OR T1189 OR T1190 OR T1195.002 OR T1566.001 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.006 OR T1203 OR T1204.002 OR T1098.007 OR T1112 OR T1136.001 OR T1505.003 OR T1547.001 OR T1003.002 OR T1003.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Dragonfly with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1133 OR T1189 OR T1190 OR T1195.002 OR T1566.001 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.006 OR T1203 OR T1204.002 OR T1098.007 OR T1112 OR T1136.001 OR T1505.003 OR T1547.001 OR T1003.002 OR T1003.003) OR threat.technique.id:(T1078 OR T1133 OR T1189 OR T1190 OR T1195.002 OR T1566.001 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.006 OR T1203 OR T1204.002 OR T1098.007 OR T1112 OR T1136.001 OR T1505.003 OR T1547.001 OR T1003.002 OR T1003.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1195.002\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1195.002\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1195.002\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1195.002\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0036-gcman.json b/app/playbooks/threat-groups/apt-g0036-gcman.json
new file mode 100644
index 0000000..31e06a3
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0036-gcman.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0036",
+ "num": 75,
+ "name": "MITRE ATT&CK Group — GCMAN",
+ "fullName": "GCMAN (G0036) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[GCMAN](https://attack.mitre.org/groups/G0036) is a threat group that focuses on targeting banks for the purpose of transferring money to e-currency services. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with GCMAN.",
+ "mitre": "T1021.004, T1021.005",
+ "aliases": [
+ "GCMAN"
+ ],
+ "mitreGroupId": "G0036",
+ "mitreUrl": "https://attack.mitre.org/groups/G0036",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile GCMAN with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0036. Aliases: GCMAN. Primary mapped tactics: Lateral Movement. Mapped techniques: T1021.004 SSH, T1021.005 VNC. Source: https://attack.mitre.org/groups/G0036. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - GCMAN (G0036) ATT&CK technique pivots\n(rule.threat.technique.id:(T1021.004 OR T1021.005) OR threat.technique.id:(T1021.004 OR T1021.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - GCMAN (G0036) ATT&CK technique pivots\n(rule.threat.technique.id:(T1021.004 OR T1021.005) OR threat.technique.id:(T1021.004 OR T1021.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile GCMAN with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1021.004 OR T1021.005) OR threat.technique.id:(T1021.004 OR T1021.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1021.004\"\n[[rule.threat.technique]]\nid = \"T1021.005\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1021.004\"\n[[rule.threat.technique]]\nid = \"T1021.005\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1021.004\"\n[[rule.threat.technique]]\nid = \"T1021.005\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1021.004\"\n[[rule.threat.technique]]\nid = \"T1021.005\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0037-fin6.json b/app/playbooks/threat-groups/apt-g0037-fin6.json
new file mode 100644
index 0000000..bde2f69
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0037-fin6.json
@@ -0,0 +1,121 @@
+{
+ "id": "apt-g0037",
+ "num": 76,
+ "name": "MITRE ATT&CK Group — FIN6",
+ "fullName": "FIN6 (G0037) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[FIN6](https://attack.mitre.org/groups/G0037) is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces. This group has aggressively targeted and compromised point of sale (PoS) systems in the hospitality and retail sectors. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with FIN6.",
+ "mitre": "T1078, T1566.001, T1566.003, T1047, T1053.005, T1059, T1059.001, T1059.003, T1059.007, T1204.002, T1569.002, T1547.001, T1068, T1134, T1003.001, T1003.003, T1110.002, T1555, T1555.003, T1018, T1046, T1087.002, T1021.001, T1005",
+ "aliases": [
+ "FIN6",
+ "Magecart Group 6",
+ "ITG08",
+ "Skeleton Spider",
+ "TAAL",
+ "Camouflage Tempest"
+ ],
+ "mitreGroupId": "G0037",
+ "mitreUrl": "https://attack.mitre.org/groups/G0037",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile FIN6 with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0037. Aliases: FIN6, Magecart Group 6, ITG08, Skeleton Spider, TAAL, Camouflage Tempest. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Defense Impairment, Resource Development, Stealth. Mapped techniques: T1078 Valid Accounts, T1566.001 Spearphishing Attachment, T1566.003 Spearphishing via Service, T1047 Windows Management Instrumentation, T1053.005 Scheduled Task, T1059 Command and Scripting Interpreter, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1059.007 JavaScript, T1204.002 Malicious File, T1569.002 Service Execution, T1547.001 Registry Run Keys / Startup Folder, plus 28 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0037. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - FIN6 (G0037) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1566.001 OR T1566.003 OR T1047 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.007 OR T1204.002 OR T1569.002 OR T1547.001 OR T1068 OR T1134 OR T1003.001 OR T1003.003 OR T1110.002 OR T1555 OR T1555.003 OR T1018) OR threat.technique.id:(T1078 OR T1566.001 OR T1566.003 OR T1047 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.007 OR T1204.002 OR T1569.002 OR T1547.001 OR T1068 OR T1134 OR T1003.001 OR T1003.003 OR T1110.002 OR T1555 OR T1555.003 OR T1018) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - FIN6 (G0037) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1566.001 OR T1566.003 OR T1047 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.007 OR T1204.002 OR T1569.002 OR T1547.001 OR T1068 OR T1134 OR T1003.001 OR T1003.003 OR T1110.002 OR T1555 OR T1555.003 OR T1018) OR threat.technique.id:(T1078 OR T1566.001 OR T1566.003 OR T1047 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.007 OR T1204.002 OR T1569.002 OR T1547.001 OR T1068 OR T1134 OR T1003.001 OR T1003.003 OR T1110.002 OR T1555 OR T1555.003 OR T1018) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile FIN6 with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1566.001 OR T1566.003 OR T1047 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.007 OR T1204.002 OR T1569.002 OR T1547.001 OR T1068 OR T1134 OR T1003.001 OR T1003.003 OR T1110.002 OR T1555 OR T1555.003 OR T1018) OR threat.technique.id:(T1078 OR T1566.001 OR T1566.003 OR T1047 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.007 OR T1204.002 OR T1569.002 OR T1547.001 OR T1068 OR T1134 OR T1003.001 OR T1003.003 OR T1110.002 OR T1555 OR T1555.003 OR T1018) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.003\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.003\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.003\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.003\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0038-stealth-falcon.json b/app/playbooks/threat-groups/apt-g0038-stealth-falcon.json
new file mode 100644
index 0000000..7bdd049
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0038-stealth-falcon.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0038",
+ "num": 77,
+ "name": "MITRE ATT&CK Group — Stealth Falcon",
+ "fullName": "Stealth Falcon (G0038) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Stealth Falcon](https://attack.mitre.org/groups/G0038) is a threat group that has conducted targeted spyware attacks against Emirati journalists, activists, and dissidents since at least 2012. Circumstantial evidence suggests there could be a link between this group and the United Arab Emirates (UAE) government, but that has not been confirmed. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Stealth Falcon.",
+ "mitre": "T1047, T1053.005, T1059, T1059.001, T1555, T1555.003, T1555.004, T1012, T1016, T1033, T1057, T1082, T1005, T1071.001, T1573.001, T1041",
+ "aliases": [
+ "Stealth Falcon"
+ ],
+ "mitreGroupId": "G0038",
+ "mitreUrl": "https://attack.mitre.org/groups/G0038",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Stealth Falcon with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0038. Aliases: Stealth Falcon. Primary mapped tactics: Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Collection, Command and Control, Exfiltration. Mapped techniques: T1047 Windows Management Instrumentation, T1053.005 Scheduled Task, T1059 Command and Scripting Interpreter, T1059.001 PowerShell, T1555 Credentials from Password Stores, T1555.003 Credentials from Web Browsers, T1555.004 Windows Credential Manager, T1012 Query Registry, T1016 System Network Configuration Discovery, T1033 System Owner/User Discovery, T1057 Process Discovery, T1082 System Information Discovery, plus 4 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0038. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Stealth Falcon (G0038) ATT&CK technique pivots\n(rule.threat.technique.id:(T1047 OR T1053.005 OR T1059 OR T1059.001 OR T1555 OR T1555.003 OR T1555.004 OR T1012 OR T1016 OR T1033 OR T1057 OR T1082 OR T1005 OR T1071.001 OR T1573.001 OR T1041) OR threat.technique.id:(T1047 OR T1053.005 OR T1059 OR T1059.001 OR T1555 OR T1555.003 OR T1555.004 OR T1012 OR T1016 OR T1033 OR T1057 OR T1082 OR T1005 OR T1071.001 OR T1573.001 OR T1041) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Stealth Falcon (G0038) ATT&CK technique pivots\n(rule.threat.technique.id:(T1047 OR T1053.005 OR T1059 OR T1059.001 OR T1555 OR T1555.003 OR T1555.004 OR T1012 OR T1016 OR T1033 OR T1057 OR T1082 OR T1005 OR T1071.001 OR T1573.001 OR T1041) OR threat.technique.id:(T1047 OR T1053.005 OR T1059 OR T1059.001 OR T1555 OR T1555.003 OR T1555.004 OR T1012 OR T1016 OR T1033 OR T1057 OR T1082 OR T1005 OR T1071.001 OR T1573.001 OR T1041) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Stealth Falcon with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1047 OR T1053.005 OR T1059 OR T1059.001 OR T1555 OR T1555.003 OR T1555.004 OR T1012 OR T1016 OR T1033 OR T1057 OR T1082 OR T1005 OR T1071.001 OR T1573.001 OR T1041) OR threat.technique.id:(T1047 OR T1053.005 OR T1059 OR T1059.001 OR T1555 OR T1555.003 OR T1555.004 OR T1012 OR T1016 OR T1033 OR T1057 OR T1082 OR T1005 OR T1071.001 OR T1573.001 OR T1041) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1555\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1555\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1555\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1555\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0039-suckfly.json b/app/playbooks/threat-groups/apt-g0039-suckfly.json
new file mode 100644
index 0000000..06e5f43
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0039-suckfly.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0039",
+ "num": 78,
+ "name": "MITRE ATT&CK Group — Suckfly",
+ "fullName": "Suckfly (G0039) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Suckfly](https://attack.mitre.org/groups/G0039) is a China-based threat group that has been active since at least 2014. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Suckfly.",
+ "mitre": "T1078, T1059.003, T1003, T1046, T1553.002",
+ "aliases": [
+ "Suckfly"
+ ],
+ "mitreGroupId": "G0039",
+ "mitreUrl": "https://attack.mitre.org/groups/G0039",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Suckfly with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0039. Aliases: Suckfly. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Defense Impairment, Stealth. Mapped techniques: T1078 Valid Accounts, T1059.003 Windows Command Shell, T1003 OS Credential Dumping, T1046 Network Service Discovery, T1553.002 Code Signing. Source: https://attack.mitre.org/groups/G0039. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Suckfly (G0039) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1059.003 OR T1003 OR T1046 OR T1553.002) OR threat.technique.id:(T1078 OR T1059.003 OR T1003 OR T1046 OR T1553.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Suckfly (G0039) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1059.003 OR T1003 OR T1046 OR T1553.002) OR threat.technique.id:(T1078 OR T1059.003 OR T1003 OR T1046 OR T1553.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Suckfly with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1059.003 OR T1003 OR T1046 OR T1553.002) OR threat.technique.id:(T1078 OR T1059.003 OR T1003 OR T1046 OR T1553.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1003\"\n[[rule.threat.technique]]\nid = \"T1046\"\n[[rule.threat.technique]]\nid = \"T1553.002\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1003\"\n[[rule.threat.technique]]\nid = \"T1046\"\n[[rule.threat.technique]]\nid = \"T1553.002\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1003\"\n[[rule.threat.technique]]\nid = \"T1046\"\n[[rule.threat.technique]]\nid = \"T1553.002\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1003\"\n[[rule.threat.technique]]\nid = \"T1046\"\n[[rule.threat.technique]]\nid = \"T1553.002\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0040-patchwork.json b/app/playbooks/threat-groups/apt-g0040-patchwork.json
new file mode 100644
index 0000000..650b398
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0040-patchwork.json
@@ -0,0 +1,121 @@
+{
+ "id": "apt-g0040",
+ "num": 79,
+ "name": "MITRE ATT&CK Group — Patchwork",
+ "fullName": "Patchwork (G0040) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Patchwork](https://attack.mitre.org/groups/G0040) is a cyber espionage group that was first observed in December 2015. While the group has not been definitively attributed, circumstantial evidence suggests the group may be a pro-Indian or Indian entity. [Patchwork](https://attack.mitre.org/groups/G0040) has been seen targeting industries related to diplomatic and government agencies. Much of the code used by this group was copied and pasted from online forums. [Patchwork](https://attack.mitre.org/groups/G0040) was also seen operating spearphishing campaigns targeting U.S. think tank groups in March and April of 2018. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Patchwork.",
+ "mitre": "T1189, T1566.001, T1566.002, T1053.005, T1059.001, T1059.003, T1059.005, T1197, T1203, T1204.001, T1204.002, T1559.002, T1574.001, T1112, T1547.001, T1055.012, T1548.002, T1555.003, T1033, T1082, T1083, T1518.001, T1680, T1021.001",
+ "aliases": [
+ "Patchwork",
+ "Hangover Group",
+ "Dropping Elephant",
+ "Chinastrats",
+ "MONSOON",
+ "Operation Hangover"
+ ],
+ "mitreGroupId": "G0040",
+ "mitreUrl": "https://attack.mitre.org/groups/G0040",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Patchwork with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0040. Aliases: Patchwork, Hangover Group, Dropping Elephant, Chinastrats, MONSOON, Operation Hangover. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Defense Impairment, Reconnaissance, Resource Development, Stealth. Mapped techniques: T1189 Drive-by Compromise, T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link, T1053.005 Scheduled Task, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1059.005 Visual Basic, T1197 BITS Jobs, T1203 Exploitation for Client Execution, T1204.001 Malicious Link, T1204.002 Malicious File, T1559.002 Dynamic Data Exchange, plus 29 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0040. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Patchwork (G0040) ATT&CK technique pivots\n(rule.threat.technique.id:(T1189 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1197 OR T1203 OR T1204.001 OR T1204.002 OR T1559.002 OR T1574.001 OR T1112 OR T1547.001 OR T1055.012 OR T1548.002 OR T1555.003 OR T1033 OR T1082) OR threat.technique.id:(T1189 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1197 OR T1203 OR T1204.001 OR T1204.002 OR T1559.002 OR T1574.001 OR T1112 OR T1547.001 OR T1055.012 OR T1548.002 OR T1555.003 OR T1033 OR T1082) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Patchwork (G0040) ATT&CK technique pivots\n(rule.threat.technique.id:(T1189 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1197 OR T1203 OR T1204.001 OR T1204.002 OR T1559.002 OR T1574.001 OR T1112 OR T1547.001 OR T1055.012 OR T1548.002 OR T1555.003 OR T1033 OR T1082) OR threat.technique.id:(T1189 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1197 OR T1203 OR T1204.001 OR T1204.002 OR T1559.002 OR T1574.001 OR T1112 OR T1547.001 OR T1055.012 OR T1548.002 OR T1555.003 OR T1033 OR T1082) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Patchwork with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1189 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1197 OR T1203 OR T1204.001 OR T1204.002 OR T1559.002 OR T1574.001 OR T1112 OR T1547.001 OR T1055.012 OR T1548.002 OR T1555.003 OR T1033 OR T1082) OR threat.technique.id:(T1189 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1197 OR T1203 OR T1204.001 OR T1204.002 OR T1559.002 OR T1574.001 OR T1112 OR T1547.001 OR T1055.012 OR T1548.002 OR T1555.003 OR T1033 OR T1082) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0041-strider.json b/app/playbooks/threat-groups/apt-g0041-strider.json
new file mode 100644
index 0000000..105e8cf
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0041-strider.json
@@ -0,0 +1,117 @@
+{
+ "id": "apt-g0041",
+ "num": 80,
+ "name": "MITRE ATT&CK Group — Strider",
+ "fullName": "Strider (G0041) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Strider](https://attack.mitre.org/groups/G0041) is a threat group that has been active since at least 2011 and has targeted victims in Russia, China, Sweden, Belgium, Iran, and Rwanda. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Strider.",
+ "mitre": "T1556.002, T1090.001, T1564.005",
+ "aliases": [
+ "Strider",
+ "ProjectSauron"
+ ],
+ "mitreGroupId": "G0041",
+ "mitreUrl": "https://attack.mitre.org/groups/G0041",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Strider with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0041. Aliases: Strider, ProjectSauron. Primary mapped tactics: Persistence, Credential Access, Command and Control, Defense Impairment, Stealth. Mapped techniques: T1556.002 Password Filter DLL, T1090.001 Internal Proxy, T1564.005 Hidden File System. Source: https://attack.mitre.org/groups/G0041. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Strider (G0041) ATT&CK technique pivots\n(rule.threat.technique.id:(T1556.002 OR T1090.001 OR T1564.005) OR threat.technique.id:(T1556.002 OR T1090.001 OR T1564.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Strider (G0041) ATT&CK technique pivots\n(rule.threat.technique.id:(T1556.002 OR T1090.001 OR T1564.005) OR threat.technique.id:(T1556.002 OR T1090.001 OR T1564.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Strider with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1556.002 OR T1090.001 OR T1564.005) OR threat.technique.id:(T1556.002 OR T1090.001 OR T1564.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1556.002\"\n[[rule.threat.technique]]\nid = \"T1090.001\"\n[[rule.threat.technique]]\nid = \"T1564.005\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1556.002\"\n[[rule.threat.technique]]\nid = \"T1090.001\"\n[[rule.threat.technique]]\nid = \"T1564.005\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1556.002\"\n[[rule.threat.technique]]\nid = \"T1090.001\"\n[[rule.threat.technique]]\nid = \"T1564.005\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1556.002\"\n[[rule.threat.technique]]\nid = \"T1090.001\"\n[[rule.threat.technique]]\nid = \"T1564.005\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0043-group5.json b/app/playbooks/threat-groups/apt-g0043-group5.json
new file mode 100644
index 0000000..032f358
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0043-group5.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0043",
+ "num": 81,
+ "name": "MITRE ATT&CK Group — Group5",
+ "fullName": "Group5 (G0043) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Group5](https://attack.mitre.org/groups/G0043) is a threat group with a suspected Iranian nexus, though this attribution is not definite. The group has targeted individuals connected to the Syrian opposition via spearphishing and watering holes, normally using Syrian and Iranian themes. [Group5](https://attack.mitre.org/groups/G0043) has used two commonly available remote access tools (RATs), [njRAT](https://attack.mitre.org/software/S0385) and [NanoCore](https://attack.mitre.org/software/S0336), as well as an Android RAT, DroidJack. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Group5.",
+ "mitre": "T1056.001, T1113, T1027.013, T1070.004",
+ "aliases": [
+ "Group5"
+ ],
+ "mitreGroupId": "G0043",
+ "mitreUrl": "https://attack.mitre.org/groups/G0043",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Group5 with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0043. Aliases: Group5. Primary mapped tactics: Credential Access, Collection, Stealth. Mapped techniques: T1056.001 Keylogging, T1113 Screen Capture, T1027.013 Encrypted/Encoded File, T1070.004 File Deletion. Source: https://attack.mitre.org/groups/G0043. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Group5 (G0043) ATT&CK technique pivots\n(rule.threat.technique.id:(T1056.001 OR T1113 OR T1027.013 OR T1070.004) OR threat.technique.id:(T1056.001 OR T1113 OR T1027.013 OR T1070.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Group5 (G0043) ATT&CK technique pivots\n(rule.threat.technique.id:(T1056.001 OR T1113 OR T1027.013 OR T1070.004) OR threat.technique.id:(T1056.001 OR T1113 OR T1027.013 OR T1070.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Group5 with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1056.001 OR T1113 OR T1027.013 OR T1070.004) OR threat.technique.id:(T1056.001 OR T1113 OR T1027.013 OR T1070.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1056.001\"\n[[rule.threat.technique]]\nid = \"T1113\"\n[[rule.threat.technique]]\nid = \"T1027.013\"\n[[rule.threat.technique]]\nid = \"T1070.004\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1056.001\"\n[[rule.threat.technique]]\nid = \"T1113\"\n[[rule.threat.technique]]\nid = \"T1027.013\"\n[[rule.threat.technique]]\nid = \"T1070.004\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1056.001\"\n[[rule.threat.technique]]\nid = \"T1113\"\n[[rule.threat.technique]]\nid = \"T1027.013\"\n[[rule.threat.technique]]\nid = \"T1070.004\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1056.001\"\n[[rule.threat.technique]]\nid = \"T1113\"\n[[rule.threat.technique]]\nid = \"T1027.013\"\n[[rule.threat.technique]]\nid = \"T1070.004\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0044-winnti-group.json b/app/playbooks/threat-groups/apt-g0044-winnti-group.json
new file mode 100644
index 0000000..7949192
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0044-winnti-group.json
@@ -0,0 +1,117 @@
+{
+ "id": "apt-g0044",
+ "num": 82,
+ "name": "MITRE ATT&CK Group — Winnti Group",
+ "fullName": "Winnti Group (G0044) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Winnti Group](https://attack.mitre.org/groups/G0044) is a threat group with Chinese origins that has been active since at least 2010. The group has heavily targeted the gaming industry, but it has also expanded the scope of its targeting. Some reporting suggests a number of other groups, including [Axiom](https://attack.mitre.org/groups/G0001), [APT17](https://attack.mitre.org/groups/G0025), and [Ke3chang](https://attack.mitre.org/groups/G0004), are closely linked to [Winnti Group](https://attack.mitre.org/groups/G0044). This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Winnti Group.",
+ "mitre": "T1057, T1083, T1105, T1553.002, T1583.001, T1014",
+ "aliases": [
+ "Winnti Group",
+ "Blackfly"
+ ],
+ "mitreGroupId": "G0044",
+ "mitreUrl": "https://attack.mitre.org/groups/G0044",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Winnti Group with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0044. Aliases: Winnti Group, Blackfly. Primary mapped tactics: Discovery, Command and Control, Defense Impairment, Resource Development, Stealth. Mapped techniques: T1057 Process Discovery, T1083 File and Directory Discovery, T1105 Ingress Tool Transfer, T1553.002 Code Signing, T1583.001 Domains, T1014 Rootkit. Source: https://attack.mitre.org/groups/G0044. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Winnti Group (G0044) ATT&CK technique pivots\n(rule.threat.technique.id:(T1057 OR T1083 OR T1105 OR T1553.002 OR T1583.001 OR T1014) OR threat.technique.id:(T1057 OR T1083 OR T1105 OR T1553.002 OR T1583.001 OR T1014) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Winnti Group (G0044) ATT&CK technique pivots\n(rule.threat.technique.id:(T1057 OR T1083 OR T1105 OR T1553.002 OR T1583.001 OR T1014) OR threat.technique.id:(T1057 OR T1083 OR T1105 OR T1553.002 OR T1583.001 OR T1014) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Winnti Group with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1057 OR T1083 OR T1105 OR T1553.002 OR T1583.001 OR T1014) OR threat.technique.id:(T1057 OR T1083 OR T1105 OR T1553.002 OR T1583.001 OR T1014) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1057\"\n[[rule.threat.technique]]\nid = \"T1083\"\n[[rule.threat.technique]]\nid = \"T1105\"\n[[rule.threat.technique]]\nid = \"T1553.002\"\n[[rule.threat.technique]]\nid = \"T1583.001\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1057\"\n[[rule.threat.technique]]\nid = \"T1083\"\n[[rule.threat.technique]]\nid = \"T1105\"\n[[rule.threat.technique]]\nid = \"T1553.002\"\n[[rule.threat.technique]]\nid = \"T1583.001\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1057\"\n[[rule.threat.technique]]\nid = \"T1083\"\n[[rule.threat.technique]]\nid = \"T1105\"\n[[rule.threat.technique]]\nid = \"T1553.002\"\n[[rule.threat.technique]]\nid = \"T1583.001\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1057\"\n[[rule.threat.technique]]\nid = \"T1083\"\n[[rule.threat.technique]]\nid = \"T1105\"\n[[rule.threat.technique]]\nid = \"T1553.002\"\n[[rule.threat.technique]]\nid = \"T1583.001\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0045-menupass.json b/app/playbooks/threat-groups/apt-g0045-menupass.json
new file mode 100644
index 0000000..af2b9fb
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0045-menupass.json
@@ -0,0 +1,124 @@
+{
+ "id": "apt-g0045",
+ "num": 83,
+ "name": "MITRE ATT&CK Group — menuPass",
+ "fullName": "menuPass (G0045) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[menuPass](https://attack.mitre.org/groups/G0045) is a threat group that has been active since at least 2006. Individual members of [menuPass](https://attack.mitre.org/groups/G0045) are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company. [menuPass](https://attack.mitre.org/groups/G0045) has targeted healthcare, defense, aerospace, finance, maritime, biotechnology, energy, and government sectors globally, with an emphasis on Japanese organizations. In 2016 and 2017, the group is known to have targeted managed IT service providers (MSPs), manufacturing and mining companies, and a university. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with menuPass.",
+ "mitre": "T1078, T1190, T1199, T1566.001, T1047, T1053.005, T1059.001, T1059.003, T1106, T1204.002, T1574.001, T1055.012, T1003.002, T1003.003, T1003.004, T1056.001, T1016, T1018, T1046, T1049, T1083, T1087.002, T1021.001, T1021.004",
+ "aliases": [
+ "menuPass",
+ "Cicada",
+ "POTASSIUM",
+ "Stone Panda",
+ "APT10",
+ "Red Apollo",
+ "CVNX",
+ "HOGFISH",
+ "BRONZE RIVERSIDE"
+ ],
+ "mitreGroupId": "G0045",
+ "mitreUrl": "https://attack.mitre.org/groups/G0045",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile menuPass with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0045. Aliases: menuPass, Cicada, POTASSIUM, Stone Panda, APT10, Red Apollo, CVNX, HOGFISH, BRONZE RIVERSIDE. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Defense Impairment, Resource Development, Stealth. Mapped techniques: T1078 Valid Accounts, T1190 Exploit Public-Facing Application, T1199 Trusted Relationship, T1566.001 Spearphishing Attachment, T1047 Windows Management Instrumentation, T1053.005 Scheduled Task, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1106 Native API, T1204.002 Malicious File, T1574.001 DLL, T1055.012 Process Hollowing, plus 34 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0045. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - menuPass (G0045) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1190 OR T1199 OR T1566.001 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1106 OR T1204.002 OR T1574.001 OR T1055.012 OR T1003.002 OR T1003.003 OR T1003.004 OR T1056.001 OR T1016 OR T1018 OR T1046 OR T1049) OR threat.technique.id:(T1078 OR T1190 OR T1199 OR T1566.001 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1106 OR T1204.002 OR T1574.001 OR T1055.012 OR T1003.002 OR T1003.003 OR T1003.004 OR T1056.001 OR T1016 OR T1018 OR T1046 OR T1049) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - menuPass (G0045) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1190 OR T1199 OR T1566.001 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1106 OR T1204.002 OR T1574.001 OR T1055.012 OR T1003.002 OR T1003.003 OR T1003.004 OR T1056.001 OR T1016 OR T1018 OR T1046 OR T1049) OR threat.technique.id:(T1078 OR T1190 OR T1199 OR T1566.001 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1106 OR T1204.002 OR T1574.001 OR T1055.012 OR T1003.002 OR T1003.003 OR T1003.004 OR T1056.001 OR T1016 OR T1018 OR T1046 OR T1049) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile menuPass with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1190 OR T1199 OR T1566.001 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1106 OR T1204.002 OR T1574.001 OR T1055.012 OR T1003.002 OR T1003.003 OR T1003.004 OR T1056.001 OR T1016 OR T1018 OR T1046 OR T1049) OR threat.technique.id:(T1078 OR T1190 OR T1199 OR T1566.001 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1106 OR T1204.002 OR T1574.001 OR T1055.012 OR T1003.002 OR T1003.003 OR T1003.004 OR T1056.001 OR T1016 OR T1018 OR T1046 OR T1049) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1199\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1047\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1199\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1047\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1199\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1047\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1199\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1047\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0046-fin7.json b/app/playbooks/threat-groups/apt-g0046-fin7.json
new file mode 100644
index 0000000..fef715e
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0046-fin7.json
@@ -0,0 +1,121 @@
+{
+ "id": "apt-g0046",
+ "num": 84,
+ "name": "MITRE ATT&CK Group — FIN7",
+ "fullName": "FIN7 (G0046) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[FIN7](https://attack.mitre.org/groups/G0046) is a financially-motivated threat group that has been active since 2013. [FIN7](https://attack.mitre.org/groups/G0046) has targeted the retail, restaurant, hospitality, software, consulting, financial services, medical equipment, cloud services, media, food and beverage, transportation, pharmaceutical, and utilities industries in the United States. A portion of [FIN7](https://attack.mitre.org/groups/G0046) was operated out of a front company called Combi Security and often used point-of-sale malware for targeting efforts. Since 2020, [FIN7](https://attack.mitre.org/groups/G0046) shifted operations to big game hunting (BGH), including use of [REvil](https://attack.mitre.org/software/S0496) ransomware and their own Ransomware-as-a-Service (RaaS), Darkside. FIN7 may be linked to the [Carbanak](https://attack.mitre.org/groups/G0008) Group, but multiple threat groups have been observed using [Carbanak](https://attack.mitre.org/software/S0030), leading these groups to be tracked separately. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with FIN7.",
+ "mitre": "T1078, T1078.003, T1091, T1190, T1195.002, T1566.001, T1566.002, T1047, T1053.005, T1059, T1059.001, T1059.003, T1059.005, T1059.007, T1204.001, T1204.002, T1559.002, T1569.002, T1674, T1543.003, T1546.011, T1547.001, T1558.003, T1033",
+ "aliases": [
+ "FIN7",
+ "GOLD NIAGARA",
+ "ITG14",
+ "Carbon Spider",
+ "ELBRUS",
+ "Sangria Tempest"
+ ],
+ "mitreGroupId": "G0046",
+ "mitreUrl": "https://attack.mitre.org/groups/G0046",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile FIN7 with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0046. Aliases: FIN7, GOLD NIAGARA, ITG14, Carbon Spider, ELBRUS, Sangria Tempest. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact, Defense Impairment, Reconnaissance, Resource Development, Stealth. Mapped techniques: T1078 Valid Accounts, T1078.003 Local Accounts, T1091 Replication Through Removable Media, T1190 Exploit Public-Facing Application, T1195.002 Compromise Software Supply Chain, T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link, T1047 Windows Management Instrumentation, T1053.005 Scheduled Task, T1059 Command and Scripting Interpreter, T1059.001 PowerShell, T1059.003 Windows Command Shell, plus 55 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0046. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - FIN7 (G0046) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1078.003 OR T1091 OR T1190 OR T1195.002 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1204.001 OR T1204.002 OR T1559.002 OR T1569.002 OR T1674 OR T1543.003) OR threat.technique.id:(T1078 OR T1078.003 OR T1091 OR T1190 OR T1195.002 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1204.001 OR T1204.002 OR T1559.002 OR T1569.002 OR T1674 OR T1543.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - FIN7 (G0046) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1078.003 OR T1091 OR T1190 OR T1195.002 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1204.001 OR T1204.002 OR T1559.002 OR T1569.002 OR T1674 OR T1543.003) OR threat.technique.id:(T1078 OR T1078.003 OR T1091 OR T1190 OR T1195.002 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1204.001 OR T1204.002 OR T1559.002 OR T1569.002 OR T1674 OR T1543.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile FIN7 with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1078.003 OR T1091 OR T1190 OR T1195.002 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1204.001 OR T1204.002 OR T1559.002 OR T1569.002 OR T1674 OR T1543.003) OR threat.technique.id:(T1078 OR T1078.003 OR T1091 OR T1190 OR T1195.002 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1204.001 OR T1204.002 OR T1559.002 OR T1569.002 OR T1674 OR T1543.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1091\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1195.002\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1091\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1195.002\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1091\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1195.002\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1091\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1195.002\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0047-gamaredon-group.json b/app/playbooks/threat-groups/apt-g0047-gamaredon-group.json
new file mode 100644
index 0000000..b061df7
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0047-gamaredon-group.json
@@ -0,0 +1,124 @@
+{
+ "id": "apt-g0047",
+ "num": 85,
+ "name": "MITRE ATT&CK Group — Gamaredon Group",
+ "fullName": "Gamaredon Group (G0047) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Gamaredon Group](https://attack.mitre.org/groups/G0047) is a suspected Russian cyber espionage group that has targeted military, law enforcement, judiciary, non-profit, and non-governmental organizations in Ukraine since at least 2013. The name [Gamaredon Group](https://attack.mitre.org/groups/G0047) derives from a misspelling of the word \"Armageddon,\" found in early campaigns. In November 2021, the Ukrainian government publicly attributed [Gamaredon Group](https://attack.mitre.org/groups/G0047) to Russia’s Federal Security Service (FSB) Center 18, an assessment later supported by multiple independent cybersecurity researchers. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Gamaredon Group.",
+ "mitre": "T1091, T1566.001, T1047, T1053.005, T1059.001, T1059.003, T1059.005, T1106, T1204.001, T1204.002, T1559.001, T1112, T1137, T1547.001, T1055, T1012, T1016.001, T1033, T1057, T1082, T1083, T1120, T1497.001, T1518.001",
+ "aliases": [
+ "Gamaredon Group",
+ "IRON TILDEN",
+ "Primitive Bear",
+ "ACTINIUM",
+ "Armageddon",
+ "Shuckworm",
+ "DEV-0157",
+ "Aqua Blizzard",
+ "NastyShrew"
+ ],
+ "mitreGroupId": "G0047",
+ "mitreUrl": "https://attack.mitre.org/groups/G0047",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Gamaredon Group with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0047. Aliases: Gamaredon Group, IRON TILDEN, Primitive Bear, ACTINIUM, Armageddon, Shuckworm, DEV-0157, Aqua Blizzard, NastyShrew. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact, Defense Impairment, Resource Development, Stealth. Mapped techniques: T1091 Replication Through Removable Media, T1566.001 Spearphishing Attachment, T1047 Windows Management Instrumentation, T1053.005 Scheduled Task, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1059.005 Visual Basic, T1106 Native API, T1204.001 Malicious Link, T1204.002 Malicious File, T1559.001 Component Object Model, T1112 Modify Registry, plus 58 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0047. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Gamaredon Group (G0047) ATT&CK technique pivots\n(rule.threat.technique.id:(T1091 OR T1566.001 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1106 OR T1204.001 OR T1204.002 OR T1559.001 OR T1112 OR T1137 OR T1547.001 OR T1055 OR T1012 OR T1016.001 OR T1033 OR T1057 OR T1082) OR threat.technique.id:(T1091 OR T1566.001 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1106 OR T1204.001 OR T1204.002 OR T1559.001 OR T1112 OR T1137 OR T1547.001 OR T1055 OR T1012 OR T1016.001 OR T1033 OR T1057 OR T1082) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Gamaredon Group (G0047) ATT&CK technique pivots\n(rule.threat.technique.id:(T1091 OR T1566.001 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1106 OR T1204.001 OR T1204.002 OR T1559.001 OR T1112 OR T1137 OR T1547.001 OR T1055 OR T1012 OR T1016.001 OR T1033 OR T1057 OR T1082) OR threat.technique.id:(T1091 OR T1566.001 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1106 OR T1204.001 OR T1204.002 OR T1559.001 OR T1112 OR T1137 OR T1547.001 OR T1055 OR T1012 OR T1016.001 OR T1033 OR T1057 OR T1082) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Gamaredon Group with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1091 OR T1566.001 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1106 OR T1204.001 OR T1204.002 OR T1559.001 OR T1112 OR T1137 OR T1547.001 OR T1055 OR T1012 OR T1016.001 OR T1033 OR T1057 OR T1082) OR threat.technique.id:(T1091 OR T1566.001 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1106 OR T1204.001 OR T1204.002 OR T1559.001 OR T1112 OR T1137 OR T1547.001 OR T1055 OR T1012 OR T1016.001 OR T1033 OR T1057 OR T1082) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1091\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1091\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1091\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1091\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0048-rtm.json b/app/playbooks/threat-groups/apt-g0048-rtm.json
new file mode 100644
index 0000000..4e9384b
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0048-rtm.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0048",
+ "num": 86,
+ "name": "MITRE ATT&CK Group — RTM",
+ "fullName": "RTM (G0048) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[RTM](https://attack.mitre.org/groups/G0048) is a cybercriminal group that has been active since at least 2015 and is primarily interested in users of remote banking systems in Russia and neighboring countries. The group uses a Trojan by the same name ([RTM](https://attack.mitre.org/software/S0148)). This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with RTM.",
+ "mitre": "T1189, T1566.001, T1204.002, T1574.001, T1547.001, T1102.001, T1219.002",
+ "aliases": [
+ "RTM"
+ ],
+ "mitreGroupId": "G0048",
+ "mitreUrl": "https://attack.mitre.org/groups/G0048",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile RTM with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0048. Aliases: RTM. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Command and Control, Stealth. Mapped techniques: T1189 Drive-by Compromise, T1566.001 Spearphishing Attachment, T1204.002 Malicious File, T1574.001 DLL, T1547.001 Registry Run Keys / Startup Folder, T1102.001 Dead Drop Resolver, T1219.002 Remote Desktop Software. Source: https://attack.mitre.org/groups/G0048. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - RTM (G0048) ATT&CK technique pivots\n(rule.threat.technique.id:(T1189 OR T1566.001 OR T1204.002 OR T1574.001 OR T1547.001 OR T1102.001 OR T1219.002) OR threat.technique.id:(T1189 OR T1566.001 OR T1204.002 OR T1574.001 OR T1547.001 OR T1102.001 OR T1219.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - RTM (G0048) ATT&CK technique pivots\n(rule.threat.technique.id:(T1189 OR T1566.001 OR T1204.002 OR T1574.001 OR T1547.001 OR T1102.001 OR T1219.002) OR threat.technique.id:(T1189 OR T1566.001 OR T1204.002 OR T1574.001 OR T1547.001 OR T1102.001 OR T1219.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile RTM with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1189 OR T1566.001 OR T1204.002 OR T1574.001 OR T1547.001 OR T1102.001 OR T1219.002) OR threat.technique.id:(T1189 OR T1566.001 OR T1204.002 OR T1574.001 OR T1547.001 OR T1102.001 OR T1219.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1574.001\"\n[[rule.threat.technique]]\nid = \"T1547.001\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1574.001\"\n[[rule.threat.technique]]\nid = \"T1547.001\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1574.001\"\n[[rule.threat.technique]]\nid = \"T1547.001\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1574.001\"\n[[rule.threat.technique]]\nid = \"T1547.001\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0049-oilrig.json b/app/playbooks/threat-groups/apt-g0049-oilrig.json
new file mode 100644
index 0000000..15a4abc
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0049-oilrig.json
@@ -0,0 +1,127 @@
+{
+ "id": "apt-g0049",
+ "num": 87,
+ "name": "MITRE ATT&CK Group — OilRig",
+ "fullName": "OilRig (G0049) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[OilRig](https://attack.mitre.org/groups/G0049) is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. The group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with OilRig.",
+ "mitre": "T1078, T1078.002, T1133, T1195, T1566.001, T1566.002, T1566.003, T1047, T1053.005, T1059, T1059.001, T1059.003, T1059.005, T1203, T1204.001, T1204.002, T1112, T1137.004, T1505.003, T1543.003, T1556.002, T1068, T1003.001, T1003.004",
+ "aliases": [
+ "OilRig",
+ "COBALT GYPSY",
+ "IRN2",
+ "APT34",
+ "Helix Kitten",
+ "Evasive Serpens",
+ "Hazel Sandstorm",
+ "EUROPIUM",
+ "ITG13",
+ "Earth Simnavaz",
+ "Crambus",
+ "TA452"
+ ],
+ "mitreGroupId": "G0049",
+ "mitreUrl": "https://attack.mitre.org/groups/G0049",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile OilRig with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0049. Aliases: OilRig, COBALT GYPSY, IRN2, APT34, Helix Kitten, Evasive Serpens, Hazel Sandstorm, EUROPIUM, ITG13, Earth Simnavaz, Crambus, TA452. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Defense Impairment, Resource Development, Stealth. Mapped techniques: T1078 Valid Accounts, T1078.002 Domain Accounts, T1133 External Remote Services, T1195 Supply Chain Compromise, T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link, T1566.003 Spearphishing via Service, T1047 Windows Management Instrumentation, T1053.005 Scheduled Task, T1059 Command and Scripting Interpreter, T1059.001 PowerShell, T1059.003 Windows Command Shell, plus 64 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0049. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - OilRig (G0049) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1078.002 OR T1133 OR T1195 OR T1566.001 OR T1566.002 OR T1566.003 OR T1047 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.005 OR T1203 OR T1204.001 OR T1204.002 OR T1112 OR T1137.004 OR T1505.003 OR T1543.003) OR threat.technique.id:(T1078 OR T1078.002 OR T1133 OR T1195 OR T1566.001 OR T1566.002 OR T1566.003 OR T1047 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.005 OR T1203 OR T1204.001 OR T1204.002 OR T1112 OR T1137.004 OR T1505.003 OR T1543.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - OilRig (G0049) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1078.002 OR T1133 OR T1195 OR T1566.001 OR T1566.002 OR T1566.003 OR T1047 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.005 OR T1203 OR T1204.001 OR T1204.002 OR T1112 OR T1137.004 OR T1505.003 OR T1543.003) OR threat.technique.id:(T1078 OR T1078.002 OR T1133 OR T1195 OR T1566.001 OR T1566.002 OR T1566.003 OR T1047 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.005 OR T1203 OR T1204.001 OR T1204.002 OR T1112 OR T1137.004 OR T1505.003 OR T1543.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile OilRig with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1078.002 OR T1133 OR T1195 OR T1566.001 OR T1566.002 OR T1566.003 OR T1047 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.005 OR T1203 OR T1204.001 OR T1204.002 OR T1112 OR T1137.004 OR T1505.003 OR T1543.003) OR threat.technique.id:(T1078 OR T1078.002 OR T1133 OR T1195 OR T1566.001 OR T1566.002 OR T1566.003 OR T1047 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.005 OR T1203 OR T1204.001 OR T1204.002 OR T1112 OR T1137.004 OR T1505.003 OR T1543.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1195\"\n[[rule.threat.technique]]\nid = \"T1566.001\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1195\"\n[[rule.threat.technique]]\nid = \"T1566.001\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1195\"\n[[rule.threat.technique]]\nid = \"T1566.001\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1195\"\n[[rule.threat.technique]]\nid = \"T1566.001\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0050-apt32.json b/app/playbooks/threat-groups/apt-g0050-apt32.json
new file mode 100644
index 0000000..f5c1cea
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0050-apt32.json
@@ -0,0 +1,121 @@
+{
+ "id": "apt-g0050",
+ "num": 88,
+ "name": "MITRE ATT&CK Group — APT32",
+ "fullName": "APT32 (G0050) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[APT32](https://attack.mitre.org/groups/G0050) is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web compromises to compromise victims. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with APT32.",
+ "mitre": "T1078.003, T1189, T1566.001, T1566.002, T1047, T1053.005, T1059, T1059.001, T1059.003, T1059.005, T1059.007, T1072, T1203, T1204.001, T1204.002, T1569.002, T1574.001, T1112, T1137, T1505.003, T1543.003, T1547.001, T1055, T1068",
+ "aliases": [
+ "APT32",
+ "SeaLotus",
+ "OceanLotus",
+ "APT-C-00",
+ "Canvas Cyclone",
+ "BISMUTH"
+ ],
+ "mitreGroupId": "G0050",
+ "mitreUrl": "https://attack.mitre.org/groups/G0050",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile APT32 with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0050. Aliases: APT32, SeaLotus, OceanLotus, APT-C-00, Canvas Cyclone, BISMUTH. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Defense Impairment, Reconnaissance, Resource Development, Stealth. Mapped techniques: T1078.003 Local Accounts, T1189 Drive-by Compromise, T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link, T1047 Windows Management Instrumentation, T1053.005 Scheduled Task, T1059 Command and Scripting Interpreter, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1059.005 Visual Basic, T1059.007 JavaScript, T1072 Software Deployment Tools, plus 66 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0050. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - APT32 (G0050) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078.003 OR T1189 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1072 OR T1203 OR T1204.001 OR T1204.002 OR T1569.002 OR T1574.001 OR T1112 OR T1137 OR T1505.003) OR threat.technique.id:(T1078.003 OR T1189 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1072 OR T1203 OR T1204.001 OR T1204.002 OR T1569.002 OR T1574.001 OR T1112 OR T1137 OR T1505.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - APT32 (G0050) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078.003 OR T1189 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1072 OR T1203 OR T1204.001 OR T1204.002 OR T1569.002 OR T1574.001 OR T1112 OR T1137 OR T1505.003) OR threat.technique.id:(T1078.003 OR T1189 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1072 OR T1203 OR T1204.001 OR T1204.002 OR T1569.002 OR T1574.001 OR T1112 OR T1137 OR T1505.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile APT32 with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078.003 OR T1189 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1072 OR T1203 OR T1204.001 OR T1204.002 OR T1569.002 OR T1574.001 OR T1112 OR T1137 OR T1505.003) OR threat.technique.id:(T1078.003 OR T1189 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1072 OR T1203 OR T1204.001 OR T1204.002 OR T1569.002 OR T1574.001 OR T1112 OR T1137 OR T1505.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1047\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1047\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1047\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1047\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0051-fin10.json b/app/playbooks/threat-groups/apt-g0051-fin10.json
new file mode 100644
index 0000000..0ce405e
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0051-fin10.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0051",
+ "num": 89,
+ "name": "MITRE ATT&CK Group — FIN10",
+ "fullName": "FIN10 (G0051) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[FIN10](https://attack.mitre.org/groups/G0051) is a financially motivated threat group that has targeted organizations in North America since at least 2013 through 2016. The group uses stolen data exfiltrated from victims to extort organizations. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with FIN10.",
+ "mitre": "T1078, T1078.003, T1053.005, T1059.001, T1059.003, T1547.001, T1033, T1021.001, T1570, T1588.002, T1070.004",
+ "aliases": [
+ "FIN10"
+ ],
+ "mitreGroupId": "G0051",
+ "mitreUrl": "https://attack.mitre.org/groups/G0051",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile FIN10 with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0051. Aliases: FIN10. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Discovery, Lateral Movement, Resource Development, Stealth. Mapped techniques: T1078 Valid Accounts, T1078.003 Local Accounts, T1053.005 Scheduled Task, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1547.001 Registry Run Keys / Startup Folder, T1033 System Owner/User Discovery, T1021.001 Remote Desktop Protocol, T1570 Lateral Tool Transfer, T1588.002 Tool, T1070.004 File Deletion. Source: https://attack.mitre.org/groups/G0051. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - FIN10 (G0051) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1078.003 OR T1053.005 OR T1059.001 OR T1059.003 OR T1547.001 OR T1033 OR T1021.001 OR T1570 OR T1588.002 OR T1070.004) OR threat.technique.id:(T1078 OR T1078.003 OR T1053.005 OR T1059.001 OR T1059.003 OR T1547.001 OR T1033 OR T1021.001 OR T1570 OR T1588.002 OR T1070.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - FIN10 (G0051) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1078.003 OR T1053.005 OR T1059.001 OR T1059.003 OR T1547.001 OR T1033 OR T1021.001 OR T1570 OR T1588.002 OR T1070.004) OR threat.technique.id:(T1078 OR T1078.003 OR T1053.005 OR T1059.001 OR T1059.003 OR T1547.001 OR T1033 OR T1021.001 OR T1570 OR T1588.002 OR T1070.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile FIN10 with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1078.003 OR T1053.005 OR T1059.001 OR T1059.003 OR T1547.001 OR T1033 OR T1021.001 OR T1570 OR T1588.002 OR T1070.004) OR threat.technique.id:(T1078 OR T1078.003 OR T1053.005 OR T1059.001 OR T1059.003 OR T1547.001 OR T1033 OR T1021.001 OR T1570 OR T1588.002 OR T1070.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0052-copykittens.json b/app/playbooks/threat-groups/apt-g0052-copykittens.json
new file mode 100644
index 0000000..11661d4
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0052-copykittens.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0052",
+ "num": 90,
+ "name": "MITRE ATT&CK Group — CopyKittens",
+ "fullName": "CopyKittens (G0052) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[CopyKittens](https://attack.mitre.org/groups/G0052) is an Iranian cyber espionage group that has been operating since at least 2013. It has targeted countries including Israel, Saudi Arabia, Turkey, the U.S., Jordan, and Germany. The group is responsible for the campaign known as Operation Wilted Tulip. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with CopyKittens.",
+ "mitre": "T1059.001, T1560.001, T1560.003, T1090, T1553.002, T1588.002, T1218.011, T1564.003",
+ "aliases": [
+ "CopyKittens"
+ ],
+ "mitreGroupId": "G0052",
+ "mitreUrl": "https://attack.mitre.org/groups/G0052",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile CopyKittens with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0052. Aliases: CopyKittens. Primary mapped tactics: Execution, Collection, Command and Control, Defense Impairment, Resource Development, Stealth. Mapped techniques: T1059.001 PowerShell, T1560.001 Archive via Utility, T1560.003 Archive via Custom Method, T1090 Proxy, T1553.002 Code Signing, T1588.002 Tool, T1218.011 Rundll32, T1564.003 Hidden Window. Source: https://attack.mitre.org/groups/G0052. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - CopyKittens (G0052) ATT&CK technique pivots\n(rule.threat.technique.id:(T1059.001 OR T1560.001 OR T1560.003 OR T1090 OR T1553.002 OR T1588.002 OR T1218.011 OR T1564.003) OR threat.technique.id:(T1059.001 OR T1560.001 OR T1560.003 OR T1090 OR T1553.002 OR T1588.002 OR T1218.011 OR T1564.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - CopyKittens (G0052) ATT&CK technique pivots\n(rule.threat.technique.id:(T1059.001 OR T1560.001 OR T1560.003 OR T1090 OR T1553.002 OR T1588.002 OR T1218.011 OR T1564.003) OR threat.technique.id:(T1059.001 OR T1560.001 OR T1560.003 OR T1090 OR T1553.002 OR T1588.002 OR T1218.011 OR T1564.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile CopyKittens with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1059.001 OR T1560.001 OR T1560.003 OR T1090 OR T1553.002 OR T1588.002 OR T1218.011 OR T1564.003) OR threat.technique.id:(T1059.001 OR T1560.001 OR T1560.003 OR T1090 OR T1553.002 OR T1588.002 OR T1218.011 OR T1564.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1560.001\"\n[[rule.threat.technique]]\nid = \"T1560.003\"\n[[rule.threat.technique]]\nid = \"T1090\"\n[[rule.threat.technique]]\nid = \"T1553.002\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1560.001\"\n[[rule.threat.technique]]\nid = \"T1560.003\"\n[[rule.threat.technique]]\nid = \"T1090\"\n[[rule.threat.technique]]\nid = \"T1553.002\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1560.001\"\n[[rule.threat.technique]]\nid = \"T1560.003\"\n[[rule.threat.technique]]\nid = \"T1090\"\n[[rule.threat.technique]]\nid = \"T1553.002\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1560.001\"\n[[rule.threat.technique]]\nid = \"T1560.003\"\n[[rule.threat.technique]]\nid = \"T1090\"\n[[rule.threat.technique]]\nid = \"T1553.002\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0053-fin5.json b/app/playbooks/threat-groups/apt-g0053-fin5.json
new file mode 100644
index 0000000..521abd1
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0053-fin5.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0053",
+ "num": 91,
+ "name": "MITRE ATT&CK Group — FIN5",
+ "fullName": "FIN5 (G0053) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[FIN5](https://attack.mitre.org/groups/G0053) is a financially motivated threat group that has targeted personally identifiable information and payment card information. The group has been active since at least 2008 and has targeted the restaurant, gaming, and hotel industries. The group is made up of actors who likely speak Russian. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with FIN5.",
+ "mitre": "T1078, T1133, T1059, T1110, T1018, T1074.001, T1119, T1090.002, T1685.005, T1588.002, T1070.004",
+ "aliases": [
+ "FIN5"
+ ],
+ "mitreGroupId": "G0053",
+ "mitreUrl": "https://attack.mitre.org/groups/G0053",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile FIN5 with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0053. Aliases: FIN5. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Collection, Command and Control, Defense Impairment, Resource Development, Stealth. Mapped techniques: T1078 Valid Accounts, T1133 External Remote Services, T1059 Command and Scripting Interpreter, T1110 Brute Force, T1018 Remote System Discovery, T1074.001 Local Data Staging, T1119 Automated Collection, T1090.002 External Proxy, T1685.005 Clear Windows Event Logs, T1588.002 Tool, T1070.004 File Deletion. Source: https://attack.mitre.org/groups/G0053. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - FIN5 (G0053) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1133 OR T1059 OR T1110 OR T1018 OR T1074.001 OR T1119 OR T1090.002 OR T1685.005 OR T1588.002 OR T1070.004) OR threat.technique.id:(T1078 OR T1133 OR T1059 OR T1110 OR T1018 OR T1074.001 OR T1119 OR T1090.002 OR T1685.005 OR T1588.002 OR T1070.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - FIN5 (G0053) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1133 OR T1059 OR T1110 OR T1018 OR T1074.001 OR T1119 OR T1090.002 OR T1685.005 OR T1588.002 OR T1070.004) OR threat.technique.id:(T1078 OR T1133 OR T1059 OR T1110 OR T1018 OR T1074.001 OR T1119 OR T1090.002 OR T1685.005 OR T1588.002 OR T1070.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile FIN5 with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1133 OR T1059 OR T1110 OR T1018 OR T1074.001 OR T1119 OR T1090.002 OR T1685.005 OR T1588.002 OR T1070.004) OR threat.technique.id:(T1078 OR T1133 OR T1059 OR T1110 OR T1018 OR T1074.001 OR T1119 OR T1090.002 OR T1685.005 OR T1588.002 OR T1070.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1059\"\n[[rule.threat.technique]]\nid = \"T1110\"\n[[rule.threat.technique]]\nid = \"T1018\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1059\"\n[[rule.threat.technique]]\nid = \"T1110\"\n[[rule.threat.technique]]\nid = \"T1018\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1059\"\n[[rule.threat.technique]]\nid = \"T1110\"\n[[rule.threat.technique]]\nid = \"T1018\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1059\"\n[[rule.threat.technique]]\nid = \"T1110\"\n[[rule.threat.technique]]\nid = \"T1018\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0054-sowbug.json b/app/playbooks/threat-groups/apt-g0054-sowbug.json
new file mode 100644
index 0000000..1ed50f1
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0054-sowbug.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0054",
+ "num": 92,
+ "name": "MITRE ATT&CK Group — Sowbug",
+ "fullName": "Sowbug (G0054) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Sowbug](https://attack.mitre.org/groups/G0054) is a threat group that has conducted targeted attacks against organizations in South America and Southeast Asia, particularly government entities, since at least 2015. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Sowbug.",
+ "mitre": "T1059.003, T1003, T1056.001, T1082, T1083, T1135, T1039, T1560.001, T1036.005",
+ "aliases": [
+ "Sowbug"
+ ],
+ "mitreGroupId": "G0054",
+ "mitreUrl": "https://attack.mitre.org/groups/G0054",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Sowbug with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0054. Aliases: Sowbug. Primary mapped tactics: Execution, Credential Access, Discovery, Collection, Stealth. Mapped techniques: T1059.003 Windows Command Shell, T1003 OS Credential Dumping, T1056.001 Keylogging, T1082 System Information Discovery, T1083 File and Directory Discovery, T1135 Network Share Discovery, T1039 Data from Network Shared Drive, T1560.001 Archive via Utility, T1036.005 Match Legitimate Resource Name or Location. Source: https://attack.mitre.org/groups/G0054. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Sowbug (G0054) ATT&CK technique pivots\n(rule.threat.technique.id:(T1059.003 OR T1003 OR T1056.001 OR T1082 OR T1083 OR T1135 OR T1039 OR T1560.001 OR T1036.005) OR threat.technique.id:(T1059.003 OR T1003 OR T1056.001 OR T1082 OR T1083 OR T1135 OR T1039 OR T1560.001 OR T1036.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Sowbug (G0054) ATT&CK technique pivots\n(rule.threat.technique.id:(T1059.003 OR T1003 OR T1056.001 OR T1082 OR T1083 OR T1135 OR T1039 OR T1560.001 OR T1036.005) OR threat.technique.id:(T1059.003 OR T1003 OR T1056.001 OR T1082 OR T1083 OR T1135 OR T1039 OR T1560.001 OR T1036.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Sowbug with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1059.003 OR T1003 OR T1056.001 OR T1082 OR T1083 OR T1135 OR T1039 OR T1560.001 OR T1036.005) OR threat.technique.id:(T1059.003 OR T1003 OR T1056.001 OR T1082 OR T1083 OR T1135 OR T1039 OR T1560.001 OR T1036.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1003\"\n[[rule.threat.technique]]\nid = \"T1056.001\"\n[[rule.threat.technique]]\nid = \"T1082\"\n[[rule.threat.technique]]\nid = \"T1083\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1003\"\n[[rule.threat.technique]]\nid = \"T1056.001\"\n[[rule.threat.technique]]\nid = \"T1082\"\n[[rule.threat.technique]]\nid = \"T1083\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1003\"\n[[rule.threat.technique]]\nid = \"T1056.001\"\n[[rule.threat.technique]]\nid = \"T1082\"\n[[rule.threat.technique]]\nid = \"T1083\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1003\"\n[[rule.threat.technique]]\nid = \"T1056.001\"\n[[rule.threat.technique]]\nid = \"T1082\"\n[[rule.threat.technique]]\nid = \"T1083\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0055-neodymium.json b/app/playbooks/threat-groups/apt-g0055-neodymium.json
new file mode 100644
index 0000000..27fe65e
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0055-neodymium.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0055",
+ "num": 93,
+ "name": "MITRE ATT&CK Group — NEODYMIUM",
+ "fullName": "NEODYMIUM (G0055) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[NEODYMIUM](https://attack.mitre.org/groups/G0055) is an activity group that conducted a campaign in May 2016 and has heavily targeted Turkish victims. The group has demonstrated similarity to another activity group called [PROMETHIUM](https://attack.mitre.org/groups/G0056) due to overlapping victim and campaign characteristics. [NEODYMIUM](https://attack.mitre.org/groups/G0055) is reportedly associated closely with [BlackOasis](https://attack.mitre.org/groups/G0063) operations, but evidence that the group names are aliases has not been identified. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with NEODYMIUM.",
+ "mitre": "",
+ "aliases": [
+ "NEODYMIUM"
+ ],
+ "mitreGroupId": "G0055",
+ "mitreUrl": "https://attack.mitre.org/groups/G0055",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile NEODYMIUM with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0055. Aliases: NEODYMIUM. Primary mapped tactics: No explicit tactics mapped. Mapped techniques: No ATT&CK techniques are currently mapped in MITRE CTI for this group.. Source: https://attack.mitre.org/groups/G0055. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - NEODYMIUM (G0055) ATT&CK technique pivots\n(rule.threat.technique.id:(Gxxxx) OR threat.technique.id:(Gxxxx) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - NEODYMIUM (G0055) ATT&CK technique pivots\n(rule.threat.technique.id:(Gxxxx) OR threat.technique.id:(Gxxxx) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile NEODYMIUM with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(Gxxxx) OR threat.technique.id:(Gxxxx) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''"
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''"
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''"
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''"
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0056-promethium.json b/app/playbooks/threat-groups/apt-g0056-promethium.json
new file mode 100644
index 0000000..34460e5
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0056-promethium.json
@@ -0,0 +1,117 @@
+{
+ "id": "apt-g0056",
+ "num": 94,
+ "name": "MITRE ATT&CK Group — PROMETHIUM",
+ "fullName": "PROMETHIUM (G0056) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[PROMETHIUM](https://attack.mitre.org/groups/G0056) is an activity group focused on espionage that has been active since at least 2012. The group has conducted operations globally with a heavy emphasis on Turkish targets. [PROMETHIUM](https://attack.mitre.org/groups/G0056) has demonstrated similarity to another activity group called [NEODYMIUM](https://attack.mitre.org/groups/G0055) due to overlapping victim and campaign characteristics. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with PROMETHIUM.",
+ "mitre": "T1078.003, T1189, T1204.002, T1205.001, T1543.003, T1547.001, T1553.002, T1587.002, T1587.003, T1036.004, T1036.005",
+ "aliases": [
+ "PROMETHIUM",
+ "StrongPity"
+ ],
+ "mitreGroupId": "G0056",
+ "mitreUrl": "https://attack.mitre.org/groups/G0056",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile PROMETHIUM with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0056. Aliases: PROMETHIUM, StrongPity. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Command and Control, Defense Impairment, Resource Development, Stealth. Mapped techniques: T1078.003 Local Accounts, T1189 Drive-by Compromise, T1204.002 Malicious File, T1205.001 Port Knocking, T1543.003 Windows Service, T1547.001 Registry Run Keys / Startup Folder, T1553.002 Code Signing, T1587.002 Code Signing Certificates, T1587.003 Digital Certificates, T1036.004 Masquerade Task or Service, T1036.005 Match Legitimate Resource Name or Location. Source: https://attack.mitre.org/groups/G0056. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - PROMETHIUM (G0056) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078.003 OR T1189 OR T1204.002 OR T1205.001 OR T1543.003 OR T1547.001 OR T1553.002 OR T1587.002 OR T1587.003 OR T1036.004 OR T1036.005) OR threat.technique.id:(T1078.003 OR T1189 OR T1204.002 OR T1205.001 OR T1543.003 OR T1547.001 OR T1553.002 OR T1587.002 OR T1587.003 OR T1036.004 OR T1036.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - PROMETHIUM (G0056) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078.003 OR T1189 OR T1204.002 OR T1205.001 OR T1543.003 OR T1547.001 OR T1553.002 OR T1587.002 OR T1587.003 OR T1036.004 OR T1036.005) OR threat.technique.id:(T1078.003 OR T1189 OR T1204.002 OR T1205.001 OR T1543.003 OR T1547.001 OR T1553.002 OR T1587.002 OR T1587.003 OR T1036.004 OR T1036.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile PROMETHIUM with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078.003 OR T1189 OR T1204.002 OR T1205.001 OR T1543.003 OR T1547.001 OR T1553.002 OR T1587.002 OR T1587.003 OR T1036.004 OR T1036.005) OR threat.technique.id:(T1078.003 OR T1189 OR T1204.002 OR T1205.001 OR T1543.003 OR T1547.001 OR T1553.002 OR T1587.002 OR T1587.003 OR T1036.004 OR T1036.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1205.001\"\n[[rule.threat.technique]]\nid = \"T1543.003\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1205.001\"\n[[rule.threat.technique]]\nid = \"T1543.003\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1205.001\"\n[[rule.threat.technique]]\nid = \"T1543.003\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1205.001\"\n[[rule.threat.technique]]\nid = \"T1543.003\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0059-magic-hound.json b/app/playbooks/threat-groups/apt-g0059-magic-hound.json
new file mode 100644
index 0000000..b14dce8
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0059-magic-hound.json
@@ -0,0 +1,124 @@
+{
+ "id": "apt-g0059",
+ "num": 95,
+ "name": "MITRE ATT&CK Group — Magic Hound",
+ "fullName": "Magic Hound (G0059) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Magic Hound](https://attack.mitre.org/groups/G0059) is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Magic Hound.",
+ "mitre": "T1078.001, T1078.002, T1189, T1190, T1566.002, T1566.003, T1047, T1053.005, T1059.001, T1059.003, T1059.005, T1204.001, T1204.002, T1098.002, T1098.007, T1112, T1136.001, T1505.003, T1547.001, T1003.001, T1056.001, T1016, T1016.001, T1016.002",
+ "aliases": [
+ "Magic Hound",
+ "TA453",
+ "COBALT ILLUSION",
+ "Charming Kitten",
+ "ITG18",
+ "Phosphorus",
+ "Newscaster",
+ "APT35",
+ "Mint Sandstorm"
+ ],
+ "mitreGroupId": "G0059",
+ "mitreUrl": "https://attack.mitre.org/groups/G0059",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Magic Hound with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0059. Aliases: Magic Hound, TA453, COBALT ILLUSION, Charming Kitten, ITG18, Phosphorus, Newscaster, APT35, Mint Sandstorm. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact, Defense Impairment, Reconnaissance, Resource Development, Stealth. Mapped techniques: T1078.001 Default Accounts, T1078.002 Domain Accounts, T1189 Drive-by Compromise, T1190 Exploit Public-Facing Application, T1566.002 Spearphishing Link, T1566.003 Spearphishing via Service, T1047 Windows Management Instrumentation, T1053.005 Scheduled Task, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1059.005 Visual Basic, T1204.001 Malicious Link, plus 66 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0059. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Magic Hound (G0059) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078.001 OR T1078.002 OR T1189 OR T1190 OR T1566.002 OR T1566.003 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1204.001 OR T1204.002 OR T1098.002 OR T1098.007 OR T1112 OR T1136.001 OR T1505.003 OR T1547.001 OR T1003.001) OR threat.technique.id:(T1078.001 OR T1078.002 OR T1189 OR T1190 OR T1566.002 OR T1566.003 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1204.001 OR T1204.002 OR T1098.002 OR T1098.007 OR T1112 OR T1136.001 OR T1505.003 OR T1547.001 OR T1003.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Magic Hound (G0059) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078.001 OR T1078.002 OR T1189 OR T1190 OR T1566.002 OR T1566.003 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1204.001 OR T1204.002 OR T1098.002 OR T1098.007 OR T1112 OR T1136.001 OR T1505.003 OR T1547.001 OR T1003.001) OR threat.technique.id:(T1078.001 OR T1078.002 OR T1189 OR T1190 OR T1566.002 OR T1566.003 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1204.001 OR T1204.002 OR T1098.002 OR T1098.007 OR T1112 OR T1136.001 OR T1505.003 OR T1547.001 OR T1003.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Magic Hound with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078.001 OR T1078.002 OR T1189 OR T1190 OR T1566.002 OR T1566.003 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1204.001 OR T1204.002 OR T1098.002 OR T1098.007 OR T1112 OR T1136.001 OR T1505.003 OR T1547.001 OR T1003.001) OR threat.technique.id:(T1078.001 OR T1078.002 OR T1189 OR T1190 OR T1566.002 OR T1566.003 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1204.001 OR T1204.002 OR T1098.002 OR T1098.007 OR T1112 OR T1136.001 OR T1505.003 OR T1547.001 OR T1003.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.001\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566.002\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.001\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566.002\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.001\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566.002\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.001\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566.002\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0060-bronze-butler.json b/app/playbooks/threat-groups/apt-g0060-bronze-butler.json
new file mode 100644
index 0000000..f6ec3e4
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0060-bronze-butler.json
@@ -0,0 +1,118 @@
+{
+ "id": "apt-g0060",
+ "num": 96,
+ "name": "MITRE ATT&CK Group — BRONZE BUTLER",
+ "fullName": "BRONZE BUTLER (G0060) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[BRONZE BUTLER](https://attack.mitre.org/groups/G0060) is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with BRONZE BUTLER.",
+ "mitre": "T1189, T1566.001, T1053.002, T1053.005, T1059.001, T1059.003, T1059.005, T1059.006, T1203, T1204.002, T1574.001, T1547.001, T1548.002, T1003.001, T1007, T1018, T1083, T1087.002, T1124, T1518, T1080, T1550.003, T1005, T1039",
+ "aliases": [
+ "BRONZE BUTLER",
+ "REDBALDKNIGHT",
+ "Tick"
+ ],
+ "mitreGroupId": "G0060",
+ "mitreUrl": "https://attack.mitre.org/groups/G0060",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile BRONZE BUTLER with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0060. Aliases: BRONZE BUTLER, REDBALDKNIGHT, Tick. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Defense Impairment, Resource Development, Stealth. Mapped techniques: T1189 Drive-by Compromise, T1566.001 Spearphishing Attachment, T1053.002 At, T1053.005 Scheduled Task, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1059.005 Visual Basic, T1059.006 Python, T1203 Exploitation for Client Execution, T1204.002 Malicious File, T1574.001 DLL, T1547.001 Registry Run Keys / Startup Folder, plus 28 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0060. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - BRONZE BUTLER (G0060) ATT&CK technique pivots\n(rule.threat.technique.id:(T1189 OR T1566.001 OR T1053.002 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.006 OR T1203 OR T1204.002 OR T1574.001 OR T1547.001 OR T1548.002 OR T1003.001 OR T1007 OR T1018 OR T1083 OR T1087.002 OR T1124 OR T1518) OR threat.technique.id:(T1189 OR T1566.001 OR T1053.002 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.006 OR T1203 OR T1204.002 OR T1574.001 OR T1547.001 OR T1548.002 OR T1003.001 OR T1007 OR T1018 OR T1083 OR T1087.002 OR T1124 OR T1518) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - BRONZE BUTLER (G0060) ATT&CK technique pivots\n(rule.threat.technique.id:(T1189 OR T1566.001 OR T1053.002 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.006 OR T1203 OR T1204.002 OR T1574.001 OR T1547.001 OR T1548.002 OR T1003.001 OR T1007 OR T1018 OR T1083 OR T1087.002 OR T1124 OR T1518) OR threat.technique.id:(T1189 OR T1566.001 OR T1053.002 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.006 OR T1203 OR T1204.002 OR T1574.001 OR T1547.001 OR T1548.002 OR T1003.001 OR T1007 OR T1018 OR T1083 OR T1087.002 OR T1124 OR T1518) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile BRONZE BUTLER with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1189 OR T1566.001 OR T1053.002 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.006 OR T1203 OR T1204.002 OR T1574.001 OR T1547.001 OR T1548.002 OR T1003.001 OR T1007 OR T1018 OR T1083 OR T1087.002 OR T1124 OR T1518) OR threat.technique.id:(T1189 OR T1566.001 OR T1053.002 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.006 OR T1203 OR T1204.002 OR T1574.001 OR T1547.001 OR T1548.002 OR T1003.001 OR T1007 OR T1018 OR T1083 OR T1087.002 OR T1124 OR T1518) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1053.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1053.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1053.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1053.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0061-fin8.json b/app/playbooks/threat-groups/apt-g0061-fin8.json
new file mode 100644
index 0000000..eb17964
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0061-fin8.json
@@ -0,0 +1,117 @@
+{
+ "id": "apt-g0061",
+ "num": 97,
+ "name": "MITRE ATT&CK Group — FIN8",
+ "fullName": "FIN8 (G0061) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[FIN8](https://attack.mitre.org/groups/G0061) is a financially motivated threat group that has been active since at least January 2016, and known for targeting organizations in the hospitality, retail, entertainment, insurance, technology, chemical, and financial sectors. In June 2021, security researchers detected [FIN8](https://attack.mitre.org/groups/G0061) switching from targeting point-of-sale (POS) devices to distributing a number of ransomware variants. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with FIN8.",
+ "mitre": "T1078, T1566.001, T1566.002, T1047, T1053.005, T1059.001, T1059.003, T1204.001, T1204.002, T1112, T1546.003, T1055.004, T1068, T1134.001, T1003.001, T1016.001, T1018, T1033, T1082, T1482, T1518.001, T1021.001, T1021.002, T1074.002",
+ "aliases": [
+ "FIN8",
+ "Syssphinx"
+ ],
+ "mitreGroupId": "G0061",
+ "mitreUrl": "https://attack.mitre.org/groups/G0061",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile FIN8 with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0061. Aliases: FIN8, Syssphinx. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact, Defense Impairment, Resource Development, Stealth. Mapped techniques: T1078 Valid Accounts, T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link, T1047 Windows Management Instrumentation, T1053.005 Scheduled Task, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1204.001 Malicious Link, T1204.002 Malicious File, T1112 Modify Registry, T1546.003 Windows Management Instrumentation Event Subscription, T1055.004 Asynchronous Procedure Call, plus 24 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0061. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - FIN8 (G0061) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1204.001 OR T1204.002 OR T1112 OR T1546.003 OR T1055.004 OR T1068 OR T1134.001 OR T1003.001 OR T1016.001 OR T1018 OR T1033 OR T1082 OR T1482) OR threat.technique.id:(T1078 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1204.001 OR T1204.002 OR T1112 OR T1546.003 OR T1055.004 OR T1068 OR T1134.001 OR T1003.001 OR T1016.001 OR T1018 OR T1033 OR T1082 OR T1482) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - FIN8 (G0061) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1204.001 OR T1204.002 OR T1112 OR T1546.003 OR T1055.004 OR T1068 OR T1134.001 OR T1003.001 OR T1016.001 OR T1018 OR T1033 OR T1082 OR T1482) OR threat.technique.id:(T1078 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1204.001 OR T1204.002 OR T1112 OR T1546.003 OR T1055.004 OR T1068 OR T1134.001 OR T1003.001 OR T1016.001 OR T1018 OR T1033 OR T1082 OR T1482) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile FIN8 with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1204.001 OR T1204.002 OR T1112 OR T1546.003 OR T1055.004 OR T1068 OR T1134.001 OR T1003.001 OR T1016.001 OR T1018 OR T1033 OR T1082 OR T1482) OR threat.technique.id:(T1078 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1204.001 OR T1204.002 OR T1112 OR T1546.003 OR T1055.004 OR T1068 OR T1134.001 OR T1003.001 OR T1016.001 OR T1018 OR T1033 OR T1082 OR T1482) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0062-ta459.json b/app/playbooks/threat-groups/apt-g0062-ta459.json
new file mode 100644
index 0000000..54f6edc
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0062-ta459.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0062",
+ "num": 98,
+ "name": "MITRE ATT&CK Group — TA459",
+ "fullName": "TA459 (G0062) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[TA459](https://attack.mitre.org/groups/G0062) is a threat group believed to operate out of China that has targeted countries including Russia, Belarus, Mongolia, and others. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with TA459.",
+ "mitre": "T1566.001, T1059.001, T1059.005, T1203, T1204.002",
+ "aliases": [
+ "TA459"
+ ],
+ "mitreGroupId": "G0062",
+ "mitreUrl": "https://attack.mitre.org/groups/G0062",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile TA459 with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0062. Aliases: TA459. Primary mapped tactics: Initial Access, Execution. Mapped techniques: T1566.001 Spearphishing Attachment, T1059.001 PowerShell, T1059.005 Visual Basic, T1203 Exploitation for Client Execution, T1204.002 Malicious File. Source: https://attack.mitre.org/groups/G0062. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - TA459 (G0062) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1059.001 OR T1059.005 OR T1203 OR T1204.002) OR threat.technique.id:(T1566.001 OR T1059.001 OR T1059.005 OR T1203 OR T1204.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - TA459 (G0062) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1059.001 OR T1059.005 OR T1203 OR T1204.002) OR threat.technique.id:(T1566.001 OR T1059.001 OR T1059.005 OR T1203 OR T1204.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile TA459 with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1566.001 OR T1059.001 OR T1059.005 OR T1203 OR T1204.002) OR threat.technique.id:(T1566.001 OR T1059.001 OR T1059.005 OR T1203 OR T1204.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.002\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.002\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.002\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.002\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0063-blackoasis.json b/app/playbooks/threat-groups/apt-g0063-blackoasis.json
new file mode 100644
index 0000000..55dba5e
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0063-blackoasis.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0063",
+ "num": 99,
+ "name": "MITRE ATT&CK Group — BlackOasis",
+ "fullName": "BlackOasis (G0063) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[BlackOasis](https://attack.mitre.org/groups/G0063) is a Middle Eastern threat group that is believed to be a customer of Gamma Group. The group has shown interest in prominent figures in the United Nations, as well as opposition bloggers, activists, regional news correspondents, and think tanks. A group known by Microsoft as [NEODYMIUM](https://attack.mitre.org/groups/G0055) is reportedly associated closely with [BlackOasis](https://attack.mitre.org/groups/G0063) operations, but evidence that the group names are aliases has not been identified. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with BlackOasis.",
+ "mitre": "T1027",
+ "aliases": [
+ "BlackOasis"
+ ],
+ "mitreGroupId": "G0063",
+ "mitreUrl": "https://attack.mitre.org/groups/G0063",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile BlackOasis with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0063. Aliases: BlackOasis. Primary mapped tactics: Stealth. Mapped techniques: T1027 Obfuscated Files or Information. Source: https://attack.mitre.org/groups/G0063. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - BlackOasis (G0063) ATT&CK technique pivots\n(rule.threat.technique.id:(T1027) OR threat.technique.id:(T1027) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - BlackOasis (G0063) ATT&CK technique pivots\n(rule.threat.technique.id:(T1027) OR threat.technique.id:(T1027) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile BlackOasis with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1027) OR threat.technique.id:(T1027) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1027\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1027\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1027\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1027\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0064-apt33.json b/app/playbooks/threat-groups/apt-g0064-apt33.json
new file mode 100644
index 0000000..1291a63
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0064-apt33.json
@@ -0,0 +1,119 @@
+{
+ "id": "apt-g0064",
+ "num": 100,
+ "name": "MITRE ATT&CK Group — APT33",
+ "fullName": "APT33 (G0064) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[APT33](https://attack.mitre.org/groups/G0064) is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States, Saudi Arabia, and South Korea, with a particular interest in the aviation and energy sectors. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with APT33.",
+ "mitre": "T1078, T1078.004, T1566.001, T1566.002, T1053.005, T1059.001, T1059.005, T1203, T1204.001, T1204.002, T1546.003, T1547.001, T1068, T1003.001, T1003.004, T1003.005, T1040, T1110.003, T1552.001, T1552.006, T1555, T1555.003, T1560.001, T1071.001",
+ "aliases": [
+ "APT33",
+ "HOLMIUM",
+ "Elfin",
+ "Peach Sandstorm"
+ ],
+ "mitreGroupId": "G0064",
+ "mitreUrl": "https://attack.mitre.org/groups/G0064",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile APT33 with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0064. Aliases: APT33, HOLMIUM, Elfin, Peach Sandstorm. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Collection, Command and Control, Exfiltration, Resource Development, Stealth. Mapped techniques: T1078 Valid Accounts, T1078.004 Cloud Accounts, T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link, T1053.005 Scheduled Task, T1059.001 PowerShell, T1059.005 Visual Basic, T1203 Exploitation for Client Execution, T1204.001 Malicious Link, T1204.002 Malicious File, T1546.003 Windows Management Instrumentation Event Subscription, T1547.001 Registry Run Keys / Startup Folder, plus 19 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0064. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - APT33 (G0064) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1078.004 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.005 OR T1203 OR T1204.001 OR T1204.002 OR T1546.003 OR T1547.001 OR T1068 OR T1003.001 OR T1003.004 OR T1003.005 OR T1040 OR T1110.003 OR T1552.001 OR T1552.006) OR threat.technique.id:(T1078 OR T1078.004 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.005 OR T1203 OR T1204.001 OR T1204.002 OR T1546.003 OR T1547.001 OR T1068 OR T1003.001 OR T1003.004 OR T1003.005 OR T1040 OR T1110.003 OR T1552.001 OR T1552.006) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - APT33 (G0064) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1078.004 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.005 OR T1203 OR T1204.001 OR T1204.002 OR T1546.003 OR T1547.001 OR T1068 OR T1003.001 OR T1003.004 OR T1003.005 OR T1040 OR T1110.003 OR T1552.001 OR T1552.006) OR threat.technique.id:(T1078 OR T1078.004 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.005 OR T1203 OR T1204.001 OR T1204.002 OR T1546.003 OR T1547.001 OR T1068 OR T1003.001 OR T1003.004 OR T1003.005 OR T1040 OR T1110.003 OR T1552.001 OR T1552.006) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile APT33 with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1078.004 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.005 OR T1203 OR T1204.001 OR T1204.002 OR T1546.003 OR T1547.001 OR T1068 OR T1003.001 OR T1003.004 OR T1003.005 OR T1040 OR T1110.003 OR T1552.001 OR T1552.006) OR threat.technique.id:(T1078 OR T1078.004 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.005 OR T1203 OR T1204.001 OR T1204.002 OR T1546.003 OR T1547.001 OR T1068 OR T1003.001 OR T1003.004 OR T1003.005 OR T1040 OR T1110.003 OR T1552.001 OR T1552.006) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.004\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.004\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.004\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.004\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0065-leviathan.json b/app/playbooks/threat-groups/apt-g0065-leviathan.json
new file mode 100644
index 0000000..33290f8
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0065-leviathan.json
@@ -0,0 +1,124 @@
+{
+ "id": "apt-g0065",
+ "num": 101,
+ "name": "MITRE ATT&CK Group — Leviathan",
+ "fullName": "Leviathan (G0065) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Leviathan](https://attack.mitre.org/groups/G0065) is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company. Active since at least 2009, [Leviathan](https://attack.mitre.org/groups/G0065) has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle East, and Southeast Asia. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Leviathan.",
+ "mitre": "T1078, T1133, T1189, T1190, T1566.001, T1566.002, T1047, T1059.001, T1059.005, T1197, T1203, T1204.001, T1204.002, T1559.002, T1505.003, T1546.003, T1547.001, T1547.009, T1055.001, T1003, T1003.001, T1021.001, T1021.004, T1534",
+ "aliases": [
+ "Leviathan",
+ "MUDCARP",
+ "Kryptonite Panda",
+ "Gadolinium",
+ "BRONZE MOHAWK",
+ "TEMP.Jumper",
+ "APT40",
+ "TEMP.Periscope",
+ "Gingham Typhoon"
+ ],
+ "mitreGroupId": "G0065",
+ "mitreUrl": "https://attack.mitre.org/groups/G0065",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Leviathan with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0065. Aliases: Leviathan, MUDCARP, Kryptonite Panda, Gadolinium, BRONZE MOHAWK, TEMP.Jumper, APT40, TEMP.Periscope, Gingham Typhoon. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Lateral Movement, Collection, Command and Control, Exfiltration, Defense Impairment, Reconnaissance, Resource Development, Stealth. Mapped techniques: T1078 Valid Accounts, T1133 External Remote Services, T1189 Drive-by Compromise, T1190 Exploit Public-Facing Application, T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link, T1047 Windows Management Instrumentation, T1059.001 PowerShell, T1059.005 Visual Basic, T1197 BITS Jobs, T1203 Exploitation for Client Execution, T1204.001 Malicious Link, plus 38 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0065. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Leviathan (G0065) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1133 OR T1189 OR T1190 OR T1566.001 OR T1566.002 OR T1047 OR T1059.001 OR T1059.005 OR T1197 OR T1203 OR T1204.001 OR T1204.002 OR T1559.002 OR T1505.003 OR T1546.003 OR T1547.001 OR T1547.009 OR T1055.001 OR T1003) OR threat.technique.id:(T1078 OR T1133 OR T1189 OR T1190 OR T1566.001 OR T1566.002 OR T1047 OR T1059.001 OR T1059.005 OR T1197 OR T1203 OR T1204.001 OR T1204.002 OR T1559.002 OR T1505.003 OR T1546.003 OR T1547.001 OR T1547.009 OR T1055.001 OR T1003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Leviathan (G0065) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1133 OR T1189 OR T1190 OR T1566.001 OR T1566.002 OR T1047 OR T1059.001 OR T1059.005 OR T1197 OR T1203 OR T1204.001 OR T1204.002 OR T1559.002 OR T1505.003 OR T1546.003 OR T1547.001 OR T1547.009 OR T1055.001 OR T1003) OR threat.technique.id:(T1078 OR T1133 OR T1189 OR T1190 OR T1566.001 OR T1566.002 OR T1047 OR T1059.001 OR T1059.005 OR T1197 OR T1203 OR T1204.001 OR T1204.002 OR T1559.002 OR T1505.003 OR T1546.003 OR T1547.001 OR T1547.009 OR T1055.001 OR T1003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Leviathan with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1133 OR T1189 OR T1190 OR T1566.001 OR T1566.002 OR T1047 OR T1059.001 OR T1059.005 OR T1197 OR T1203 OR T1204.001 OR T1204.002 OR T1559.002 OR T1505.003 OR T1546.003 OR T1547.001 OR T1547.009 OR T1055.001 OR T1003) OR threat.technique.id:(T1078 OR T1133 OR T1189 OR T1190 OR T1566.001 OR T1566.002 OR T1047 OR T1059.001 OR T1059.005 OR T1197 OR T1203 OR T1204.001 OR T1204.002 OR T1559.002 OR T1505.003 OR T1546.003 OR T1547.001 OR T1547.009 OR T1055.001 OR T1003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566.001\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566.001\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566.001\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566.001\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0066-elderwood.json b/app/playbooks/threat-groups/apt-g0066-elderwood.json
new file mode 100644
index 0000000..43c8070
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0066-elderwood.json
@@ -0,0 +1,119 @@
+{
+ "id": "apt-g0066",
+ "num": 102,
+ "name": "MITRE ATT&CK Group — Elderwood",
+ "fullName": "Elderwood (G0066) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Elderwood](https://attack.mitre.org/groups/G0066) is a suspected Chinese cyber espionage group that was reportedly responsible for the 2009 Google intrusion known as Operation Aurora. The group has targeted defense organizations, supply chain manufacturers, human rights and nongovernmental organizations (NGOs), and IT service providers. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Elderwood.",
+ "mitre": "T1189, T1566.001, T1566.002, T1203, T1204.001, T1204.002, T1105, T1027.002, T1027.013",
+ "aliases": [
+ "Elderwood",
+ "Elderwood Gang",
+ "Beijing Group",
+ "Sneaky Panda"
+ ],
+ "mitreGroupId": "G0066",
+ "mitreUrl": "https://attack.mitre.org/groups/G0066",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Elderwood with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0066. Aliases: Elderwood, Elderwood Gang, Beijing Group, Sneaky Panda. Primary mapped tactics: Initial Access, Execution, Command and Control, Stealth. Mapped techniques: T1189 Drive-by Compromise, T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link, T1203 Exploitation for Client Execution, T1204.001 Malicious Link, T1204.002 Malicious File, T1105 Ingress Tool Transfer, T1027.002 Software Packing, T1027.013 Encrypted/Encoded File. Source: https://attack.mitre.org/groups/G0066. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Elderwood (G0066) ATT&CK technique pivots\n(rule.threat.technique.id:(T1189 OR T1566.001 OR T1566.002 OR T1203 OR T1204.001 OR T1204.002 OR T1105 OR T1027.002 OR T1027.013) OR threat.technique.id:(T1189 OR T1566.001 OR T1566.002 OR T1203 OR T1204.001 OR T1204.002 OR T1105 OR T1027.002 OR T1027.013) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Elderwood (G0066) ATT&CK technique pivots\n(rule.threat.technique.id:(T1189 OR T1566.001 OR T1566.002 OR T1203 OR T1204.001 OR T1204.002 OR T1105 OR T1027.002 OR T1027.013) OR threat.technique.id:(T1189 OR T1566.001 OR T1566.002 OR T1203 OR T1204.001 OR T1204.002 OR T1105 OR T1027.002 OR T1027.013) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Elderwood with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1189 OR T1566.001 OR T1566.002 OR T1203 OR T1204.001 OR T1204.002 OR T1105 OR T1027.002 OR T1027.013) OR threat.technique.id:(T1189 OR T1566.001 OR T1566.002 OR T1203 OR T1204.001 OR T1204.002 OR T1105 OR T1027.002 OR T1027.013) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.001\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.001\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.001\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.001\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0067-apt37.json b/app/playbooks/threat-groups/apt-g0067-apt37.json
new file mode 100644
index 0000000..cc7f2a0
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0067-apt37.json
@@ -0,0 +1,122 @@
+{
+ "id": "apt-g0067",
+ "num": 103,
+ "name": "MITRE ATT&CK Group — APT37",
+ "fullName": "APT37 (G0067) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[APT37](https://attack.mitre.org/groups/G0067) is a North Korean state-sponsored cyber espionage group that has been active since at least 2012. The group has targeted victims primarily in South Korea, but also in Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait, and other parts of the Middle East. [APT37](https://attack.mitre.org/groups/G0067) has also been linked to the following campaigns between 2016-2018: Operation Daybreak, Operation Erebus, Golden Time, Evil New Year, Are you Happy?, FreeMilk, North Korean Human Rights, and Evil New Year 2018. North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name [Lazarus Group](https://attack.mitre.org/groups/G0032) instead of tracking clusters or subgroups. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with APT37.",
+ "mitre": "T1189, T1566.001, T1053.005, T1059, T1059.003, T1059.005, T1059.006, T1106, T1203, T1204.002, T1559.002, T1547.001, T1055, T1548.002, T1555.003, T1033, T1057, T1082, T1120, T1005, T1123, T1071.001, T1102.002, T1105",
+ "aliases": [
+ "APT37",
+ "InkySquid",
+ "ScarCruft",
+ "Reaper",
+ "Group123",
+ "TEMP.Reaper",
+ "Ricochet Chollima"
+ ],
+ "mitreGroupId": "G0067",
+ "mitreUrl": "https://attack.mitre.org/groups/G0067",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile APT37 with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0067. Aliases: APT37, InkySquid, ScarCruft, Reaper, Group123, TEMP.Reaper, Ricochet Chollima. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Collection, Command and Control, Impact, Stealth. Mapped techniques: T1189 Drive-by Compromise, T1566.001 Spearphishing Attachment, T1053.005 Scheduled Task, T1059 Command and Scripting Interpreter, T1059.003 Windows Command Shell, T1059.005 Visual Basic, T1059.006 Python, T1106 Native API, T1203 Exploitation for Client Execution, T1204.002 Malicious File, T1559.002 Dynamic Data Exchange, T1547.001 Registry Run Keys / Startup Folder, plus 17 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0067. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - APT37 (G0067) ATT&CK technique pivots\n(rule.threat.technique.id:(T1189 OR T1566.001 OR T1053.005 OR T1059 OR T1059.003 OR T1059.005 OR T1059.006 OR T1106 OR T1203 OR T1204.002 OR T1559.002 OR T1547.001 OR T1055 OR T1548.002 OR T1555.003 OR T1033 OR T1057 OR T1082 OR T1120 OR T1005) OR threat.technique.id:(T1189 OR T1566.001 OR T1053.005 OR T1059 OR T1059.003 OR T1059.005 OR T1059.006 OR T1106 OR T1203 OR T1204.002 OR T1559.002 OR T1547.001 OR T1055 OR T1548.002 OR T1555.003 OR T1033 OR T1057 OR T1082 OR T1120 OR T1005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - APT37 (G0067) ATT&CK technique pivots\n(rule.threat.technique.id:(T1189 OR T1566.001 OR T1053.005 OR T1059 OR T1059.003 OR T1059.005 OR T1059.006 OR T1106 OR T1203 OR T1204.002 OR T1559.002 OR T1547.001 OR T1055 OR T1548.002 OR T1555.003 OR T1033 OR T1057 OR T1082 OR T1120 OR T1005) OR threat.technique.id:(T1189 OR T1566.001 OR T1053.005 OR T1059 OR T1059.003 OR T1059.005 OR T1059.006 OR T1106 OR T1203 OR T1204.002 OR T1559.002 OR T1547.001 OR T1055 OR T1548.002 OR T1555.003 OR T1033 OR T1057 OR T1082 OR T1120 OR T1005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile APT37 with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1189 OR T1566.001 OR T1053.005 OR T1059 OR T1059.003 OR T1059.005 OR T1059.006 OR T1106 OR T1203 OR T1204.002 OR T1559.002 OR T1547.001 OR T1055 OR T1548.002 OR T1555.003 OR T1033 OR T1057 OR T1082 OR T1120 OR T1005) OR threat.technique.id:(T1189 OR T1566.001 OR T1053.005 OR T1059 OR T1059.003 OR T1059.005 OR T1059.006 OR T1106 OR T1203 OR T1204.002 OR T1559.002 OR T1547.001 OR T1055 OR T1548.002 OR T1555.003 OR T1033 OR T1057 OR T1082 OR T1120 OR T1005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0068-platinum.json b/app/playbooks/threat-groups/apt-g0068-platinum.json
new file mode 100644
index 0000000..7dc8804
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0068-platinum.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0068",
+ "num": 104,
+ "name": "MITRE ATT&CK Group — PLATINUM",
+ "fullName": "PLATINUM (G0068) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[PLATINUM](https://attack.mitre.org/groups/G0068) is an activity group that has targeted victims since at least 2009. The group has focused on targets associated with governments and related organizations in South and Southeast Asia. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with PLATINUM.",
+ "mitre": "T1189, T1566.001, T1204.002, T1055, T1068, T1003.001, T1056.001, T1056.004, T1095, T1105, T1036",
+ "aliases": [
+ "PLATINUM"
+ ],
+ "mitreGroupId": "G0068",
+ "mitreUrl": "https://attack.mitre.org/groups/G0068",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile PLATINUM with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0068. Aliases: PLATINUM. Primary mapped tactics: Initial Access, Execution, Privilege Escalation, Credential Access, Collection, Command and Control, Stealth. Mapped techniques: T1189 Drive-by Compromise, T1566.001 Spearphishing Attachment, T1204.002 Malicious File, T1055 Process Injection, T1068 Exploitation for Privilege Escalation, T1003.001 LSASS Memory, T1056.001 Keylogging, T1056.004 Credential API Hooking, T1095 Non-Application Layer Protocol, T1105 Ingress Tool Transfer, T1036 Masquerading. Source: https://attack.mitre.org/groups/G0068. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - PLATINUM (G0068) ATT&CK technique pivots\n(rule.threat.technique.id:(T1189 OR T1566.001 OR T1204.002 OR T1055 OR T1068 OR T1003.001 OR T1056.001 OR T1056.004 OR T1095 OR T1105 OR T1036) OR threat.technique.id:(T1189 OR T1566.001 OR T1204.002 OR T1055 OR T1068 OR T1003.001 OR T1056.001 OR T1056.004 OR T1095 OR T1105 OR T1036) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - PLATINUM (G0068) ATT&CK technique pivots\n(rule.threat.technique.id:(T1189 OR T1566.001 OR T1204.002 OR T1055 OR T1068 OR T1003.001 OR T1056.001 OR T1056.004 OR T1095 OR T1105 OR T1036) OR threat.technique.id:(T1189 OR T1566.001 OR T1204.002 OR T1055 OR T1068 OR T1003.001 OR T1056.001 OR T1056.004 OR T1095 OR T1105 OR T1036) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile PLATINUM with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1189 OR T1566.001 OR T1204.002 OR T1055 OR T1068 OR T1003.001 OR T1056.001 OR T1056.004 OR T1095 OR T1105 OR T1036) OR threat.technique.id:(T1189 OR T1566.001 OR T1204.002 OR T1055 OR T1068 OR T1003.001 OR T1056.001 OR T1056.004 OR T1095 OR T1105 OR T1036) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1055\"\n[[rule.threat.technique]]\nid = \"T1068\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1055\"\n[[rule.threat.technique]]\nid = \"T1068\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1055\"\n[[rule.threat.technique]]\nid = \"T1068\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1055\"\n[[rule.threat.technique]]\nid = \"T1068\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0069-muddywater.json b/app/playbooks/threat-groups/apt-g0069-muddywater.json
new file mode 100644
index 0000000..9b39712
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0069-muddywater.json
@@ -0,0 +1,124 @@
+{
+ "id": "apt-g0069",
+ "num": 105,
+ "name": "MITRE ATT&CK Group — MuddyWater",
+ "fullName": "MuddyWater (G0069) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[MuddyWater](https://attack.mitre.org/groups/G0069) is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS). Since at least 2017, [MuddyWater](https://attack.mitre.org/groups/G0069) has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. [MuddyWater](https://attack.mitre.org/groups/G0069) has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026, [MuddyWater](https://attack.mitre.org/groups/G0069) used commercial satellite internet (i.e., Starlink) for command and control (C2) communication. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with MuddyWater.",
+ "mitre": "T1190, T1566, T1566.001, T1566.002, T1047, T1053.005, T1059.001, T1059.003, T1059.005, T1059.006, T1059.007, T1203, T1204.001, T1204.002, T1204.004, T1559.001, T1559.002, T1574.001, T1137.001, T1547.001, T1548.002, T1003.001, T1003.004, T1003.005",
+ "aliases": [
+ "MuddyWater",
+ "Earth Vetala",
+ "MERCURY",
+ "Static Kitten",
+ "Seedworm",
+ "TEMP.Zagros",
+ "Mango Sandstorm",
+ "TA450",
+ "MuddyKrill"
+ ],
+ "mitreGroupId": "G0069",
+ "mitreUrl": "https://attack.mitre.org/groups/G0069",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile MuddyWater with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0069. Aliases: MuddyWater, Earth Vetala, MERCURY, Static Kitten, Seedworm, TEMP.Zagros, Mango Sandstorm, TA450, MuddyKrill. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Defense Impairment, Reconnaissance, Resource Development, Stealth. Mapped techniques: T1190 Exploit Public-Facing Application, T1566 Phishing, T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link, T1047 Windows Management Instrumentation, T1053.005 Scheduled Task, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1059.005 Visual Basic, T1059.006 Python, T1059.007 JavaScript, T1203 Exploitation for Client Execution, plus 56 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0069. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - MuddyWater (G0069) ATT&CK technique pivots\n(rule.threat.technique.id:(T1190 OR T1566 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.006 OR T1059.007 OR T1203 OR T1204.001 OR T1204.002 OR T1204.004 OR T1559.001 OR T1559.002 OR T1574.001 OR T1137.001 OR T1547.001) OR threat.technique.id:(T1190 OR T1566 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.006 OR T1059.007 OR T1203 OR T1204.001 OR T1204.002 OR T1204.004 OR T1559.001 OR T1559.002 OR T1574.001 OR T1137.001 OR T1547.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - MuddyWater (G0069) ATT&CK technique pivots\n(rule.threat.technique.id:(T1190 OR T1566 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.006 OR T1059.007 OR T1203 OR T1204.001 OR T1204.002 OR T1204.004 OR T1559.001 OR T1559.002 OR T1574.001 OR T1137.001 OR T1547.001) OR threat.technique.id:(T1190 OR T1566 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.006 OR T1059.007 OR T1203 OR T1204.001 OR T1204.002 OR T1204.004 OR T1559.001 OR T1559.002 OR T1574.001 OR T1137.001 OR T1547.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile MuddyWater with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1190 OR T1566 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.006 OR T1059.007 OR T1203 OR T1204.001 OR T1204.002 OR T1204.004 OR T1559.001 OR T1559.002 OR T1574.001 OR T1137.001 OR T1547.001) OR threat.technique.id:(T1190 OR T1566 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.006 OR T1059.007 OR T1203 OR T1204.001 OR T1204.002 OR T1204.004 OR T1559.001 OR T1559.002 OR T1574.001 OR T1137.001 OR T1547.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1047\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1047\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1047\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1047\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0070-dark-caracal.json b/app/playbooks/threat-groups/apt-g0070-dark-caracal.json
new file mode 100644
index 0000000..137804c
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0070-dark-caracal.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0070",
+ "num": 106,
+ "name": "MITRE ATT&CK Group — Dark Caracal",
+ "fullName": "Dark Caracal (G0070) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Dark Caracal](https://attack.mitre.org/groups/G0070) is threat group that has been attributed to the Lebanese General Directorate of General Security (GDGS) and has operated since at least 2012. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Dark Caracal.",
+ "mitre": "T1189, T1566.003, T1059.003, T1204.002, T1547.001, T1083, T1005, T1113, T1071.001, T1027.002, T1027.013, T1218.001",
+ "aliases": [
+ "Dark Caracal"
+ ],
+ "mitreGroupId": "G0070",
+ "mitreUrl": "https://attack.mitre.org/groups/G0070",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Dark Caracal with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0070. Aliases: Dark Caracal. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Discovery, Collection, Command and Control, Stealth. Mapped techniques: T1189 Drive-by Compromise, T1566.003 Spearphishing via Service, T1059.003 Windows Command Shell, T1204.002 Malicious File, T1547.001 Registry Run Keys / Startup Folder, T1083 File and Directory Discovery, T1005 Data from Local System, T1113 Screen Capture, T1071.001 Web Protocols, T1027.002 Software Packing, T1027.013 Encrypted/Encoded File, T1218.001 Compiled HTML File. Source: https://attack.mitre.org/groups/G0070. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Dark Caracal (G0070) ATT&CK technique pivots\n(rule.threat.technique.id:(T1189 OR T1566.003 OR T1059.003 OR T1204.002 OR T1547.001 OR T1083 OR T1005 OR T1113 OR T1071.001 OR T1027.002 OR T1027.013 OR T1218.001) OR threat.technique.id:(T1189 OR T1566.003 OR T1059.003 OR T1204.002 OR T1547.001 OR T1083 OR T1005 OR T1113 OR T1071.001 OR T1027.002 OR T1027.013 OR T1218.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Dark Caracal (G0070) ATT&CK technique pivots\n(rule.threat.technique.id:(T1189 OR T1566.003 OR T1059.003 OR T1204.002 OR T1547.001 OR T1083 OR T1005 OR T1113 OR T1071.001 OR T1027.002 OR T1027.013 OR T1218.001) OR threat.technique.id:(T1189 OR T1566.003 OR T1059.003 OR T1204.002 OR T1547.001 OR T1083 OR T1005 OR T1113 OR T1071.001 OR T1027.002 OR T1027.013 OR T1218.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Dark Caracal with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1189 OR T1566.003 OR T1059.003 OR T1204.002 OR T1547.001 OR T1083 OR T1005 OR T1113 OR T1071.001 OR T1027.002 OR T1027.013 OR T1218.001) OR threat.technique.id:(T1189 OR T1566.003 OR T1059.003 OR T1204.002 OR T1547.001 OR T1083 OR T1005 OR T1113 OR T1071.001 OR T1027.002 OR T1027.013 OR T1218.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.003\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1547.001\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.003\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1547.001\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.003\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1547.001\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.003\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1547.001\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0071-orangeworm.json b/app/playbooks/threat-groups/apt-g0071-orangeworm.json
new file mode 100644
index 0000000..0b75f3d
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0071-orangeworm.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0071",
+ "num": 107,
+ "name": "MITRE ATT&CK Group — Orangeworm",
+ "fullName": "Orangeworm (G0071) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Orangeworm](https://attack.mitre.org/groups/G0071) is a group that has targeted organizations in the healthcare sector in the United States, Europe, and Asia since at least 2015, likely for the purpose of corporate espionage. Reverse engineering of [Kwampirs](https://attack.mitre.org/software/S0236), directly associated with [Orangeworm](https://attack.mitre.org/groups/G0071) activity, indicates significant functional and development overlaps with [Shamoon](https://attack.mitre.org/software/S0140). This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Orangeworm.",
+ "mitre": "T1021.002, T1071.001",
+ "aliases": [
+ "Orangeworm"
+ ],
+ "mitreGroupId": "G0071",
+ "mitreUrl": "https://attack.mitre.org/groups/G0071",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Orangeworm with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0071. Aliases: Orangeworm. Primary mapped tactics: Lateral Movement, Command and Control. Mapped techniques: T1021.002 SMB/Windows Admin Shares, T1071.001 Web Protocols. Source: https://attack.mitre.org/groups/G0071. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Orangeworm (G0071) ATT&CK technique pivots\n(rule.threat.technique.id:(T1021.002 OR T1071.001) OR threat.technique.id:(T1021.002 OR T1071.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Orangeworm (G0071) ATT&CK technique pivots\n(rule.threat.technique.id:(T1021.002 OR T1071.001) OR threat.technique.id:(T1021.002 OR T1071.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Orangeworm with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1021.002 OR T1071.001) OR threat.technique.id:(T1021.002 OR T1071.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1021.002\"\n[[rule.threat.technique]]\nid = \"T1071.001\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1021.002\"\n[[rule.threat.technique]]\nid = \"T1071.001\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1021.002\"\n[[rule.threat.technique]]\nid = \"T1071.001\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1021.002\"\n[[rule.threat.technique]]\nid = \"T1071.001\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0073-apt19.json b/app/playbooks/threat-groups/apt-g0073-apt19.json
new file mode 100644
index 0000000..5caaeae
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0073-apt19.json
@@ -0,0 +1,120 @@
+{
+ "id": "apt-g0073",
+ "num": 108,
+ "name": "MITRE ATT&CK Group — APT19",
+ "fullName": "APT19 (G0073) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[APT19](https://attack.mitre.org/groups/G0073) is a Chinese-based threat group that has targeted a variety of industries, including defense, finance, energy, pharmaceutical, telecommunications, high tech, education, manufacturing, and legal services. In 2017, a phishing campaign was used to target seven law and investment firms. Some analysts track [APT19](https://attack.mitre.org/groups/G0073) and [Deep Panda](https://attack.mitre.org/groups/G0009) as the same group, but it is unclear from open source information if the groups are the same. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with APT19.",
+ "mitre": "T1189, T1566.001, T1059, T1059.001, T1204.002, T1574.001, T1112, T1543.003, T1547.001, T1016, T1033, T1082, T1071.001, T1132.001, T1588.002, T1027.010, T1027.013, T1140, T1218.010, T1218.011, T1564.003",
+ "aliases": [
+ "APT19",
+ "Codoso",
+ "C0d0so0",
+ "Codoso Team",
+ "Sunshop Group"
+ ],
+ "mitreGroupId": "G0073",
+ "mitreUrl": "https://attack.mitre.org/groups/G0073",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile APT19 with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0073. Aliases: APT19, Codoso, C0d0so0, Codoso Team, Sunshop Group. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Discovery, Command and Control, Defense Impairment, Resource Development, Stealth. Mapped techniques: T1189 Drive-by Compromise, T1566.001 Spearphishing Attachment, T1059 Command and Scripting Interpreter, T1059.001 PowerShell, T1204.002 Malicious File, T1574.001 DLL, T1112 Modify Registry, T1543.003 Windows Service, T1547.001 Registry Run Keys / Startup Folder, T1016 System Network Configuration Discovery, T1033 System Owner/User Discovery, T1082 System Information Discovery, plus 9 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0073. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - APT19 (G0073) ATT&CK technique pivots\n(rule.threat.technique.id:(T1189 OR T1566.001 OR T1059 OR T1059.001 OR T1204.002 OR T1574.001 OR T1112 OR T1543.003 OR T1547.001 OR T1016 OR T1033 OR T1082 OR T1071.001 OR T1132.001 OR T1588.002 OR T1027.010 OR T1027.013 OR T1140 OR T1218.010 OR T1218.011) OR threat.technique.id:(T1189 OR T1566.001 OR T1059 OR T1059.001 OR T1204.002 OR T1574.001 OR T1112 OR T1543.003 OR T1547.001 OR T1016 OR T1033 OR T1082 OR T1071.001 OR T1132.001 OR T1588.002 OR T1027.010 OR T1027.013 OR T1140 OR T1218.010 OR T1218.011) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - APT19 (G0073) ATT&CK technique pivots\n(rule.threat.technique.id:(T1189 OR T1566.001 OR T1059 OR T1059.001 OR T1204.002 OR T1574.001 OR T1112 OR T1543.003 OR T1547.001 OR T1016 OR T1033 OR T1082 OR T1071.001 OR T1132.001 OR T1588.002 OR T1027.010 OR T1027.013 OR T1140 OR T1218.010 OR T1218.011) OR threat.technique.id:(T1189 OR T1566.001 OR T1059 OR T1059.001 OR T1204.002 OR T1574.001 OR T1112 OR T1543.003 OR T1547.001 OR T1016 OR T1033 OR T1082 OR T1071.001 OR T1132.001 OR T1588.002 OR T1027.010 OR T1027.013 OR T1140 OR T1218.010 OR T1218.011) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile APT19 with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1189 OR T1566.001 OR T1059 OR T1059.001 OR T1204.002 OR T1574.001 OR T1112 OR T1543.003 OR T1547.001 OR T1016 OR T1033 OR T1082 OR T1071.001 OR T1132.001 OR T1588.002 OR T1027.010 OR T1027.013 OR T1140 OR T1218.010 OR T1218.011) OR threat.technique.id:(T1189 OR T1566.001 OR T1059 OR T1059.001 OR T1204.002 OR T1574.001 OR T1112 OR T1543.003 OR T1547.001 OR T1016 OR T1033 OR T1082 OR T1071.001 OR T1132.001 OR T1588.002 OR T1027.010 OR T1027.013 OR T1140 OR T1218.010 OR T1218.011) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1204.002\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1204.002\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1204.002\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1204.002\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0075-rancor.json b/app/playbooks/threat-groups/apt-g0075-rancor.json
new file mode 100644
index 0000000..e5308a4
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0075-rancor.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0075",
+ "num": 109,
+ "name": "MITRE ATT&CK Group — Rancor",
+ "fullName": "Rancor (G0075) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Rancor](https://attack.mitre.org/groups/G0075) is a threat group that has led targeted campaigns against the South East Asia region. [Rancor](https://attack.mitre.org/groups/G0075) uses politically-motivated lures to entice victims to open malicious documents. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Rancor.",
+ "mitre": "T1566.001, T1053.005, T1059.003, T1059.005, T1204.002, T1546.003, T1071.001, T1105, T1218.007",
+ "aliases": [
+ "Rancor"
+ ],
+ "mitreGroupId": "G0075",
+ "mitreUrl": "https://attack.mitre.org/groups/G0075",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Rancor with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0075. Aliases: Rancor. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Command and Control, Stealth. Mapped techniques: T1566.001 Spearphishing Attachment, T1053.005 Scheduled Task, T1059.003 Windows Command Shell, T1059.005 Visual Basic, T1204.002 Malicious File, T1546.003 Windows Management Instrumentation Event Subscription, T1071.001 Web Protocols, T1105 Ingress Tool Transfer, T1218.007 Msiexec. Source: https://attack.mitre.org/groups/G0075. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Rancor (G0075) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1053.005 OR T1059.003 OR T1059.005 OR T1204.002 OR T1546.003 OR T1071.001 OR T1105 OR T1218.007) OR threat.technique.id:(T1566.001 OR T1053.005 OR T1059.003 OR T1059.005 OR T1204.002 OR T1546.003 OR T1071.001 OR T1105 OR T1218.007) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Rancor (G0075) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1053.005 OR T1059.003 OR T1059.005 OR T1204.002 OR T1546.003 OR T1071.001 OR T1105 OR T1218.007) OR threat.technique.id:(T1566.001 OR T1053.005 OR T1059.003 OR T1059.005 OR T1204.002 OR T1546.003 OR T1071.001 OR T1105 OR T1218.007) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Rancor with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1566.001 OR T1053.005 OR T1059.003 OR T1059.005 OR T1204.002 OR T1546.003 OR T1071.001 OR T1105 OR T1218.007) OR threat.technique.id:(T1566.001 OR T1053.005 OR T1059.003 OR T1059.005 OR T1204.002 OR T1546.003 OR T1071.001 OR T1105 OR T1218.007) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1204.002\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1204.002\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1204.002\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1204.002\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0076-thrip.json b/app/playbooks/threat-groups/apt-g0076-thrip.json
new file mode 100644
index 0000000..954e468
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0076-thrip.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0076",
+ "num": 110,
+ "name": "MITRE ATT&CK Group — Thrip",
+ "fullName": "Thrip (G0076) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Thrip](https://attack.mitre.org/groups/G0076) is an espionage group that has targeted satellite communications, telecoms, and defense contractor companies in the U.S. and Southeast Asia. The group uses custom malware as well as \"living off the land\" techniques. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Thrip.",
+ "mitre": "T1059.001, T1219.002, T1048.003, T1588.002",
+ "aliases": [
+ "Thrip"
+ ],
+ "mitreGroupId": "G0076",
+ "mitreUrl": "https://attack.mitre.org/groups/G0076",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Thrip with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0076. Aliases: Thrip. Primary mapped tactics: Execution, Command and Control, Exfiltration, Resource Development. Mapped techniques: T1059.001 PowerShell, T1219.002 Remote Desktop Software, T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol, T1588.002 Tool. Source: https://attack.mitre.org/groups/G0076. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Thrip (G0076) ATT&CK technique pivots\n(rule.threat.technique.id:(T1059.001 OR T1219.002 OR T1048.003 OR T1588.002) OR threat.technique.id:(T1059.001 OR T1219.002 OR T1048.003 OR T1588.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Thrip (G0076) ATT&CK technique pivots\n(rule.threat.technique.id:(T1059.001 OR T1219.002 OR T1048.003 OR T1588.002) OR threat.technique.id:(T1059.001 OR T1219.002 OR T1048.003 OR T1588.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Thrip with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1059.001 OR T1219.002 OR T1048.003 OR T1588.002) OR threat.technique.id:(T1059.001 OR T1219.002 OR T1048.003 OR T1588.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1219.002\"\n[[rule.threat.technique]]\nid = \"T1048.003\"\n[[rule.threat.technique]]\nid = \"T1588.002\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1219.002\"\n[[rule.threat.technique]]\nid = \"T1048.003\"\n[[rule.threat.technique]]\nid = \"T1588.002\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1219.002\"\n[[rule.threat.technique]]\nid = \"T1048.003\"\n[[rule.threat.technique]]\nid = \"T1588.002\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1219.002\"\n[[rule.threat.technique]]\nid = \"T1048.003\"\n[[rule.threat.technique]]\nid = \"T1588.002\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0077-leafminer.json b/app/playbooks/threat-groups/apt-g0077-leafminer.json
new file mode 100644
index 0000000..76d91ee
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0077-leafminer.json
@@ -0,0 +1,117 @@
+{
+ "id": "apt-g0077",
+ "num": 111,
+ "name": "MITRE ATT&CK Group — Leafminer",
+ "fullName": "Leafminer (G0077) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Leafminer](https://attack.mitre.org/groups/G0077) is an Iranian threat group that has targeted government organizations and business entities in the Middle East since at least early 2017. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Leafminer.",
+ "mitre": "T1189, T1059.007, T1136.001, T1055.013, T1003.001, T1003.004, T1003.005, T1110.003, T1552.001, T1555, T1555.003, T1018, T1046, T1083, T1114.002, T1588.002, T1027.010",
+ "aliases": [
+ "Leafminer",
+ "Raspite"
+ ],
+ "mitreGroupId": "G0077",
+ "mitreUrl": "https://attack.mitre.org/groups/G0077",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Leafminer with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0077. Aliases: Leafminer, Raspite. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Collection, Resource Development, Stealth. Mapped techniques: T1189 Drive-by Compromise, T1059.007 JavaScript, T1136.001 Local Account, T1055.013 Process Doppelgänging, T1003.001 LSASS Memory, T1003.004 LSA Secrets, T1003.005 Cached Domain Credentials, T1110.003 Password Spraying, T1552.001 Credentials In Files, T1555 Credentials from Password Stores, T1555.003 Credentials from Web Browsers, T1018 Remote System Discovery, plus 5 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0077. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Leafminer (G0077) ATT&CK technique pivots\n(rule.threat.technique.id:(T1189 OR T1059.007 OR T1136.001 OR T1055.013 OR T1003.001 OR T1003.004 OR T1003.005 OR T1110.003 OR T1552.001 OR T1555 OR T1555.003 OR T1018 OR T1046 OR T1083 OR T1114.002 OR T1588.002 OR T1027.010) OR threat.technique.id:(T1189 OR T1059.007 OR T1136.001 OR T1055.013 OR T1003.001 OR T1003.004 OR T1003.005 OR T1110.003 OR T1552.001 OR T1555 OR T1555.003 OR T1018 OR T1046 OR T1083 OR T1114.002 OR T1588.002 OR T1027.010) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Leafminer (G0077) ATT&CK technique pivots\n(rule.threat.technique.id:(T1189 OR T1059.007 OR T1136.001 OR T1055.013 OR T1003.001 OR T1003.004 OR T1003.005 OR T1110.003 OR T1552.001 OR T1555 OR T1555.003 OR T1018 OR T1046 OR T1083 OR T1114.002 OR T1588.002 OR T1027.010) OR threat.technique.id:(T1189 OR T1059.007 OR T1136.001 OR T1055.013 OR T1003.001 OR T1003.004 OR T1003.005 OR T1110.003 OR T1552.001 OR T1555 OR T1555.003 OR T1018 OR T1046 OR T1083 OR T1114.002 OR T1588.002 OR T1027.010) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Leafminer with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1189 OR T1059.007 OR T1136.001 OR T1055.013 OR T1003.001 OR T1003.004 OR T1003.005 OR T1110.003 OR T1552.001 OR T1555 OR T1555.003 OR T1018 OR T1046 OR T1083 OR T1114.002 OR T1588.002 OR T1027.010) OR threat.technique.id:(T1189 OR T1059.007 OR T1136.001 OR T1055.013 OR T1003.001 OR T1003.004 OR T1003.005 OR T1110.003 OR T1552.001 OR T1555 OR T1555.003 OR T1018 OR T1046 OR T1083 OR T1114.002 OR T1588.002 OR T1027.010) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1059.007\"\n[[rule.threat.technique]]\nid = \"T1136.001\"\n[[rule.threat.technique]]\nid = \"T1055.013\"\n[[rule.threat.technique]]\nid = \"T1003.001\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1059.007\"\n[[rule.threat.technique]]\nid = \"T1136.001\"\n[[rule.threat.technique]]\nid = \"T1055.013\"\n[[rule.threat.technique]]\nid = \"T1003.001\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1059.007\"\n[[rule.threat.technique]]\nid = \"T1136.001\"\n[[rule.threat.technique]]\nid = \"T1055.013\"\n[[rule.threat.technique]]\nid = \"T1003.001\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1059.007\"\n[[rule.threat.technique]]\nid = \"T1136.001\"\n[[rule.threat.technique]]\nid = \"T1055.013\"\n[[rule.threat.technique]]\nid = \"T1003.001\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0078-gorgon-group.json b/app/playbooks/threat-groups/apt-g0078-gorgon-group.json
new file mode 100644
index 0000000..6fb4e75
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0078-gorgon-group.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0078",
+ "num": 112,
+ "name": "MITRE ATT&CK Group — Gorgon Group",
+ "fullName": "Gorgon Group (G0078) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Gorgon Group](https://attack.mitre.org/groups/G0078) is a threat group consisting of members who are suspected to be Pakistan-based or have other connections to Pakistan. The group has performed a mix of criminal and targeted attacks, including campaigns against government organizations in the United Kingdom, Spain, Russia, and the United States. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Gorgon Group.",
+ "mitre": "T1566.001, T1059.001, T1059.003, T1059.005, T1106, T1204.002, T1112, T1547.001, T1547.009, T1055.002, T1055.012, T1105, T1685, T1588.002, T1140, T1564.003",
+ "aliases": [
+ "Gorgon Group"
+ ],
+ "mitreGroupId": "G0078",
+ "mitreUrl": "https://attack.mitre.org/groups/G0078",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Gorgon Group with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0078. Aliases: Gorgon Group. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Command and Control, Defense Impairment, Resource Development, Stealth. Mapped techniques: T1566.001 Spearphishing Attachment, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1059.005 Visual Basic, T1106 Native API, T1204.002 Malicious File, T1112 Modify Registry, T1547.001 Registry Run Keys / Startup Folder, T1547.009 Shortcut Modification, T1055.002 Portable Executable Injection, T1055.012 Process Hollowing, T1105 Ingress Tool Transfer, plus 4 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0078. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Gorgon Group (G0078) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1059.001 OR T1059.003 OR T1059.005 OR T1106 OR T1204.002 OR T1112 OR T1547.001 OR T1547.009 OR T1055.002 OR T1055.012 OR T1105 OR T1685 OR T1588.002 OR T1140 OR T1564.003) OR threat.technique.id:(T1566.001 OR T1059.001 OR T1059.003 OR T1059.005 OR T1106 OR T1204.002 OR T1112 OR T1547.001 OR T1547.009 OR T1055.002 OR T1055.012 OR T1105 OR T1685 OR T1588.002 OR T1140 OR T1564.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Gorgon Group (G0078) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1059.001 OR T1059.003 OR T1059.005 OR T1106 OR T1204.002 OR T1112 OR T1547.001 OR T1547.009 OR T1055.002 OR T1055.012 OR T1105 OR T1685 OR T1588.002 OR T1140 OR T1564.003) OR threat.technique.id:(T1566.001 OR T1059.001 OR T1059.003 OR T1059.005 OR T1106 OR T1204.002 OR T1112 OR T1547.001 OR T1547.009 OR T1055.002 OR T1055.012 OR T1105 OR T1685 OR T1588.002 OR T1140 OR T1564.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Gorgon Group with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1566.001 OR T1059.001 OR T1059.003 OR T1059.005 OR T1106 OR T1204.002 OR T1112 OR T1547.001 OR T1547.009 OR T1055.002 OR T1055.012 OR T1105 OR T1685 OR T1588.002 OR T1140 OR T1564.003) OR threat.technique.id:(T1566.001 OR T1059.001 OR T1059.003 OR T1059.005 OR T1106 OR T1204.002 OR T1112 OR T1547.001 OR T1547.009 OR T1055.002 OR T1055.012 OR T1105 OR T1685 OR T1588.002 OR T1140 OR T1564.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1106\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1106\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1106\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1106\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0079-darkhydrus.json b/app/playbooks/threat-groups/apt-g0079-darkhydrus.json
new file mode 100644
index 0000000..50c031e
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0079-darkhydrus.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0079",
+ "num": 113,
+ "name": "MITRE ATT&CK Group — DarkHydrus",
+ "fullName": "DarkHydrus (G0079) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[DarkHydrus](https://attack.mitre.org/groups/G0079) is a threat group that has targeted government agencies and educational institutions in the Middle East since at least 2016. The group heavily leverages open-source tools and custom payloads for carrying out attacks. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with DarkHydrus.",
+ "mitre": "T1566.001, T1059.001, T1204.002, T1187, T1588.002, T1221, T1564.003",
+ "aliases": [
+ "DarkHydrus"
+ ],
+ "mitreGroupId": "G0079",
+ "mitreUrl": "https://attack.mitre.org/groups/G0079",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile DarkHydrus with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0079. Aliases: DarkHydrus. Primary mapped tactics: Initial Access, Execution, Credential Access, Resource Development, Stealth. Mapped techniques: T1566.001 Spearphishing Attachment, T1059.001 PowerShell, T1204.002 Malicious File, T1187 Forced Authentication, T1588.002 Tool, T1221 Template Injection, T1564.003 Hidden Window. Source: https://attack.mitre.org/groups/G0079. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - DarkHydrus (G0079) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1059.001 OR T1204.002 OR T1187 OR T1588.002 OR T1221 OR T1564.003) OR threat.technique.id:(T1566.001 OR T1059.001 OR T1204.002 OR T1187 OR T1588.002 OR T1221 OR T1564.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - DarkHydrus (G0079) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1059.001 OR T1204.002 OR T1187 OR T1588.002 OR T1221 OR T1564.003) OR threat.technique.id:(T1566.001 OR T1059.001 OR T1204.002 OR T1187 OR T1588.002 OR T1221 OR T1564.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile DarkHydrus with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1566.001 OR T1059.001 OR T1204.002 OR T1187 OR T1588.002 OR T1221 OR T1564.003) OR threat.technique.id:(T1566.001 OR T1059.001 OR T1204.002 OR T1187 OR T1588.002 OR T1221 OR T1564.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1187\"\n[[rule.threat.technique]]\nid = \"T1588.002\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1187\"\n[[rule.threat.technique]]\nid = \"T1588.002\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1187\"\n[[rule.threat.technique]]\nid = \"T1588.002\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1187\"\n[[rule.threat.technique]]\nid = \"T1588.002\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0080-cobalt-group.json b/app/playbooks/threat-groups/apt-g0080-cobalt-group.json
new file mode 100644
index 0000000..3e4e642
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0080-cobalt-group.json
@@ -0,0 +1,119 @@
+{
+ "id": "apt-g0080",
+ "num": 114,
+ "name": "MITRE ATT&CK Group — Cobalt Group",
+ "fullName": "Cobalt Group (G0080) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Cobalt Group](https://attack.mitre.org/groups/G0080) is a financially motivated threat group that has primarily targeted financial institutions since at least 2016. The group has conducted intrusions to steal money via targeting ATM systems, card processing, payment systems and SWIFT systems. [Cobalt Group](https://attack.mitre.org/groups/G0080) has mainly targeted banks in Eastern Europe, Central Asia, and Southeast Asia. One of the alleged leaders was arrested in Spain in early 2018, but the group still appears to be active. The group has been known to target organizations in order to use their access to then compromise additional victims. Reporting indicates there may be links between [Cobalt Group](https://attack.mitre.org/groups/G0080) and both the malware [Carbanak](https://attack.mitre.org/software/S0030) and the group [Carbanak](https://attack.mitre.org/groups/G0008). This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Cobalt Group.",
+ "mitre": "T1195.002, T1566.001, T1566.002, T1053.005, T1059.001, T1059.003, T1059.005, T1059.007, T1203, T1204.001, T1204.002, T1559.002, T1037.001, T1543.003, T1547.001, T1055, T1068, T1548.002, T1046, T1518.001, T1021.001, T1071.001, T1071.004, T1105",
+ "aliases": [
+ "Cobalt Group",
+ "GOLD KINGSWOOD",
+ "Cobalt Gang",
+ "Cobalt Spider"
+ ],
+ "mitreGroupId": "G0080",
+ "mitreUrl": "https://attack.mitre.org/groups/G0080",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Cobalt Group with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0080. Aliases: Cobalt Group, GOLD KINGSWOOD, Cobalt Gang, Cobalt Spider. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Discovery, Lateral Movement, Command and Control, Resource Development, Stealth. Mapped techniques: T1195.002 Compromise Software Supply Chain, T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link, T1053.005 Scheduled Task, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1059.005 Visual Basic, T1059.007 JavaScript, T1203 Exploitation for Client Execution, T1204.001 Malicious Link, T1204.002 Malicious File, T1559.002 Dynamic Data Exchange, plus 22 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0080. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Cobalt Group (G0080) ATT&CK technique pivots\n(rule.threat.technique.id:(T1195.002 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1203 OR T1204.001 OR T1204.002 OR T1559.002 OR T1037.001 OR T1543.003 OR T1547.001 OR T1055 OR T1068 OR T1548.002 OR T1046 OR T1518.001) OR threat.technique.id:(T1195.002 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1203 OR T1204.001 OR T1204.002 OR T1559.002 OR T1037.001 OR T1543.003 OR T1547.001 OR T1055 OR T1068 OR T1548.002 OR T1046 OR T1518.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Cobalt Group (G0080) ATT&CK technique pivots\n(rule.threat.technique.id:(T1195.002 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1203 OR T1204.001 OR T1204.002 OR T1559.002 OR T1037.001 OR T1543.003 OR T1547.001 OR T1055 OR T1068 OR T1548.002 OR T1046 OR T1518.001) OR threat.technique.id:(T1195.002 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1203 OR T1204.001 OR T1204.002 OR T1559.002 OR T1037.001 OR T1543.003 OR T1547.001 OR T1055 OR T1068 OR T1548.002 OR T1046 OR T1518.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Cobalt Group with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1195.002 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1203 OR T1204.001 OR T1204.002 OR T1559.002 OR T1037.001 OR T1543.003 OR T1547.001 OR T1055 OR T1068 OR T1548.002 OR T1046 OR T1518.001) OR threat.technique.id:(T1195.002 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1203 OR T1204.001 OR T1204.002 OR T1559.002 OR T1037.001 OR T1543.003 OR T1547.001 OR T1055 OR T1068 OR T1548.002 OR T1046 OR T1518.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1195.002\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1195.002\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1195.002\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1195.002\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0081-tropic-trooper.json b/app/playbooks/threat-groups/apt-g0081-tropic-trooper.json
new file mode 100644
index 0000000..99dd38f
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0081-tropic-trooper.json
@@ -0,0 +1,118 @@
+{
+ "id": "apt-g0081",
+ "num": 115,
+ "name": "MITRE ATT&CK Group — Tropic Trooper",
+ "fullName": "Tropic Trooper (G0081) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Tropic Trooper](https://attack.mitre.org/groups/G0081) is an unaffiliated threat group that has led targeted campaigns against targets in Taiwan, the Philippines, and Hong Kong. [Tropic Trooper](https://attack.mitre.org/groups/G0081) focuses on targeting government, healthcare, transportation, and high-tech industries and has been active since 2011. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Tropic Trooper.",
+ "mitre": "T1078.003, T1091, T1566.001, T1059.003, T1106, T1203, T1204.002, T1574.001, T1505.003, T1543.003, T1547.001, T1547.004, T1055.001, T1016, T1033, T1046, T1049, T1057, T1082, T1083, T1135, T1518, T1518.001, T1680",
+ "aliases": [
+ "Tropic Trooper",
+ "Pirate Panda",
+ "KeyBoy"
+ ],
+ "mitreGroupId": "G0081",
+ "mitreUrl": "https://attack.mitre.org/groups/G0081",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Tropic Trooper with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0081. Aliases: Tropic Trooper, Pirate Panda, KeyBoy. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Stealth. Mapped techniques: T1078.003 Local Accounts, T1091 Replication Through Removable Media, T1566.001 Spearphishing Attachment, T1059.003 Windows Command Shell, T1106 Native API, T1203 Exploitation for Client Execution, T1204.002 Malicious File, T1574.001 DLL, T1505.003 Web Shell, T1543.003 Windows Service, T1547.001 Registry Run Keys / Startup Folder, T1547.004 Winlogon Helper DLL, plus 28 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0081. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Tropic Trooper (G0081) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078.003 OR T1091 OR T1566.001 OR T1059.003 OR T1106 OR T1203 OR T1204.002 OR T1574.001 OR T1505.003 OR T1543.003 OR T1547.001 OR T1547.004 OR T1055.001 OR T1016 OR T1033 OR T1046 OR T1049 OR T1057 OR T1082 OR T1083) OR threat.technique.id:(T1078.003 OR T1091 OR T1566.001 OR T1059.003 OR T1106 OR T1203 OR T1204.002 OR T1574.001 OR T1505.003 OR T1543.003 OR T1547.001 OR T1547.004 OR T1055.001 OR T1016 OR T1033 OR T1046 OR T1049 OR T1057 OR T1082 OR T1083) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Tropic Trooper (G0081) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078.003 OR T1091 OR T1566.001 OR T1059.003 OR T1106 OR T1203 OR T1204.002 OR T1574.001 OR T1505.003 OR T1543.003 OR T1547.001 OR T1547.004 OR T1055.001 OR T1016 OR T1033 OR T1046 OR T1049 OR T1057 OR T1082 OR T1083) OR threat.technique.id:(T1078.003 OR T1091 OR T1566.001 OR T1059.003 OR T1106 OR T1203 OR T1204.002 OR T1574.001 OR T1505.003 OR T1543.003 OR T1547.001 OR T1547.004 OR T1055.001 OR T1016 OR T1033 OR T1046 OR T1049 OR T1057 OR T1082 OR T1083) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Tropic Trooper with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078.003 OR T1091 OR T1566.001 OR T1059.003 OR T1106 OR T1203 OR T1204.002 OR T1574.001 OR T1505.003 OR T1543.003 OR T1547.001 OR T1547.004 OR T1055.001 OR T1016 OR T1033 OR T1046 OR T1049 OR T1057 OR T1082 OR T1083) OR threat.technique.id:(T1078.003 OR T1091 OR T1566.001 OR T1059.003 OR T1106 OR T1203 OR T1204.002 OR T1574.001 OR T1505.003 OR T1543.003 OR T1547.001 OR T1547.004 OR T1055.001 OR T1016 OR T1033 OR T1046 OR T1049 OR T1057 OR T1082 OR T1083) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1091\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1106\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1091\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1106\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1091\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1106\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1091\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1106\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0082-apt38.json b/app/playbooks/threat-groups/apt-g0082-apt38.json
new file mode 100644
index 0000000..a98dfdf
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0082-apt38.json
@@ -0,0 +1,122 @@
+{
+ "id": "apt-g0082",
+ "num": 116,
+ "name": "MITRE ATT&CK Group — APT38",
+ "fullName": "APT38 (G0082) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[APT38](https://attack.mitre.org/groups/G0082) is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau. Active since at least 2014, [APT38](https://attack.mitre.org/groups/G0082) has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, during which [APT38](https://attack.mitre.org/groups/G0082) stole $81 million, as well as attacks against Bancomext and Banco de Chile ; some of their attacks have been destructive. North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name [Lazarus Group](https://attack.mitre.org/groups/G0032) instead of tracking clusters or subgroups. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with APT38.",
+ "mitre": "T1189, T1566.001, T1053.003, T1053.005, T1059.001, T1059.003, T1059.005, T1106, T1204.001, T1204.002, T1569.002, T1112, T1505.003, T1543.003, T1055, T1548.002, T1056.001, T1110, T1033, T1049, T1057, T1082, T1083, T1135",
+ "aliases": [
+ "APT38",
+ "NICKEL GLADSTONE",
+ "BeagleBoyz",
+ "Bluenoroff",
+ "Stardust Chollima",
+ "Sapphire Sleet",
+ "COPERNICIUM"
+ ],
+ "mitreGroupId": "G0082",
+ "mitreUrl": "https://attack.mitre.org/groups/G0082",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile APT38 with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0082. Aliases: APT38, NICKEL GLADSTONE, BeagleBoyz, Bluenoroff, Stardust Chollima, Sapphire Sleet, COPERNICIUM. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Collection, Command and Control, Impact, Defense Impairment, Resource Development, Stealth. Mapped techniques: T1189 Drive-by Compromise, T1566.001 Spearphishing Attachment, T1053.003 Cron, T1053.005 Scheduled Task, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1059.005 Visual Basic, T1106 Native API, T1204.001 Malicious Link, T1204.002 Malicious File, T1569.002 Service Execution, T1112 Modify Registry, plus 44 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0082. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - APT38 (G0082) ATT&CK technique pivots\n(rule.threat.technique.id:(T1189 OR T1566.001 OR T1053.003 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1106 OR T1204.001 OR T1204.002 OR T1569.002 OR T1112 OR T1505.003 OR T1543.003 OR T1055 OR T1548.002 OR T1056.001 OR T1110 OR T1033 OR T1049) OR threat.technique.id:(T1189 OR T1566.001 OR T1053.003 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1106 OR T1204.001 OR T1204.002 OR T1569.002 OR T1112 OR T1505.003 OR T1543.003 OR T1055 OR T1548.002 OR T1056.001 OR T1110 OR T1033 OR T1049) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - APT38 (G0082) ATT&CK technique pivots\n(rule.threat.technique.id:(T1189 OR T1566.001 OR T1053.003 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1106 OR T1204.001 OR T1204.002 OR T1569.002 OR T1112 OR T1505.003 OR T1543.003 OR T1055 OR T1548.002 OR T1056.001 OR T1110 OR T1033 OR T1049) OR threat.technique.id:(T1189 OR T1566.001 OR T1053.003 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1106 OR T1204.001 OR T1204.002 OR T1569.002 OR T1112 OR T1505.003 OR T1543.003 OR T1055 OR T1548.002 OR T1056.001 OR T1110 OR T1033 OR T1049) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile APT38 with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1189 OR T1566.001 OR T1053.003 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1106 OR T1204.001 OR T1204.002 OR T1569.002 OR T1112 OR T1505.003 OR T1543.003 OR T1055 OR T1548.002 OR T1056.001 OR T1110 OR T1033 OR T1049) OR threat.technique.id:(T1189 OR T1566.001 OR T1053.003 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1106 OR T1204.001 OR T1204.002 OR T1569.002 OR T1112 OR T1505.003 OR T1543.003 OR T1055 OR T1548.002 OR T1056.001 OR T1110 OR T1033 OR T1049) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1053.003\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1053.003\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1053.003\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1053.003\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0083-silverterrier.json b/app/playbooks/threat-groups/apt-g0083-silverterrier.json
new file mode 100644
index 0000000..1b2d4c4
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0083-silverterrier.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0083",
+ "num": 117,
+ "name": "MITRE ATT&CK Group — SilverTerrier",
+ "fullName": "SilverTerrier (G0083) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[SilverTerrier](https://attack.mitre.org/groups/G0083) is a Nigerian threat group that has been seen active since 2014. [SilverTerrier](https://attack.mitre.org/groups/G0083) mainly targets organizations in high technology, higher education, and manufacturing. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with SilverTerrier.",
+ "mitre": "T1071.001, T1071.002, T1071.003, T1657",
+ "aliases": [
+ "SilverTerrier"
+ ],
+ "mitreGroupId": "G0083",
+ "mitreUrl": "https://attack.mitre.org/groups/G0083",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile SilverTerrier with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0083. Aliases: SilverTerrier. Primary mapped tactics: Command and Control, Impact. Mapped techniques: T1071.001 Web Protocols, T1071.002 File Transfer Protocols, T1071.003 Mail Protocols, T1657 Financial Theft. Source: https://attack.mitre.org/groups/G0083. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - SilverTerrier (G0083) ATT&CK technique pivots\n(rule.threat.technique.id:(T1071.001 OR T1071.002 OR T1071.003 OR T1657) OR threat.technique.id:(T1071.001 OR T1071.002 OR T1071.003 OR T1657) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - SilverTerrier (G0083) ATT&CK technique pivots\n(rule.threat.technique.id:(T1071.001 OR T1071.002 OR T1071.003 OR T1657) OR threat.technique.id:(T1071.001 OR T1071.002 OR T1071.003 OR T1657) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile SilverTerrier with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1071.001 OR T1071.002 OR T1071.003 OR T1657) OR threat.technique.id:(T1071.001 OR T1071.002 OR T1071.003 OR T1657) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1071.001\"\n[[rule.threat.technique]]\nid = \"T1071.002\"\n[[rule.threat.technique]]\nid = \"T1071.003\"\n[[rule.threat.technique]]\nid = \"T1657\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1071.001\"\n[[rule.threat.technique]]\nid = \"T1071.002\"\n[[rule.threat.technique]]\nid = \"T1071.003\"\n[[rule.threat.technique]]\nid = \"T1657\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1071.001\"\n[[rule.threat.technique]]\nid = \"T1071.002\"\n[[rule.threat.technique]]\nid = \"T1071.003\"\n[[rule.threat.technique]]\nid = \"T1657\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1071.001\"\n[[rule.threat.technique]]\nid = \"T1071.002\"\n[[rule.threat.technique]]\nid = \"T1071.003\"\n[[rule.threat.technique]]\nid = \"T1657\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0084-gallmaker.json b/app/playbooks/threat-groups/apt-g0084-gallmaker.json
new file mode 100644
index 0000000..c1a4f31
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0084-gallmaker.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0084",
+ "num": 118,
+ "name": "MITRE ATT&CK Group — Gallmaker",
+ "fullName": "Gallmaker (G0084) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Gallmaker](https://attack.mitre.org/groups/G0084) is a cyberespionage group that has targeted victims in the Middle East and has been active since at least December 2017. The group has mainly targeted victims in the defense, military, and government sectors. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Gallmaker.",
+ "mitre": "T1566.001, T1059.001, T1204.002, T1559.002, T1560.001, T1027",
+ "aliases": [
+ "Gallmaker"
+ ],
+ "mitreGroupId": "G0084",
+ "mitreUrl": "https://attack.mitre.org/groups/G0084",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Gallmaker with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0084. Aliases: Gallmaker. Primary mapped tactics: Initial Access, Execution, Collection, Stealth. Mapped techniques: T1566.001 Spearphishing Attachment, T1059.001 PowerShell, T1204.002 Malicious File, T1559.002 Dynamic Data Exchange, T1560.001 Archive via Utility, T1027 Obfuscated Files or Information. Source: https://attack.mitre.org/groups/G0084. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Gallmaker (G0084) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1059.001 OR T1204.002 OR T1559.002 OR T1560.001 OR T1027) OR threat.technique.id:(T1566.001 OR T1059.001 OR T1204.002 OR T1559.002 OR T1560.001 OR T1027) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Gallmaker (G0084) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1059.001 OR T1204.002 OR T1559.002 OR T1560.001 OR T1027) OR threat.technique.id:(T1566.001 OR T1059.001 OR T1204.002 OR T1559.002 OR T1560.001 OR T1027) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Gallmaker with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1566.001 OR T1059.001 OR T1204.002 OR T1559.002 OR T1560.001 OR T1027) OR threat.technique.id:(T1566.001 OR T1059.001 OR T1204.002 OR T1559.002 OR T1560.001 OR T1027) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1559.002\"\n[[rule.threat.technique]]\nid = \"T1560.001\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1559.002\"\n[[rule.threat.technique]]\nid = \"T1560.001\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1559.002\"\n[[rule.threat.technique]]\nid = \"T1560.001\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1559.002\"\n[[rule.threat.technique]]\nid = \"T1560.001\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0085-fin4.json b/app/playbooks/threat-groups/apt-g0085-fin4.json
new file mode 100644
index 0000000..21fa4b5
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0085-fin4.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0085",
+ "num": 119,
+ "name": "MITRE ATT&CK Group — FIN4",
+ "fullName": "FIN4 (G0085) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[FIN4](https://attack.mitre.org/groups/G0085) is a financially-motivated threat group that has targeted confidential information related to the public financial market, particularly regarding healthcare and pharmaceutical companies, since at least 2013. [FIN4](https://attack.mitre.org/groups/G0085) is unique in that they do not infect victims with typical persistent malware, but rather they focus on capturing credentials authorized to access email and other non-public correspondence. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with FIN4.",
+ "mitre": "T1078, T1566.001, T1566.002, T1059.005, T1204.001, T1204.002, T1056.001, T1056.002, T1114.002, T1071.001, T1090.003, T1564.008",
+ "aliases": [
+ "FIN4"
+ ],
+ "mitreGroupId": "G0085",
+ "mitreUrl": "https://attack.mitre.org/groups/G0085",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile FIN4 with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0085. Aliases: FIN4. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Collection, Command and Control, Stealth. Mapped techniques: T1078 Valid Accounts, T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link, T1059.005 Visual Basic, T1204.001 Malicious Link, T1204.002 Malicious File, T1056.001 Keylogging, T1056.002 GUI Input Capture, T1114.002 Remote Email Collection, T1071.001 Web Protocols, T1090.003 Multi-hop Proxy, T1564.008 Email Hiding Rules. Source: https://attack.mitre.org/groups/G0085. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - FIN4 (G0085) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1566.001 OR T1566.002 OR T1059.005 OR T1204.001 OR T1204.002 OR T1056.001 OR T1056.002 OR T1114.002 OR T1071.001 OR T1090.003 OR T1564.008) OR threat.technique.id:(T1078 OR T1566.001 OR T1566.002 OR T1059.005 OR T1204.001 OR T1204.002 OR T1056.001 OR T1056.002 OR T1114.002 OR T1071.001 OR T1090.003 OR T1564.008) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - FIN4 (G0085) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1566.001 OR T1566.002 OR T1059.005 OR T1204.001 OR T1204.002 OR T1056.001 OR T1056.002 OR T1114.002 OR T1071.001 OR T1090.003 OR T1564.008) OR threat.technique.id:(T1078 OR T1566.001 OR T1566.002 OR T1059.005 OR T1204.001 OR T1204.002 OR T1056.001 OR T1056.002 OR T1114.002 OR T1071.001 OR T1090.003 OR T1564.008) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile FIN4 with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1566.001 OR T1566.002 OR T1059.005 OR T1204.001 OR T1204.002 OR T1056.001 OR T1056.002 OR T1114.002 OR T1071.001 OR T1090.003 OR T1564.008) OR threat.technique.id:(T1078 OR T1566.001 OR T1566.002 OR T1059.005 OR T1204.001 OR T1204.002 OR T1056.001 OR T1056.002 OR T1114.002 OR T1071.001 OR T1090.003 OR T1564.008) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1204.001\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1204.001\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1204.001\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1204.001\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0087-apt39.json b/app/playbooks/threat-groups/apt-g0087-apt39.json
new file mode 100644
index 0000000..74f1718
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0087-apt39.json
@@ -0,0 +1,119 @@
+{
+ "id": "apt-g0087",
+ "num": 120,
+ "name": "MITRE ATT&CK Group — APT39",
+ "fullName": "APT39 (G0087) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[APT39](https://attack.mitre.org/groups/G0087) is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2014. [APT39](https://attack.mitre.org/groups/G0087) has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and across Asia, Africa, Europe, and North America to track individuals and entities considered to be a threat by the MOIS. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with APT39.",
+ "mitre": "T1078, T1190, T1566.001, T1566.002, T1053.005, T1059, T1059.001, T1059.005, T1059.006, T1059.010, T1197, T1204.001, T1204.002, T1569.002, T1136.001, T1505.003, T1546.010, T1547.001, T1547.009, T1003, T1003.001, T1056, T1056.001, T1110",
+ "aliases": [
+ "APT39",
+ "ITG07",
+ "Chafer",
+ "Remix Kitten"
+ ],
+ "mitreGroupId": "G0087",
+ "mitreUrl": "https://attack.mitre.org/groups/G0087",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile APT39 with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0087. Aliases: APT39, ITG07, Chafer, Remix Kitten. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Defense Impairment, Resource Development, Stealth. Mapped techniques: T1078 Valid Accounts, T1190 Exploit Public-Facing Application, T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link, T1053.005 Scheduled Task, T1059 Command and Scripting Interpreter, T1059.001 PowerShell, T1059.005 Visual Basic, T1059.006 Python, T1059.010 AutoHotKey & AutoIT, T1197 BITS Jobs, T1204.001 Malicious Link, plus 41 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0087. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - APT39 (G0087) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1190 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059 OR T1059.001 OR T1059.005 OR T1059.006 OR T1059.010 OR T1197 OR T1204.001 OR T1204.002 OR T1569.002 OR T1136.001 OR T1505.003 OR T1546.010 OR T1547.001 OR T1547.009 OR T1003) OR threat.technique.id:(T1078 OR T1190 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059 OR T1059.001 OR T1059.005 OR T1059.006 OR T1059.010 OR T1197 OR T1204.001 OR T1204.002 OR T1569.002 OR T1136.001 OR T1505.003 OR T1546.010 OR T1547.001 OR T1547.009 OR T1003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - APT39 (G0087) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1190 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059 OR T1059.001 OR T1059.005 OR T1059.006 OR T1059.010 OR T1197 OR T1204.001 OR T1204.002 OR T1569.002 OR T1136.001 OR T1505.003 OR T1546.010 OR T1547.001 OR T1547.009 OR T1003) OR threat.technique.id:(T1078 OR T1190 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059 OR T1059.001 OR T1059.005 OR T1059.006 OR T1059.010 OR T1197 OR T1204.001 OR T1204.002 OR T1569.002 OR T1136.001 OR T1505.003 OR T1546.010 OR T1547.001 OR T1547.009 OR T1003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile APT39 with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1190 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059 OR T1059.001 OR T1059.005 OR T1059.006 OR T1059.010 OR T1197 OR T1204.001 OR T1204.002 OR T1569.002 OR T1136.001 OR T1505.003 OR T1546.010 OR T1547.001 OR T1547.009 OR T1003) OR threat.technique.id:(T1078 OR T1190 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059 OR T1059.001 OR T1059.005 OR T1059.006 OR T1059.010 OR T1197 OR T1204.001 OR T1204.002 OR T1569.002 OR T1136.001 OR T1505.003 OR T1546.010 OR T1547.001 OR T1547.009 OR T1003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0088-temp-veles.json b/app/playbooks/threat-groups/apt-g0088-temp-veles.json
new file mode 100644
index 0000000..c69b30f
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0088-temp-veles.json
@@ -0,0 +1,117 @@
+{
+ "id": "apt-g0088",
+ "num": 121,
+ "name": "MITRE ATT&CK Group — TEMP.Veles",
+ "fullName": "TEMP.Veles (G0088) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[TEMP.Veles](https://attack.mitre.org/groups/G0088) is a Russia-based threat group that has targeted critical infrastructure. The group has been observed utilizing [TRITON](https://attack.mitre.org/software/S0609), a malware framework designed to manipulate industrial safety systems. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with TEMP.Veles.",
+ "mitre": "",
+ "aliases": [
+ "TEMP.Veles",
+ "XENOTIME"
+ ],
+ "mitreGroupId": "G0088",
+ "mitreUrl": "https://attack.mitre.org/groups/G0088",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile TEMP.Veles with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0088. Aliases: TEMP.Veles, XENOTIME. Primary mapped tactics: No explicit tactics mapped. Mapped techniques: No ATT&CK techniques are currently mapped in MITRE CTI for this group.. Source: https://attack.mitre.org/groups/G0088. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - TEMP.Veles (G0088) ATT&CK technique pivots\n(rule.threat.technique.id:(Gxxxx) OR threat.technique.id:(Gxxxx) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - TEMP.Veles (G0088) ATT&CK technique pivots\n(rule.threat.technique.id:(Gxxxx) OR threat.technique.id:(Gxxxx) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile TEMP.Veles with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(Gxxxx) OR threat.technique.id:(Gxxxx) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''"
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''"
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''"
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''"
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0089-the-white-company.json b/app/playbooks/threat-groups/apt-g0089-the-white-company.json
new file mode 100644
index 0000000..37dff50
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0089-the-white-company.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0089",
+ "num": 122,
+ "name": "MITRE ATT&CK Group — The White Company",
+ "fullName": "The White Company (G0089) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[The White Company](https://attack.mitre.org/groups/G0089) is a likely state-sponsored threat actor with advanced capabilities. From 2017 through 2018, the group led an espionage campaign called Operation Shaheen targeting government and military organizations in Pakistan. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with The White Company.",
+ "mitre": "T1566.001, T1203, T1204.002, T1124, T1518.001, T1027.002, T1070.004",
+ "aliases": [
+ "The White Company"
+ ],
+ "mitreGroupId": "G0089",
+ "mitreUrl": "https://attack.mitre.org/groups/G0089",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile The White Company with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0089. Aliases: The White Company. Primary mapped tactics: Initial Access, Execution, Discovery, Stealth. Mapped techniques: T1566.001 Spearphishing Attachment, T1203 Exploitation for Client Execution, T1204.002 Malicious File, T1124 System Time Discovery, T1518.001 Security Software Discovery, T1027.002 Software Packing, T1070.004 File Deletion. Source: https://attack.mitre.org/groups/G0089. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - The White Company (G0089) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1203 OR T1204.002 OR T1124 OR T1518.001 OR T1027.002 OR T1070.004) OR threat.technique.id:(T1566.001 OR T1203 OR T1204.002 OR T1124 OR T1518.001 OR T1027.002 OR T1070.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - The White Company (G0089) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1203 OR T1204.002 OR T1124 OR T1518.001 OR T1027.002 OR T1070.004) OR threat.technique.id:(T1566.001 OR T1203 OR T1204.002 OR T1124 OR T1518.001 OR T1027.002 OR T1070.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile The White Company with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1566.001 OR T1203 OR T1204.002 OR T1124 OR T1518.001 OR T1027.002 OR T1070.004) OR threat.technique.id:(T1566.001 OR T1203 OR T1204.002 OR T1124 OR T1518.001 OR T1027.002 OR T1070.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1124\"\n[[rule.threat.technique]]\nid = \"T1518.001\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1124\"\n[[rule.threat.technique]]\nid = \"T1518.001\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1124\"\n[[rule.threat.technique]]\nid = \"T1518.001\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1124\"\n[[rule.threat.technique]]\nid = \"T1518.001\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0090-wirte.json b/app/playbooks/threat-groups/apt-g0090-wirte.json
new file mode 100644
index 0000000..bef3dc4
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0090-wirte.json
@@ -0,0 +1,117 @@
+{
+ "id": "apt-g0090",
+ "num": 123,
+ "name": "MITRE ATT&CK Group — WIRTE",
+ "fullName": "WIRTE (G0090) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[WIRTE](https://attack.mitre.org/groups/G0090) is a cyberespionage actor, believed to be a subgroup of the Hamas-affiliated Gaza Cybergang, that has been active since at least August 2018. [WIRTE](https://attack.mitre.org/groups/G0090) has targeted diplomatic, financial, military, legal, and technology organizations across the Middle East, North Africa, and in Europe to gather intelligence. [WIRTE](https://attack.mitre.org/groups/G0090) has remained persistently active despite the ongoing Israel-Hamas conflict and has expanded their operations to include wiper malware attacks against Israeli targets. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with WIRTE.",
+ "mitre": "T1566.001, T1566.002, T1059.001, T1059.003, T1059.005, T1106, T1204.001, T1204.002, T1574.001, T1497.001, T1074.001, T1114.001, T1071.001, T1105, T1571, T1041, T1583.001, T1586.002, T1588.002, T1608.001, T1027.010, T1027.015, T1036.005, T1140",
+ "aliases": [
+ "WIRTE",
+ "Ashen Lepus"
+ ],
+ "mitreGroupId": "G0090",
+ "mitreUrl": "https://attack.mitre.org/groups/G0090",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile WIRTE with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0090. Aliases: WIRTE, Ashen Lepus. Primary mapped tactics: Initial Access, Execution, Discovery, Collection, Command and Control, Exfiltration, Resource Development, Stealth. Mapped techniques: T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1059.005 Visual Basic, T1106 Native API, T1204.001 Malicious Link, T1204.002 Malicious File, T1574.001 DLL, T1497.001 System Checks, T1074.001 Local Data Staging, T1114.001 Local Email Collection, plus 14 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0090. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - WIRTE (G0090) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1566.002 OR T1059.001 OR T1059.003 OR T1059.005 OR T1106 OR T1204.001 OR T1204.002 OR T1574.001 OR T1497.001 OR T1074.001 OR T1114.001 OR T1071.001 OR T1105 OR T1571 OR T1041 OR T1583.001 OR T1586.002 OR T1588.002 OR T1608.001) OR threat.technique.id:(T1566.001 OR T1566.002 OR T1059.001 OR T1059.003 OR T1059.005 OR T1106 OR T1204.001 OR T1204.002 OR T1574.001 OR T1497.001 OR T1074.001 OR T1114.001 OR T1071.001 OR T1105 OR T1571 OR T1041 OR T1583.001 OR T1586.002 OR T1588.002 OR T1608.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - WIRTE (G0090) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1566.002 OR T1059.001 OR T1059.003 OR T1059.005 OR T1106 OR T1204.001 OR T1204.002 OR T1574.001 OR T1497.001 OR T1074.001 OR T1114.001 OR T1071.001 OR T1105 OR T1571 OR T1041 OR T1583.001 OR T1586.002 OR T1588.002 OR T1608.001) OR threat.technique.id:(T1566.001 OR T1566.002 OR T1059.001 OR T1059.003 OR T1059.005 OR T1106 OR T1204.001 OR T1204.002 OR T1574.001 OR T1497.001 OR T1074.001 OR T1114.001 OR T1071.001 OR T1105 OR T1571 OR T1041 OR T1583.001 OR T1586.002 OR T1588.002 OR T1608.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile WIRTE with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1566.001 OR T1566.002 OR T1059.001 OR T1059.003 OR T1059.005 OR T1106 OR T1204.001 OR T1204.002 OR T1574.001 OR T1497.001 OR T1074.001 OR T1114.001 OR T1071.001 OR T1105 OR T1571 OR T1041 OR T1583.001 OR T1586.002 OR T1588.002 OR T1608.001) OR threat.technique.id:(T1566.001 OR T1566.002 OR T1059.001 OR T1059.003 OR T1059.005 OR T1106 OR T1204.001 OR T1204.002 OR T1574.001 OR T1497.001 OR T1074.001 OR T1114.001 OR T1071.001 OR T1105 OR T1571 OR T1041 OR T1583.001 OR T1586.002 OR T1588.002 OR T1608.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.005\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.005\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.005\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.005\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0091-silence.json b/app/playbooks/threat-groups/apt-g0091-silence.json
new file mode 100644
index 0000000..0d1cc58
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0091-silence.json
@@ -0,0 +1,117 @@
+{
+ "id": "apt-g0091",
+ "num": 124,
+ "name": "MITRE ATT&CK Group — Silence",
+ "fullName": "Silence (G0091) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Silence](https://attack.mitre.org/groups/G0091) is a financially motivated threat actor targeting financial institutions in different countries. The group was first seen in June 2016. Their main targets reside in Russia, Ukraine, Belarus, Azerbaijan, Poland and Kazakhstan. They compromised various banking systems, including the Russian Central Bank's Automated Workstation Client, ATMs, and card processing. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Silence.",
+ "mitre": "T1078, T1566.001, T1053.005, T1059.001, T1059.003, T1059.005, T1059.007, T1072, T1106, T1204.002, T1569.002, T1112, T1547.001, T1055, T1003.001, T1018, T1021.001, T1113, T1125, T1090.002, T1105, T1571, T1553.002, T1588.002",
+ "aliases": [
+ "Silence",
+ "Whisper Spider"
+ ],
+ "mitreGroupId": "G0091",
+ "mitreUrl": "https://attack.mitre.org/groups/G0091",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Silence with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0091. Aliases: Silence, Whisper Spider. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Defense Impairment, Resource Development, Stealth. Mapped techniques: T1078 Valid Accounts, T1566.001 Spearphishing Attachment, T1053.005 Scheduled Task, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1059.005 Visual Basic, T1059.007 JavaScript, T1072 Software Deployment Tools, T1106 Native API, T1204.002 Malicious File, T1569.002 Service Execution, T1112 Modify Registry, plus 16 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0091. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Silence (G0091) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1566.001 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1072 OR T1106 OR T1204.002 OR T1569.002 OR T1112 OR T1547.001 OR T1055 OR T1003.001 OR T1018 OR T1021.001 OR T1113 OR T1125 OR T1090.002) OR threat.technique.id:(T1078 OR T1566.001 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1072 OR T1106 OR T1204.002 OR T1569.002 OR T1112 OR T1547.001 OR T1055 OR T1003.001 OR T1018 OR T1021.001 OR T1113 OR T1125 OR T1090.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Silence (G0091) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1566.001 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1072 OR T1106 OR T1204.002 OR T1569.002 OR T1112 OR T1547.001 OR T1055 OR T1003.001 OR T1018 OR T1021.001 OR T1113 OR T1125 OR T1090.002) OR threat.technique.id:(T1078 OR T1566.001 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1072 OR T1106 OR T1204.002 OR T1569.002 OR T1112 OR T1547.001 OR T1055 OR T1003.001 OR T1018 OR T1021.001 OR T1113 OR T1125 OR T1090.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Silence with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1566.001 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1072 OR T1106 OR T1204.002 OR T1569.002 OR T1112 OR T1547.001 OR T1055 OR T1003.001 OR T1018 OR T1021.001 OR T1113 OR T1125 OR T1090.002) OR threat.technique.id:(T1078 OR T1566.001 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1072 OR T1106 OR T1204.002 OR T1569.002 OR T1112 OR T1547.001 OR T1055 OR T1003.001 OR T1018 OR T1021.001 OR T1113 OR T1125 OR T1090.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0092-ta505.json b/app/playbooks/threat-groups/apt-g0092-ta505.json
new file mode 100644
index 0000000..b8d63ed
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0092-ta505.json
@@ -0,0 +1,119 @@
+{
+ "id": "apt-g0092",
+ "num": 125,
+ "name": "MITRE ATT&CK Group — TA505",
+ "fullName": "TA505 (G0092) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[TA505](https://attack.mitre.org/groups/G0092) is a cyber criminal group that has been active since at least 2014. [TA505](https://attack.mitre.org/groups/G0092) is known for frequently changing malware, driving global trends in criminal malware distribution, and ransomware campaigns involving [Clop](https://attack.mitre.org/software/S0611). This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with TA505.",
+ "mitre": "T1078.002, T1566.001, T1566.002, T1059.001, T1059.003, T1059.005, T1059.007, T1106, T1204.001, T1204.002, T1559.002, T1112, T1055.001, T1552.001, T1555.003, T1069, T1087.003, T1071.001, T1105, T1568.001, T1486, T1553.002, T1553.005, T1685",
+ "aliases": [
+ "TA505",
+ "Hive0065",
+ "Spandex Tempest",
+ "CHIMBORAZO"
+ ],
+ "mitreGroupId": "G0092",
+ "mitreUrl": "https://attack.mitre.org/groups/G0092",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile TA505 with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0092. Aliases: TA505, Hive0065, Spandex Tempest, CHIMBORAZO. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Command and Control, Impact, Defense Impairment, Resource Development, Stealth. Mapped techniques: T1078.002 Domain Accounts, T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1059.005 Visual Basic, T1059.007 JavaScript, T1106 Native API, T1204.001 Malicious Link, T1204.002 Malicious File, T1559.002 Dynamic Data Exchange, T1112 Modify Registry, plus 22 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0092. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - TA505 (G0092) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078.002 OR T1566.001 OR T1566.002 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1106 OR T1204.001 OR T1204.002 OR T1559.002 OR T1112 OR T1055.001 OR T1552.001 OR T1555.003 OR T1069 OR T1087.003 OR T1071.001 OR T1105 OR T1568.001) OR threat.technique.id:(T1078.002 OR T1566.001 OR T1566.002 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1106 OR T1204.001 OR T1204.002 OR T1559.002 OR T1112 OR T1055.001 OR T1552.001 OR T1555.003 OR T1069 OR T1087.003 OR T1071.001 OR T1105 OR T1568.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - TA505 (G0092) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078.002 OR T1566.001 OR T1566.002 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1106 OR T1204.001 OR T1204.002 OR T1559.002 OR T1112 OR T1055.001 OR T1552.001 OR T1555.003 OR T1069 OR T1087.003 OR T1071.001 OR T1105 OR T1568.001) OR threat.technique.id:(T1078.002 OR T1566.001 OR T1566.002 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1106 OR T1204.001 OR T1204.002 OR T1559.002 OR T1112 OR T1055.001 OR T1552.001 OR T1555.003 OR T1069 OR T1087.003 OR T1071.001 OR T1105 OR T1568.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile TA505 with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078.002 OR T1566.001 OR T1566.002 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1106 OR T1204.001 OR T1204.002 OR T1559.002 OR T1112 OR T1055.001 OR T1552.001 OR T1555.003 OR T1069 OR T1087.003 OR T1071.001 OR T1105 OR T1568.001) OR threat.technique.id:(T1078.002 OR T1566.001 OR T1566.002 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1106 OR T1204.001 OR T1204.002 OR T1559.002 OR T1112 OR T1055.001 OR T1552.001 OR T1555.003 OR T1069 OR T1087.003 OR T1071.001 OR T1105 OR T1568.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0093-gallium.json b/app/playbooks/threat-groups/apt-g0093-gallium.json
new file mode 100644
index 0000000..4a641b8
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0093-gallium.json
@@ -0,0 +1,117 @@
+{
+ "id": "apt-g0093",
+ "num": 126,
+ "name": "MITRE ATT&CK Group — GALLIUM",
+ "fullName": "GALLIUM (G0093) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[GALLIUM](https://attack.mitre.org/groups/G0093) is a cyberespionage group that has been active since at least 2012, primarily targeting telecommunications companies, financial institutions, and government entities in Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia, and Vietnam. This group is particularly known for launching Operation Soft Cell, a long-term campaign targeting telecommunications providers. Security researchers have identified [GALLIUM](https://attack.mitre.org/groups/G0093) as a likely Chinese state-sponsored group, based in part on tools used and TTPs commonly associated with Chinese threat actors. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with GALLIUM.",
+ "mitre": "T1078, T1133, T1190, T1047, T1053.005, T1059.001, T1059.003, T1574.001, T1136.002, T1505.003, T1003.001, T1003.002, T1016, T1018, T1033, T1049, T1550.002, T1570, T1005, T1074.001, T1560.001, T1090.002, T1105, T1041",
+ "aliases": [
+ "GALLIUM",
+ "Granite Typhoon"
+ ],
+ "mitreGroupId": "G0093",
+ "mitreUrl": "https://attack.mitre.org/groups/G0093",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile GALLIUM with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0093. Aliases: GALLIUM, Granite Typhoon. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Defense Impairment, Resource Development, Stealth. Mapped techniques: T1078 Valid Accounts, T1133 External Remote Services, T1190 Exploit Public-Facing Application, T1047 Windows Management Instrumentation, T1053.005 Scheduled Task, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1574.001 DLL, T1136.002 Domain Account, T1505.003 Web Shell, T1003.001 LSASS Memory, T1003.002 Security Account Manager, plus 19 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0093. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - GALLIUM (G0093) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1133 OR T1190 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1574.001 OR T1136.002 OR T1505.003 OR T1003.001 OR T1003.002 OR T1016 OR T1018 OR T1033 OR T1049 OR T1550.002 OR T1570 OR T1005 OR T1074.001) OR threat.technique.id:(T1078 OR T1133 OR T1190 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1574.001 OR T1136.002 OR T1505.003 OR T1003.001 OR T1003.002 OR T1016 OR T1018 OR T1033 OR T1049 OR T1550.002 OR T1570 OR T1005 OR T1074.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - GALLIUM (G0093) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1133 OR T1190 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1574.001 OR T1136.002 OR T1505.003 OR T1003.001 OR T1003.002 OR T1016 OR T1018 OR T1033 OR T1049 OR T1550.002 OR T1570 OR T1005 OR T1074.001) OR threat.technique.id:(T1078 OR T1133 OR T1190 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1574.001 OR T1136.002 OR T1505.003 OR T1003.001 OR T1003.002 OR T1016 OR T1018 OR T1033 OR T1049 OR T1550.002 OR T1570 OR T1005 OR T1074.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile GALLIUM with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1133 OR T1190 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1574.001 OR T1136.002 OR T1505.003 OR T1003.001 OR T1003.002 OR T1016 OR T1018 OR T1033 OR T1049 OR T1550.002 OR T1570 OR T1005 OR T1074.001) OR threat.technique.id:(T1078 OR T1133 OR T1190 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1574.001 OR T1136.002 OR T1505.003 OR T1003.001 OR T1003.002 OR T1016 OR T1018 OR T1033 OR T1049 OR T1550.002 OR T1570 OR T1005 OR T1074.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0094-kimsuky.json b/app/playbooks/threat-groups/apt-g0094-kimsuky.json
new file mode 100644
index 0000000..1522955
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0094-kimsuky.json
@@ -0,0 +1,125 @@
+{
+ "id": "apt-g0094",
+ "num": 127,
+ "name": "MITRE ATT&CK Group — Kimsuky",
+ "fullName": "Kimsuky (G0094) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Kimsuky](https://attack.mitre.org/groups/G0094) is a Democratic People's Republic of Korea (DPRK)-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think tanks, and subject-matter experts in various fields. Its operations expanded to include the United Nations and organizations in the government, education, business services, and manufacturing sectors across the United States, Japan, Russia, and Europe. [Kimsuky](https://attack.mitre.org/groups/G0094) has focused collection on foreign policy and national security issues tied to the Korean Peninsula, nuclear policy, and sanctions. [Kimsuky](https://attack.mitre.org/groups/G0094) operations have overlapped with those of other North Korean state-sponsored cyber espionage actors as a result of ad hoc collaborations or other limited resource sharing. [Kimsuky](https://attack.mitre.org/groups/G0094) was assessed to be responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise; other notable campaigns include Operation STOLEN PENCIL (2018), Operation Kabar Cobra (2019), and Operation Smoke Screen (2019). In 2023, [Kimsuky](https://attack.mitre.org/groups/G0094) was observed using commercial large language models (LLMs) to assist with vulnerability research, scripting, social engineering and reconnaissance. DPRK threat actor cluster boundaries overlap in open source reporting, with some security researchers consolidating all attributed North Korean state-sponsored cyber activity under [Lazarus Group](https://attack.mitre.org/groups/G0032), rather than tracking operationally distinct subgroups. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Kimsuky.",
+ "mitre": "T1078.003, T1133, T1190, T1566, T1566.001, T1566.002, T1053.005, T1059.001, T1059.003, T1059.005, T1059.006, T1059.007, T1106, T1204.001, T1204.002, T1204.004, T1559.001, T1098.007, T1112, T1136.001, T1176.001, T1205, T1505.003, T1543.003",
+ "aliases": [
+ "Kimsuky",
+ "Black Banshee",
+ "Velvet Chollima",
+ "Emerald Sleet",
+ "THALLIUM",
+ "APT43",
+ "TA427",
+ "Springtail",
+ "Earth Kumiho",
+ "PatheticSlug"
+ ],
+ "mitreGroupId": "G0094",
+ "mitreUrl": "https://attack.mitre.org/groups/G0094",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Kimsuky with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0094. Aliases: Kimsuky, Black Banshee, Velvet Chollima, Emerald Sleet, THALLIUM, APT43, TA427, Springtail, Earth Kumiho, PatheticSlug. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact, Defense Impairment, Reconnaissance, Resource Development, Stealth. Mapped techniques: T1078.003 Local Accounts, T1133 External Remote Services, T1190 Exploit Public-Facing Application, T1566 Phishing, T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link, T1053.005 Scheduled Task, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1059.005 Visual Basic, T1059.006 Python, T1059.007 JavaScript, plus 118 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0094. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Kimsuky (G0094) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078.003 OR T1133 OR T1190 OR T1566 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.006 OR T1059.007 OR T1106 OR T1204.001 OR T1204.002 OR T1204.004 OR T1559.001 OR T1098.007 OR T1112 OR T1136.001) OR threat.technique.id:(T1078.003 OR T1133 OR T1190 OR T1566 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.006 OR T1059.007 OR T1106 OR T1204.001 OR T1204.002 OR T1204.004 OR T1559.001 OR T1098.007 OR T1112 OR T1136.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Kimsuky (G0094) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078.003 OR T1133 OR T1190 OR T1566 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.006 OR T1059.007 OR T1106 OR T1204.001 OR T1204.002 OR T1204.004 OR T1559.001 OR T1098.007 OR T1112 OR T1136.001) OR threat.technique.id:(T1078.003 OR T1133 OR T1190 OR T1566 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.006 OR T1059.007 OR T1106 OR T1204.001 OR T1204.002 OR T1204.004 OR T1559.001 OR T1098.007 OR T1112 OR T1136.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Kimsuky with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078.003 OR T1133 OR T1190 OR T1566 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.006 OR T1059.007 OR T1106 OR T1204.001 OR T1204.002 OR T1204.004 OR T1559.001 OR T1098.007 OR T1112 OR T1136.001) OR threat.technique.id:(T1078.003 OR T1133 OR T1190 OR T1566 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.006 OR T1059.007 OR T1106 OR T1204.001 OR T1204.002 OR T1204.004 OR T1559.001 OR T1098.007 OR T1112 OR T1136.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566\"\n[[rule.threat.technique]]\nid = \"T1566.001\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566\"\n[[rule.threat.technique]]\nid = \"T1566.001\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566\"\n[[rule.threat.technique]]\nid = \"T1566.001\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566\"\n[[rule.threat.technique]]\nid = \"T1566.001\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0095-machete.json b/app/playbooks/threat-groups/apt-g0095-machete.json
new file mode 100644
index 0000000..497d3fd
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0095-machete.json
@@ -0,0 +1,118 @@
+{
+ "id": "apt-g0095",
+ "num": 128,
+ "name": "MITRE ATT&CK Group — Machete",
+ "fullName": "Machete (G0095) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Machete](https://attack.mitre.org/groups/G0095) is a suspected Spanish-speaking cyber espionage group that has been active since at least 2010. It has primarily focused its operations within Latin America, with a particular emphasis on Venezuela, but also in the US, Europe, Russia, and parts of Asia. [Machete](https://attack.mitre.org/groups/G0095) generally targets high-profile organizations such as government institutions, intelligence services, and military units, as well as telecommunications and power companies. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Machete.",
+ "mitre": "T1189, T1566.001, T1566.002, T1053.005, T1059.003, T1059.005, T1059.006, T1204.001, T1204.002, T1036.005, T1218.007",
+ "aliases": [
+ "Machete",
+ "APT-C-43",
+ "El Machete"
+ ],
+ "mitreGroupId": "G0095",
+ "mitreUrl": "https://attack.mitre.org/groups/G0095",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Machete with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0095. Aliases: Machete, APT-C-43, El Machete. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Stealth. Mapped techniques: T1189 Drive-by Compromise, T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link, T1053.005 Scheduled Task, T1059.003 Windows Command Shell, T1059.005 Visual Basic, T1059.006 Python, T1204.001 Malicious Link, T1204.002 Malicious File, T1036.005 Match Legitimate Resource Name or Location, T1218.007 Msiexec. Source: https://attack.mitre.org/groups/G0095. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Machete (G0095) ATT&CK technique pivots\n(rule.threat.technique.id:(T1189 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059.003 OR T1059.005 OR T1059.006 OR T1204.001 OR T1204.002 OR T1036.005 OR T1218.007) OR threat.technique.id:(T1189 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059.003 OR T1059.005 OR T1059.006 OR T1204.001 OR T1204.002 OR T1036.005 OR T1218.007) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Machete (G0095) ATT&CK technique pivots\n(rule.threat.technique.id:(T1189 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059.003 OR T1059.005 OR T1059.006 OR T1204.001 OR T1204.002 OR T1036.005 OR T1218.007) OR threat.technique.id:(T1189 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059.003 OR T1059.005 OR T1059.006 OR T1204.001 OR T1204.002 OR T1036.005 OR T1218.007) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Machete with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1189 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059.003 OR T1059.005 OR T1059.006 OR T1204.001 OR T1204.002 OR T1036.005 OR T1218.007) OR threat.technique.id:(T1189 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059.003 OR T1059.005 OR T1059.006 OR T1204.001 OR T1204.002 OR T1036.005 OR T1218.007) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0096-apt41.json b/app/playbooks/threat-groups/apt-g0096-apt41.json
new file mode 100644
index 0000000..bf6302e
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0096-apt41.json
@@ -0,0 +1,119 @@
+{
+ "id": "apt-g0096",
+ "num": 129,
+ "name": "MITRE ATT&CK Group — APT41",
+ "fullName": "APT41 (G0096) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[APT41](https://attack.mitre.org/groups/G0096) is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, [APT41](https://attack.mitre.org/groups/G0096) has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries. Notable behaviors include using a wide range of malware and tools to complete mission objectives. [APT41](https://attack.mitre.org/groups/G0096) overlaps at least partially with public reporting on groups including BARIUM and [Winnti Group](https://attack.mitre.org/groups/G0044). This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with APT41.",
+ "mitre": "T1078, T1133, T1190, T1195.002, T1566.001, T1047, T1053.005, T1059.001, T1059.003, T1059.004, T1197, T1203, T1569.002, T1574.001, T1574.006, T1037, T1098.007, T1112, T1136.001, T1542.003, T1543.003, T1546.008, T1547.001, T1055",
+ "aliases": [
+ "APT41",
+ "Wicked Panda",
+ "Brass Typhoon",
+ "BARIUM"
+ ],
+ "mitreGroupId": "G0096",
+ "mitreUrl": "https://attack.mitre.org/groups/G0096",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile APT41 with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0096. Aliases: APT41, Wicked Panda, Brass Typhoon, BARIUM. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact, Defense Impairment, Reconnaissance, Resource Development, Stealth. Mapped techniques: T1078 Valid Accounts, T1133 External Remote Services, T1190 Exploit Public-Facing Application, T1195.002 Compromise Software Supply Chain, T1566.001 Spearphishing Attachment, T1047 Windows Management Instrumentation, T1053.005 Scheduled Task, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1059.004 Unix Shell, T1197 BITS Jobs, T1203 Exploitation for Client Execution, plus 70 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0096. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - APT41 (G0096) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1133 OR T1190 OR T1195.002 OR T1566.001 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.004 OR T1197 OR T1203 OR T1569.002 OR T1574.001 OR T1574.006 OR T1037 OR T1098.007 OR T1112 OR T1136.001 OR T1542.003) OR threat.technique.id:(T1078 OR T1133 OR T1190 OR T1195.002 OR T1566.001 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.004 OR T1197 OR T1203 OR T1569.002 OR T1574.001 OR T1574.006 OR T1037 OR T1098.007 OR T1112 OR T1136.001 OR T1542.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - APT41 (G0096) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1133 OR T1190 OR T1195.002 OR T1566.001 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.004 OR T1197 OR T1203 OR T1569.002 OR T1574.001 OR T1574.006 OR T1037 OR T1098.007 OR T1112 OR T1136.001 OR T1542.003) OR threat.technique.id:(T1078 OR T1133 OR T1190 OR T1195.002 OR T1566.001 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.004 OR T1197 OR T1203 OR T1569.002 OR T1574.001 OR T1574.006 OR T1037 OR T1098.007 OR T1112 OR T1136.001 OR T1542.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile APT41 with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1133 OR T1190 OR T1195.002 OR T1566.001 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.004 OR T1197 OR T1203 OR T1569.002 OR T1574.001 OR T1574.006 OR T1037 OR T1098.007 OR T1112 OR T1136.001 OR T1542.003) OR threat.technique.id:(T1078 OR T1133 OR T1190 OR T1195.002 OR T1566.001 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.004 OR T1197 OR T1203 OR T1569.002 OR T1574.001 OR T1574.006 OR T1037 OR T1098.007 OR T1112 OR T1136.001 OR T1542.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1195.002\"\n[[rule.threat.technique]]\nid = \"T1566.001\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1195.002\"\n[[rule.threat.technique]]\nid = \"T1566.001\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1195.002\"\n[[rule.threat.technique]]\nid = \"T1566.001\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1195.002\"\n[[rule.threat.technique]]\nid = \"T1566.001\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0098-blacktech.json b/app/playbooks/threat-groups/apt-g0098-blacktech.json
new file mode 100644
index 0000000..ddb0558
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0098-blacktech.json
@@ -0,0 +1,117 @@
+{
+ "id": "apt-g0098",
+ "num": 130,
+ "name": "MITRE ATT&CK Group — BlackTech",
+ "fullName": "BlackTech (G0098) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[BlackTech](https://attack.mitre.org/groups/G0098) is a suspected Chinese cyber espionage group that has primarily targeted organizations in East Asia--particularly Taiwan, Japan, and Hong Kong--and the US since at least 2013. [BlackTech](https://attack.mitre.org/groups/G0098) has used a combination of custom malware, dual-use tools, and living off the land tactics to compromise media, construction, engineering, electronics, and financial company networks. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with BlackTech.",
+ "mitre": "T1190, T1566.001, T1566.002, T1106, T1203, T1204.001, T1204.002, T1574.001, T1046, T1021.004, T1588.002, T1588.003, T1588.004, T1036.002",
+ "aliases": [
+ "BlackTech",
+ "Palmerworm"
+ ],
+ "mitreGroupId": "G0098",
+ "mitreUrl": "https://attack.mitre.org/groups/G0098",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile BlackTech with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0098. Aliases: BlackTech, Palmerworm. Primary mapped tactics: Initial Access, Execution, Discovery, Lateral Movement, Resource Development, Stealth. Mapped techniques: T1190 Exploit Public-Facing Application, T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link, T1106 Native API, T1203 Exploitation for Client Execution, T1204.001 Malicious Link, T1204.002 Malicious File, T1574.001 DLL, T1046 Network Service Discovery, T1021.004 SSH, T1588.002 Tool, T1588.003 Code Signing Certificates, plus 2 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0098. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - BlackTech (G0098) ATT&CK technique pivots\n(rule.threat.technique.id:(T1190 OR T1566.001 OR T1566.002 OR T1106 OR T1203 OR T1204.001 OR T1204.002 OR T1574.001 OR T1046 OR T1021.004 OR T1588.002 OR T1588.003 OR T1588.004 OR T1036.002) OR threat.technique.id:(T1190 OR T1566.001 OR T1566.002 OR T1106 OR T1203 OR T1204.001 OR T1204.002 OR T1574.001 OR T1046 OR T1021.004 OR T1588.002 OR T1588.003 OR T1588.004 OR T1036.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - BlackTech (G0098) ATT&CK technique pivots\n(rule.threat.technique.id:(T1190 OR T1566.001 OR T1566.002 OR T1106 OR T1203 OR T1204.001 OR T1204.002 OR T1574.001 OR T1046 OR T1021.004 OR T1588.002 OR T1588.003 OR T1588.004 OR T1036.002) OR threat.technique.id:(T1190 OR T1566.001 OR T1566.002 OR T1106 OR T1203 OR T1204.001 OR T1204.002 OR T1574.001 OR T1046 OR T1021.004 OR T1588.002 OR T1588.003 OR T1588.004 OR T1036.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile BlackTech with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1190 OR T1566.001 OR T1566.002 OR T1106 OR T1203 OR T1204.001 OR T1204.002 OR T1574.001 OR T1046 OR T1021.004 OR T1588.002 OR T1588.003 OR T1588.004 OR T1036.002) OR threat.technique.id:(T1190 OR T1566.001 OR T1566.002 OR T1106 OR T1203 OR T1204.001 OR T1204.002 OR T1574.001 OR T1046 OR T1021.004 OR T1588.002 OR T1588.003 OR T1588.004 OR T1036.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1106\"\n[[rule.threat.technique]]\nid = \"T1203\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1106\"\n[[rule.threat.technique]]\nid = \"T1203\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1106\"\n[[rule.threat.technique]]\nid = \"T1203\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1106\"\n[[rule.threat.technique]]\nid = \"T1203\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0099-apt-c-36.json b/app/playbooks/threat-groups/apt-g0099-apt-c-36.json
new file mode 100644
index 0000000..f52ee4a
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0099-apt-c-36.json
@@ -0,0 +1,120 @@
+{
+ "id": "apt-g0099",
+ "num": 131,
+ "name": "MITRE ATT&CK Group — APT-C-36",
+ "fullName": "APT-C-36 (G0099) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[APT-C-36](https://attack.mitre.org/groups/G0099) is a suspected South American threat group that has engaged in espionage and financially motivated operations since at least 2018. [APT-C-36](https://attack.mitre.org/groups/G0099) has targeted government institutions and entities in the financial, energy, and professional manufacturing sectors across Colombia and other Latin American countries. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with APT-C-36.",
+ "mitre": "T1133, T1566.001, T1566.002, T1047, T1053.005, T1059.001, T1059.005, T1059.007, T1204.001, T1204.002, T1574.001, T1055.012, T1534, T1105, T1568, T1571, T1593, T1583.001, T1583.003, T1583.006, T1584.005, T1586.002, T1586.003, T1587.001",
+ "aliases": [
+ "APT-C-36",
+ "Blind Eagle",
+ "TAG-144",
+ "AguilaCiega",
+ "APT-Q-98"
+ ],
+ "mitreGroupId": "G0099",
+ "mitreUrl": "https://attack.mitre.org/groups/G0099",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile APT-C-36 with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0099. Aliases: APT-C-36, Blind Eagle, TAG-144, AguilaCiega, APT-Q-98. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Lateral Movement, Command and Control, Reconnaissance, Resource Development, Stealth. Mapped techniques: T1133 External Remote Services, T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link, T1047 Windows Management Instrumentation, T1053.005 Scheduled Task, T1059.001 PowerShell, T1059.005 Visual Basic, T1059.007 JavaScript, T1204.001 Malicious Link, T1204.002 Malicious File, T1574.001 DLL, T1055.012 Process Hollowing, plus 26 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0099. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - APT-C-36 (G0099) ATT&CK technique pivots\n(rule.threat.technique.id:(T1133 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.005 OR T1059.007 OR T1204.001 OR T1204.002 OR T1574.001 OR T1055.012 OR T1534 OR T1105 OR T1568 OR T1571 OR T1593 OR T1583.001 OR T1583.003 OR T1583.006) OR threat.technique.id:(T1133 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.005 OR T1059.007 OR T1204.001 OR T1204.002 OR T1574.001 OR T1055.012 OR T1534 OR T1105 OR T1568 OR T1571 OR T1593 OR T1583.001 OR T1583.003 OR T1583.006) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - APT-C-36 (G0099) ATT&CK technique pivots\n(rule.threat.technique.id:(T1133 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.005 OR T1059.007 OR T1204.001 OR T1204.002 OR T1574.001 OR T1055.012 OR T1534 OR T1105 OR T1568 OR T1571 OR T1593 OR T1583.001 OR T1583.003 OR T1583.006) OR threat.technique.id:(T1133 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.005 OR T1059.007 OR T1204.001 OR T1204.002 OR T1574.001 OR T1055.012 OR T1534 OR T1105 OR T1568 OR T1571 OR T1593 OR T1583.001 OR T1583.003 OR T1583.006) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile APT-C-36 with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1133 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.005 OR T1059.007 OR T1204.001 OR T1204.002 OR T1574.001 OR T1055.012 OR T1534 OR T1105 OR T1568 OR T1571 OR T1593 OR T1583.001 OR T1583.003 OR T1583.006) OR threat.technique.id:(T1133 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.005 OR T1059.007 OR T1204.001 OR T1204.002 OR T1574.001 OR T1055.012 OR T1534 OR T1105 OR T1568 OR T1571 OR T1593 OR T1583.001 OR T1583.003 OR T1583.006) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0100-inception.json b/app/playbooks/threat-groups/apt-g0100-inception.json
new file mode 100644
index 0000000..3585f63
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0100-inception.json
@@ -0,0 +1,118 @@
+{
+ "id": "apt-g0100",
+ "num": 132,
+ "name": "MITRE ATT&CK Group — Inception",
+ "fullName": "Inception (G0100) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Inception](https://attack.mitre.org/groups/G0100) is a cyber espionage group active since at least 2014. The group has targeted multiple industries and governmental entities primarily in Russia, but has also been active in the United States and throughout Europe, Asia, Africa, and the Middle East. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Inception.",
+ "mitre": "T1566.001, T1059.001, T1059.005, T1203, T1204.002, T1547.001, T1555.003, T1057, T1069.002, T1082, T1083, T1518, T1005, T1071.001, T1090.003, T1102, T1573.001, T1588.002, T1027.013, T1218.005, T1218.010, T1221",
+ "aliases": [
+ "Inception",
+ "Inception Framework",
+ "Cloud Atlas"
+ ],
+ "mitreGroupId": "G0100",
+ "mitreUrl": "https://attack.mitre.org/groups/G0100",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Inception with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0100. Aliases: Inception, Inception Framework, Cloud Atlas. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Collection, Command and Control, Resource Development, Stealth. Mapped techniques: T1566.001 Spearphishing Attachment, T1059.001 PowerShell, T1059.005 Visual Basic, T1203 Exploitation for Client Execution, T1204.002 Malicious File, T1547.001 Registry Run Keys / Startup Folder, T1555.003 Credentials from Web Browsers, T1057 Process Discovery, T1069.002 Domain Groups, T1082 System Information Discovery, T1083 File and Directory Discovery, T1518 Software Discovery, plus 10 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0100. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Inception (G0100) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1059.001 OR T1059.005 OR T1203 OR T1204.002 OR T1547.001 OR T1555.003 OR T1057 OR T1069.002 OR T1082 OR T1083 OR T1518 OR T1005 OR T1071.001 OR T1090.003 OR T1102 OR T1573.001 OR T1588.002 OR T1027.013 OR T1218.005) OR threat.technique.id:(T1566.001 OR T1059.001 OR T1059.005 OR T1203 OR T1204.002 OR T1547.001 OR T1555.003 OR T1057 OR T1069.002 OR T1082 OR T1083 OR T1518 OR T1005 OR T1071.001 OR T1090.003 OR T1102 OR T1573.001 OR T1588.002 OR T1027.013 OR T1218.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Inception (G0100) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1059.001 OR T1059.005 OR T1203 OR T1204.002 OR T1547.001 OR T1555.003 OR T1057 OR T1069.002 OR T1082 OR T1083 OR T1518 OR T1005 OR T1071.001 OR T1090.003 OR T1102 OR T1573.001 OR T1588.002 OR T1027.013 OR T1218.005) OR threat.technique.id:(T1566.001 OR T1059.001 OR T1059.005 OR T1203 OR T1204.002 OR T1547.001 OR T1555.003 OR T1057 OR T1069.002 OR T1082 OR T1083 OR T1518 OR T1005 OR T1071.001 OR T1090.003 OR T1102 OR T1573.001 OR T1588.002 OR T1027.013 OR T1218.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Inception with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1566.001 OR T1059.001 OR T1059.005 OR T1203 OR T1204.002 OR T1547.001 OR T1555.003 OR T1057 OR T1069.002 OR T1082 OR T1083 OR T1518 OR T1005 OR T1071.001 OR T1090.003 OR T1102 OR T1573.001 OR T1588.002 OR T1027.013 OR T1218.005) OR threat.technique.id:(T1566.001 OR T1059.001 OR T1059.005 OR T1203 OR T1204.002 OR T1547.001 OR T1555.003 OR T1057 OR T1069.002 OR T1082 OR T1083 OR T1518 OR T1005 OR T1071.001 OR T1090.003 OR T1102 OR T1573.001 OR T1588.002 OR T1027.013 OR T1218.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.002\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.002\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.002\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.002\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0102-wizard-spider.json b/app/playbooks/threat-groups/apt-g0102-wizard-spider.json
new file mode 100644
index 0000000..6111650
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0102-wizard-spider.json
@@ -0,0 +1,126 @@
+{
+ "id": "apt-g0102",
+ "num": 133,
+ "name": "MITRE ATT&CK Group — Wizard Spider",
+ "fullName": "Wizard Spider (G0102) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Wizard Spider](https://attack.mitre.org/groups/G0102) is a Russia-based financially motivated threat group originally known for the creation and deployment of [TrickBot](https://attack.mitre.org/software/S0266) since at least 2016. [Wizard Spider](https://attack.mitre.org/groups/G0102) possesses a diverse arsenal of tools and has conducted ransomware campaigns against a variety of organizations, ranging from major corporations to hospitals. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Wizard Spider.",
+ "mitre": "T1078, T1078.002, T1133, T1566.001, T1566.002, T1047, T1053.005, T1059.001, T1059.003, T1197, T1204.001, T1204.002, T1569.002, T1112, T1136.001, T1136.002, T1543.003, T1547.001, T1547.004, T1055, T1055.001, T1003.001, T1003.002, T1003.003",
+ "aliases": [
+ "Wizard Spider",
+ "UNC1878",
+ "TEMP.MixMaster",
+ "Grim Spider",
+ "FIN12",
+ "GOLD BLACKBURN",
+ "ITG23",
+ "Periwinkle Tempest",
+ "DEV-0193",
+ "Pistachio Tempest",
+ "DEV-0237"
+ ],
+ "mitreGroupId": "G0102",
+ "mitreUrl": "https://attack.mitre.org/groups/G0102",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Wizard Spider with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0102. Aliases: Wizard Spider, UNC1878, TEMP.MixMaster, Grim Spider, FIN12, GOLD BLACKBURN, ITG23, Periwinkle Tempest, DEV-0193, Pistachio Tempest, DEV-0237. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact, Defense Impairment, Resource Development, Stealth. Mapped techniques: T1078 Valid Accounts, T1078.002 Domain Accounts, T1133 External Remote Services, T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link, T1047 Windows Management Instrumentation, T1053.005 Scheduled Task, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1197 BITS Jobs, T1204.001 Malicious Link, T1204.002 Malicious File, plus 52 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0102. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Wizard Spider (G0102) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1078.002 OR T1133 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1197 OR T1204.001 OR T1204.002 OR T1569.002 OR T1112 OR T1136.001 OR T1136.002 OR T1543.003 OR T1547.001 OR T1547.004 OR T1055) OR threat.technique.id:(T1078 OR T1078.002 OR T1133 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1197 OR T1204.001 OR T1204.002 OR T1569.002 OR T1112 OR T1136.001 OR T1136.002 OR T1543.003 OR T1547.001 OR T1547.004 OR T1055) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Wizard Spider (G0102) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1078.002 OR T1133 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1197 OR T1204.001 OR T1204.002 OR T1569.002 OR T1112 OR T1136.001 OR T1136.002 OR T1543.003 OR T1547.001 OR T1547.004 OR T1055) OR threat.technique.id:(T1078 OR T1078.002 OR T1133 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1197 OR T1204.001 OR T1204.002 OR T1569.002 OR T1112 OR T1136.001 OR T1136.002 OR T1543.003 OR T1547.001 OR T1547.004 OR T1055) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Wizard Spider with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1078.002 OR T1133 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1197 OR T1204.001 OR T1204.002 OR T1569.002 OR T1112 OR T1136.001 OR T1136.002 OR T1543.003 OR T1547.001 OR T1547.004 OR T1055) OR threat.technique.id:(T1078 OR T1078.002 OR T1133 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1197 OR T1204.001 OR T1204.002 OR T1569.002 OR T1112 OR T1136.001 OR T1136.002 OR T1543.003 OR T1547.001 OR T1547.004 OR T1055) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0103-mofang.json b/app/playbooks/threat-groups/apt-g0103-mofang.json
new file mode 100644
index 0000000..f0a1b6c
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0103-mofang.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0103",
+ "num": 134,
+ "name": "MITRE ATT&CK Group — Mofang",
+ "fullName": "Mofang (G0103) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Mofang](https://attack.mitre.org/groups/G0103) is a likely China-based cyber espionage group, named for its frequent practice of imitating a victim's infrastructure. This adversary has been observed since at least May 2012 conducting focused attacks against government and critical infrastructure in Myanmar, as well as several other countries and sectors including military, automobile, and weapons industries. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Mofang.",
+ "mitre": "T1566.001, T1566.002, T1204.001, T1204.002, T1027.013, T1027.015",
+ "aliases": [
+ "Mofang"
+ ],
+ "mitreGroupId": "G0103",
+ "mitreUrl": "https://attack.mitre.org/groups/G0103",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Mofang with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0103. Aliases: Mofang. Primary mapped tactics: Initial Access, Execution, Stealth. Mapped techniques: T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link, T1204.001 Malicious Link, T1204.002 Malicious File, T1027.013 Encrypted/Encoded File, T1027.015 Compression. Source: https://attack.mitre.org/groups/G0103. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Mofang (G0103) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1566.002 OR T1204.001 OR T1204.002 OR T1027.013 OR T1027.015) OR threat.technique.id:(T1566.001 OR T1566.002 OR T1204.001 OR T1204.002 OR T1027.013 OR T1027.015) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Mofang (G0103) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1566.002 OR T1204.001 OR T1204.002 OR T1027.013 OR T1027.015) OR threat.technique.id:(T1566.001 OR T1566.002 OR T1204.001 OR T1204.002 OR T1027.013 OR T1027.015) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Mofang with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1566.001 OR T1566.002 OR T1204.001 OR T1204.002 OR T1027.013 OR T1027.015) OR threat.technique.id:(T1566.001 OR T1566.002 OR T1204.001 OR T1204.002 OR T1027.013 OR T1027.015) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1204.001\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1027.013\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1204.001\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1027.013\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1204.001\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1027.013\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1204.001\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1027.013\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0105-darkvishnya.json b/app/playbooks/threat-groups/apt-g0105-darkvishnya.json
new file mode 100644
index 0000000..7d1844b
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0105-darkvishnya.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0105",
+ "num": 135,
+ "name": "MITRE ATT&CK Group — DarkVishnya",
+ "fullName": "DarkVishnya (G0105) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[DarkVishnya](https://attack.mitre.org/groups/G0105) is a financially motivated threat actor targeting financial institutions in Eastern Europe. In 2017-2018 the group attacked at least 8 banks in this region. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with DarkVishnya.",
+ "mitre": "T1200, T1059.001, T1543.003, T1040, T1110, T1046, T1135, T1219, T1571, T1588.002",
+ "aliases": [
+ "DarkVishnya"
+ ],
+ "mitreGroupId": "G0105",
+ "mitreUrl": "https://attack.mitre.org/groups/G0105",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile DarkVishnya with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0105. Aliases: DarkVishnya. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Command and Control, Resource Development. Mapped techniques: T1200 Hardware Additions, T1059.001 PowerShell, T1543.003 Windows Service, T1040 Network Sniffing, T1110 Brute Force, T1046 Network Service Discovery, T1135 Network Share Discovery, T1219 Remote Access Tools, T1571 Non-Standard Port, T1588.002 Tool. Source: https://attack.mitre.org/groups/G0105. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - DarkVishnya (G0105) ATT&CK technique pivots\n(rule.threat.technique.id:(T1200 OR T1059.001 OR T1543.003 OR T1040 OR T1110 OR T1046 OR T1135 OR T1219 OR T1571 OR T1588.002) OR threat.technique.id:(T1200 OR T1059.001 OR T1543.003 OR T1040 OR T1110 OR T1046 OR T1135 OR T1219 OR T1571 OR T1588.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - DarkVishnya (G0105) ATT&CK technique pivots\n(rule.threat.technique.id:(T1200 OR T1059.001 OR T1543.003 OR T1040 OR T1110 OR T1046 OR T1135 OR T1219 OR T1571 OR T1588.002) OR threat.technique.id:(T1200 OR T1059.001 OR T1543.003 OR T1040 OR T1110 OR T1046 OR T1135 OR T1219 OR T1571 OR T1588.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile DarkVishnya with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1200 OR T1059.001 OR T1543.003 OR T1040 OR T1110 OR T1046 OR T1135 OR T1219 OR T1571 OR T1588.002) OR threat.technique.id:(T1200 OR T1059.001 OR T1543.003 OR T1040 OR T1110 OR T1046 OR T1135 OR T1219 OR T1571 OR T1588.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1200\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1543.003\"\n[[rule.threat.technique]]\nid = \"T1040\"\n[[rule.threat.technique]]\nid = \"T1110\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1200\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1543.003\"\n[[rule.threat.technique]]\nid = \"T1040\"\n[[rule.threat.technique]]\nid = \"T1110\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1200\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1543.003\"\n[[rule.threat.technique]]\nid = \"T1040\"\n[[rule.threat.technique]]\nid = \"T1110\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1200\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1543.003\"\n[[rule.threat.technique]]\nid = \"T1040\"\n[[rule.threat.technique]]\nid = \"T1110\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0106-rocke.json b/app/playbooks/threat-groups/apt-g0106-rocke.json
new file mode 100644
index 0000000..ac9ad47
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0106-rocke.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0106",
+ "num": 136,
+ "name": "MITRE ATT&CK Group — Rocke",
+ "fullName": "Rocke (G0106) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Rocke](https://attack.mitre.org/groups/G0106) is an alleged Chinese-speaking adversary whose primary objective appeared to be cryptojacking, or stealing victim system resources for the purposes of mining cryptocurrency. The name [Rocke](https://attack.mitre.org/groups/G0106) comes from the email address \"rocke@live.cn\" used to create the wallet which held collected cryptocurrency. Researchers have detected overlaps between [Rocke](https://attack.mitre.org/groups/G0106) and the Iron Cybercrime Group, though this attribution has not been confirmed. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Rocke.",
+ "mitre": "T1190, T1053.003, T1059.004, T1059.006, T1574.006, T1037, T1543.002, T1547.001, T1055.002, T1552.004, T1018, T1046, T1057, T1082, T1518.001, T1021.004, T1071, T1071.001, T1102, T1102.001, T1105, T1571, T1496.001, T1222.002",
+ "aliases": [
+ "Rocke"
+ ],
+ "mitreGroupId": "G0106",
+ "mitreUrl": "https://attack.mitre.org/groups/G0106",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Rocke with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0106. Aliases: Rocke. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Command and Control, Impact, Defense Impairment, Stealth. Mapped techniques: T1190 Exploit Public-Facing Application, T1053.003 Cron, T1059.004 Unix Shell, T1059.006 Python, T1574.006 Dynamic Linker Hijacking, T1037 Boot or Logon Initialization Scripts, T1543.002 Systemd Service, T1547.001 Registry Run Keys / Startup Folder, T1055.002 Portable Executable Injection, T1552.004 Private Keys, T1018 Remote System Discovery, T1046 Network Service Discovery, plus 24 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0106. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Rocke (G0106) ATT&CK technique pivots\n(rule.threat.technique.id:(T1190 OR T1053.003 OR T1059.004 OR T1059.006 OR T1574.006 OR T1037 OR T1543.002 OR T1547.001 OR T1055.002 OR T1552.004 OR T1018 OR T1046 OR T1057 OR T1082 OR T1518.001 OR T1021.004 OR T1071 OR T1071.001 OR T1102 OR T1102.001) OR threat.technique.id:(T1190 OR T1053.003 OR T1059.004 OR T1059.006 OR T1574.006 OR T1037 OR T1543.002 OR T1547.001 OR T1055.002 OR T1552.004 OR T1018 OR T1046 OR T1057 OR T1082 OR T1518.001 OR T1021.004 OR T1071 OR T1071.001 OR T1102 OR T1102.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Rocke (G0106) ATT&CK technique pivots\n(rule.threat.technique.id:(T1190 OR T1053.003 OR T1059.004 OR T1059.006 OR T1574.006 OR T1037 OR T1543.002 OR T1547.001 OR T1055.002 OR T1552.004 OR T1018 OR T1046 OR T1057 OR T1082 OR T1518.001 OR T1021.004 OR T1071 OR T1071.001 OR T1102 OR T1102.001) OR threat.technique.id:(T1190 OR T1053.003 OR T1059.004 OR T1059.006 OR T1574.006 OR T1037 OR T1543.002 OR T1547.001 OR T1055.002 OR T1552.004 OR T1018 OR T1046 OR T1057 OR T1082 OR T1518.001 OR T1021.004 OR T1071 OR T1071.001 OR T1102 OR T1102.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Rocke with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1190 OR T1053.003 OR T1059.004 OR T1059.006 OR T1574.006 OR T1037 OR T1543.002 OR T1547.001 OR T1055.002 OR T1552.004 OR T1018 OR T1046 OR T1057 OR T1082 OR T1518.001 OR T1021.004 OR T1071 OR T1071.001 OR T1102 OR T1102.001) OR threat.technique.id:(T1190 OR T1053.003 OR T1059.004 OR T1059.006 OR T1574.006 OR T1037 OR T1543.002 OR T1547.001 OR T1055.002 OR T1552.004 OR T1018 OR T1046 OR T1057 OR T1082 OR T1518.001 OR T1021.004 OR T1071 OR T1071.001 OR T1102 OR T1102.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1053.003\"\n[[rule.threat.technique]]\nid = \"T1059.004\"\n[[rule.threat.technique]]\nid = \"T1059.006\"\n[[rule.threat.technique]]\nid = \"T1574.006\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1053.003\"\n[[rule.threat.technique]]\nid = \"T1059.004\"\n[[rule.threat.technique]]\nid = \"T1059.006\"\n[[rule.threat.technique]]\nid = \"T1574.006\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1053.003\"\n[[rule.threat.technique]]\nid = \"T1059.004\"\n[[rule.threat.technique]]\nid = \"T1059.006\"\n[[rule.threat.technique]]\nid = \"T1574.006\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1053.003\"\n[[rule.threat.technique]]\nid = \"T1059.004\"\n[[rule.threat.technique]]\nid = \"T1059.006\"\n[[rule.threat.technique]]\nid = \"T1574.006\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0107-whitefly.json b/app/playbooks/threat-groups/apt-g0107-whitefly.json
new file mode 100644
index 0000000..f04187d
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0107-whitefly.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0107",
+ "num": 137,
+ "name": "MITRE ATT&CK Group — Whitefly",
+ "fullName": "Whitefly (G0107) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Whitefly](https://attack.mitre.org/groups/G0107) is a cyber espionage group that has been operating since at least 2017. The group has targeted organizations based mostly in Singapore across a wide variety of sectors, and is primarily interested in stealing large amounts of sensitive information. The group has been linked to an attack against Singapore’s largest public health organization, SingHealth. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Whitefly.",
+ "mitre": "T1059, T1204.002, T1574.001, T1068, T1003.001, T1105, T1588.002, T1027.013, T1036.005",
+ "aliases": [
+ "Whitefly"
+ ],
+ "mitreGroupId": "G0107",
+ "mitreUrl": "https://attack.mitre.org/groups/G0107",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Whitefly with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0107. Aliases: Whitefly. Primary mapped tactics: Execution, Privilege Escalation, Credential Access, Command and Control, Resource Development, Stealth. Mapped techniques: T1059 Command and Scripting Interpreter, T1204.002 Malicious File, T1574.001 DLL, T1068 Exploitation for Privilege Escalation, T1003.001 LSASS Memory, T1105 Ingress Tool Transfer, T1588.002 Tool, T1027.013 Encrypted/Encoded File, T1036.005 Match Legitimate Resource Name or Location. Source: https://attack.mitre.org/groups/G0107. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Whitefly (G0107) ATT&CK technique pivots\n(rule.threat.technique.id:(T1059 OR T1204.002 OR T1574.001 OR T1068 OR T1003.001 OR T1105 OR T1588.002 OR T1027.013 OR T1036.005) OR threat.technique.id:(T1059 OR T1204.002 OR T1574.001 OR T1068 OR T1003.001 OR T1105 OR T1588.002 OR T1027.013 OR T1036.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Whitefly (G0107) ATT&CK technique pivots\n(rule.threat.technique.id:(T1059 OR T1204.002 OR T1574.001 OR T1068 OR T1003.001 OR T1105 OR T1588.002 OR T1027.013 OR T1036.005) OR threat.technique.id:(T1059 OR T1204.002 OR T1574.001 OR T1068 OR T1003.001 OR T1105 OR T1588.002 OR T1027.013 OR T1036.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Whitefly with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1059 OR T1204.002 OR T1574.001 OR T1068 OR T1003.001 OR T1105 OR T1588.002 OR T1027.013 OR T1036.005) OR threat.technique.id:(T1059 OR T1204.002 OR T1574.001 OR T1068 OR T1003.001 OR T1105 OR T1588.002 OR T1027.013 OR T1036.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1059\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1574.001\"\n[[rule.threat.technique]]\nid = \"T1068\"\n[[rule.threat.technique]]\nid = \"T1003.001\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1059\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1574.001\"\n[[rule.threat.technique]]\nid = \"T1068\"\n[[rule.threat.technique]]\nid = \"T1003.001\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1059\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1574.001\"\n[[rule.threat.technique]]\nid = \"T1068\"\n[[rule.threat.technique]]\nid = \"T1003.001\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1059\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1574.001\"\n[[rule.threat.technique]]\nid = \"T1068\"\n[[rule.threat.technique]]\nid = \"T1003.001\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0108-blue-mockingbird.json b/app/playbooks/threat-groups/apt-g0108-blue-mockingbird.json
new file mode 100644
index 0000000..f279390
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0108-blue-mockingbird.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0108",
+ "num": 138,
+ "name": "MITRE ATT&CK Group — Blue Mockingbird",
+ "fullName": "Blue Mockingbird (G0108) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Blue Mockingbird](https://attack.mitre.org/groups/G0108) is a cluster of observed activity involving Monero cryptocurrency-mining payloads in dynamic-link library (DLL) form on Windows systems. The earliest observed Blue Mockingbird tools were created in December 2019. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Blue Mockingbird.",
+ "mitre": "T1190, T1047, T1053.005, T1059.001, T1059.003, T1569.002, T1574.012, T1112, T1543.003, T1546.003, T1134, T1003.001, T1082, T1021.001, T1021.002, T1090, T1496.001, T1588.002, T1027.013, T1036.005, T1218.010, T1218.011",
+ "aliases": [
+ "Blue Mockingbird"
+ ],
+ "mitreGroupId": "G0108",
+ "mitreUrl": "https://attack.mitre.org/groups/G0108",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Blue Mockingbird with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0108. Aliases: Blue Mockingbird. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Command and Control, Impact, Defense Impairment, Resource Development, Stealth. Mapped techniques: T1190 Exploit Public-Facing Application, T1047 Windows Management Instrumentation, T1053.005 Scheduled Task, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1569.002 Service Execution, T1574.012 COR_PROFILER, T1112 Modify Registry, T1543.003 Windows Service, T1546.003 Windows Management Instrumentation Event Subscription, T1134 Access Token Manipulation, T1003.001 LSASS Memory, plus 10 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0108. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Blue Mockingbird (G0108) ATT&CK technique pivots\n(rule.threat.technique.id:(T1190 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1569.002 OR T1574.012 OR T1112 OR T1543.003 OR T1546.003 OR T1134 OR T1003.001 OR T1082 OR T1021.001 OR T1021.002 OR T1090 OR T1496.001 OR T1588.002 OR T1027.013 OR T1036.005) OR threat.technique.id:(T1190 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1569.002 OR T1574.012 OR T1112 OR T1543.003 OR T1546.003 OR T1134 OR T1003.001 OR T1082 OR T1021.001 OR T1021.002 OR T1090 OR T1496.001 OR T1588.002 OR T1027.013 OR T1036.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Blue Mockingbird (G0108) ATT&CK technique pivots\n(rule.threat.technique.id:(T1190 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1569.002 OR T1574.012 OR T1112 OR T1543.003 OR T1546.003 OR T1134 OR T1003.001 OR T1082 OR T1021.001 OR T1021.002 OR T1090 OR T1496.001 OR T1588.002 OR T1027.013 OR T1036.005) OR threat.technique.id:(T1190 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1569.002 OR T1574.012 OR T1112 OR T1543.003 OR T1546.003 OR T1134 OR T1003.001 OR T1082 OR T1021.001 OR T1021.002 OR T1090 OR T1496.001 OR T1588.002 OR T1027.013 OR T1036.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Blue Mockingbird with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1190 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1569.002 OR T1574.012 OR T1112 OR T1543.003 OR T1546.003 OR T1134 OR T1003.001 OR T1082 OR T1021.001 OR T1021.002 OR T1090 OR T1496.001 OR T1588.002 OR T1027.013 OR T1036.005) OR threat.technique.id:(T1190 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1569.002 OR T1574.012 OR T1112 OR T1543.003 OR T1546.003 OR T1134 OR T1003.001 OR T1082 OR T1021.001 OR T1021.002 OR T1090 OR T1496.001 OR T1588.002 OR T1027.013 OR T1036.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0112-windshift.json b/app/playbooks/threat-groups/apt-g0112-windshift.json
new file mode 100644
index 0000000..aced0ea
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0112-windshift.json
@@ -0,0 +1,117 @@
+{
+ "id": "apt-g0112",
+ "num": 139,
+ "name": "MITRE ATT&CK Group — Windshift",
+ "fullName": "Windshift (G0112) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Windshift](https://attack.mitre.org/groups/G0112) is a threat group that has been active since at least 2017, targeting specific individuals for surveillance in government departments and critical infrastructure across the Middle East. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Windshift.",
+ "mitre": "T1189, T1566.001, T1566.002, T1566.003, T1047, T1059.005, T1204.001, T1204.002, T1547.001, T1033, T1057, T1082, T1518, T1518.001, T1071.001, T1105, T1027, T1036, T1036.001",
+ "aliases": [
+ "Windshift",
+ "Bahamut"
+ ],
+ "mitreGroupId": "G0112",
+ "mitreUrl": "https://attack.mitre.org/groups/G0112",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Windshift with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0112. Aliases: Windshift, Bahamut. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Discovery, Command and Control, Stealth. Mapped techniques: T1189 Drive-by Compromise, T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link, T1566.003 Spearphishing via Service, T1047 Windows Management Instrumentation, T1059.005 Visual Basic, T1204.001 Malicious Link, T1204.002 Malicious File, T1547.001 Registry Run Keys / Startup Folder, T1033 System Owner/User Discovery, T1057 Process Discovery, T1082 System Information Discovery, plus 7 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0112. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Windshift (G0112) ATT&CK technique pivots\n(rule.threat.technique.id:(T1189 OR T1566.001 OR T1566.002 OR T1566.003 OR T1047 OR T1059.005 OR T1204.001 OR T1204.002 OR T1547.001 OR T1033 OR T1057 OR T1082 OR T1518 OR T1518.001 OR T1071.001 OR T1105 OR T1027 OR T1036 OR T1036.001) OR threat.technique.id:(T1189 OR T1566.001 OR T1566.002 OR T1566.003 OR T1047 OR T1059.005 OR T1204.001 OR T1204.002 OR T1547.001 OR T1033 OR T1057 OR T1082 OR T1518 OR T1518.001 OR T1071.001 OR T1105 OR T1027 OR T1036 OR T1036.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Windshift (G0112) ATT&CK technique pivots\n(rule.threat.technique.id:(T1189 OR T1566.001 OR T1566.002 OR T1566.003 OR T1047 OR T1059.005 OR T1204.001 OR T1204.002 OR T1547.001 OR T1033 OR T1057 OR T1082 OR T1518 OR T1518.001 OR T1071.001 OR T1105 OR T1027 OR T1036 OR T1036.001) OR threat.technique.id:(T1189 OR T1566.001 OR T1566.002 OR T1566.003 OR T1047 OR T1059.005 OR T1204.001 OR T1204.002 OR T1547.001 OR T1033 OR T1057 OR T1082 OR T1518 OR T1518.001 OR T1071.001 OR T1105 OR T1027 OR T1036 OR T1036.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Windshift with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1189 OR T1566.001 OR T1566.002 OR T1566.003 OR T1047 OR T1059.005 OR T1204.001 OR T1204.002 OR T1547.001 OR T1033 OR T1057 OR T1082 OR T1518 OR T1518.001 OR T1071.001 OR T1105 OR T1027 OR T1036 OR T1036.001) OR threat.technique.id:(T1189 OR T1566.001 OR T1566.002 OR T1566.003 OR T1047 OR T1059.005 OR T1204.001 OR T1204.002 OR T1547.001 OR T1033 OR T1057 OR T1082 OR T1518 OR T1518.001 OR T1071.001 OR T1105 OR T1027 OR T1036 OR T1036.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1566.003\"\n[[rule.threat.technique]]\nid = \"T1047\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1566.003\"\n[[rule.threat.technique]]\nid = \"T1047\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1566.003\"\n[[rule.threat.technique]]\nid = \"T1047\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1566.003\"\n[[rule.threat.technique]]\nid = \"T1047\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0114-chimera.json b/app/playbooks/threat-groups/apt-g0114-chimera.json
new file mode 100644
index 0000000..d8be2f9
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0114-chimera.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0114",
+ "num": 140,
+ "name": "MITRE ATT&CK Group — Chimera",
+ "fullName": "Chimera (G0114) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Chimera](https://attack.mitre.org/groups/G0114) is a suspected China-based threat group that has been active since at least 2018 targeting the semiconductor industry in Taiwan as well as data from the airline industry. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Chimera.",
+ "mitre": "T1078, T1078.002, T1133, T1047, T1053.005, T1059.001, T1059.003, T1106, T1569.002, T1574.001, T1556.001, T1003.003, T1110.003, T1110.004, T1111, T1007, T1012, T1016, T1018, T1033, T1046, T1049, T1057, T1069.001",
+ "aliases": [
+ "Chimera"
+ ],
+ "mitreGroupId": "G0114",
+ "mitreUrl": "https://attack.mitre.org/groups/G0114",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Chimera with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0114. Aliases: Chimera. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Defense Impairment, Reconnaissance, Resource Development, Stealth. Mapped techniques: T1078 Valid Accounts, T1078.002 Domain Accounts, T1133 External Remote Services, T1047 Windows Management Instrumentation, T1053.005 Scheduled Task, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1106 Native API, T1569.002 Service Execution, T1574.001 DLL, T1556.001 Domain Controller Authentication, T1003.003 NTDS, plus 47 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0114. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Chimera (G0114) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1078.002 OR T1133 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1106 OR T1569.002 OR T1574.001 OR T1556.001 OR T1003.003 OR T1110.003 OR T1110.004 OR T1111 OR T1007 OR T1012 OR T1016 OR T1018 OR T1033) OR threat.technique.id:(T1078 OR T1078.002 OR T1133 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1106 OR T1569.002 OR T1574.001 OR T1556.001 OR T1003.003 OR T1110.003 OR T1110.004 OR T1111 OR T1007 OR T1012 OR T1016 OR T1018 OR T1033) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Chimera (G0114) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1078.002 OR T1133 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1106 OR T1569.002 OR T1574.001 OR T1556.001 OR T1003.003 OR T1110.003 OR T1110.004 OR T1111 OR T1007 OR T1012 OR T1016 OR T1018 OR T1033) OR threat.technique.id:(T1078 OR T1078.002 OR T1133 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1106 OR T1569.002 OR T1574.001 OR T1556.001 OR T1003.003 OR T1110.003 OR T1110.004 OR T1111 OR T1007 OR T1012 OR T1016 OR T1018 OR T1033) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Chimera with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1078.002 OR T1133 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1106 OR T1569.002 OR T1574.001 OR T1556.001 OR T1003.003 OR T1110.003 OR T1110.004 OR T1111 OR T1007 OR T1012 OR T1016 OR T1018 OR T1033) OR threat.technique.id:(T1078 OR T1078.002 OR T1133 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1106 OR T1569.002 OR T1574.001 OR T1556.001 OR T1003.003 OR T1110.003 OR T1110.004 OR T1111 OR T1007 OR T1012 OR T1016 OR T1018 OR T1033) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0115-gold-southfield.json b/app/playbooks/threat-groups/apt-g0115-gold-southfield.json
new file mode 100644
index 0000000..4a4f146
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0115-gold-southfield.json
@@ -0,0 +1,117 @@
+{
+ "id": "apt-g0115",
+ "num": 141,
+ "name": "MITRE ATT&CK Group — GOLD SOUTHFIELD",
+ "fullName": "GOLD SOUTHFIELD (G0115) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) is a financially motivated threat group active since at least 2018 that operates the [REvil](https://attack.mitre.org/software/S0496) Ransomware-as-a Service (RaaS). [GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) provides backend infrastructure for affiliates recruited on underground forums to perpetrate high value deployments. By early 2020, [GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) started capitalizing on the new trend of stealing data and further extorting the victim to pay for their data to not get publicly leaked. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with GOLD SOUTHFIELD.",
+ "mitre": "T1133, T1190, T1195.002, T1199, T1566, T1059.001, T1113, T1219, T1027.010",
+ "aliases": [
+ "GOLD SOUTHFIELD",
+ "Pinchy Spider"
+ ],
+ "mitreGroupId": "G0115",
+ "mitreUrl": "https://attack.mitre.org/groups/G0115",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile GOLD SOUTHFIELD with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0115. Aliases: GOLD SOUTHFIELD, Pinchy Spider. Primary mapped tactics: Initial Access, Execution, Persistence, Collection, Command and Control, Stealth. Mapped techniques: T1133 External Remote Services, T1190 Exploit Public-Facing Application, T1195.002 Compromise Software Supply Chain, T1199 Trusted Relationship, T1566 Phishing, T1059.001 PowerShell, T1113 Screen Capture, T1219 Remote Access Tools, T1027.010 Command Obfuscation. Source: https://attack.mitre.org/groups/G0115. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - GOLD SOUTHFIELD (G0115) ATT&CK technique pivots\n(rule.threat.technique.id:(T1133 OR T1190 OR T1195.002 OR T1199 OR T1566 OR T1059.001 OR T1113 OR T1219 OR T1027.010) OR threat.technique.id:(T1133 OR T1190 OR T1195.002 OR T1199 OR T1566 OR T1059.001 OR T1113 OR T1219 OR T1027.010) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - GOLD SOUTHFIELD (G0115) ATT&CK technique pivots\n(rule.threat.technique.id:(T1133 OR T1190 OR T1195.002 OR T1199 OR T1566 OR T1059.001 OR T1113 OR T1219 OR T1027.010) OR threat.technique.id:(T1133 OR T1190 OR T1195.002 OR T1199 OR T1566 OR T1059.001 OR T1113 OR T1219 OR T1027.010) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile GOLD SOUTHFIELD with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1133 OR T1190 OR T1195.002 OR T1199 OR T1566 OR T1059.001 OR T1113 OR T1219 OR T1027.010) OR threat.technique.id:(T1133 OR T1190 OR T1195.002 OR T1199 OR T1566 OR T1059.001 OR T1113 OR T1219 OR T1027.010) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1195.002\"\n[[rule.threat.technique]]\nid = \"T1199\"\n[[rule.threat.technique]]\nid = \"T1566\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1195.002\"\n[[rule.threat.technique]]\nid = \"T1199\"\n[[rule.threat.technique]]\nid = \"T1566\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1195.002\"\n[[rule.threat.technique]]\nid = \"T1199\"\n[[rule.threat.technique]]\nid = \"T1566\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1195.002\"\n[[rule.threat.technique]]\nid = \"T1199\"\n[[rule.threat.technique]]\nid = \"T1566\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0117-fox-kitten.json b/app/playbooks/threat-groups/apt-g0117-fox-kitten.json
new file mode 100644
index 0000000..8c3da4a
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0117-fox-kitten.json
@@ -0,0 +1,121 @@
+{
+ "id": "apt-g0117",
+ "num": 142,
+ "name": "MITRE ATT&CK Group — Fox Kitten",
+ "fullName": "Fox Kitten (G0117) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Fox Kitten](https://attack.mitre.org/groups/G0117) is threat actor with a suspected nexus to the Iranian government that has been active since at least 2017 against entities in the Middle East, North Africa, Europe, Australia, and North America. [Fox Kitten](https://attack.mitre.org/groups/G0117) has targeted multiple industrial verticals including oil and gas, technology, government, defense, healthcare, manufacturing, and engineering. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Fox Kitten.",
+ "mitre": "T1078, T1190, T1053.005, T1059, T1059.001, T1059.003, T1136.001, T1505.003, T1546.008, T1003.001, T1003.003, T1110, T1552.001, T1555.005, T1012, T1018, T1046, T1083, T1087.001, T1087.002, T1217, T1021.001, T1021.002, T1021.004",
+ "aliases": [
+ "Fox Kitten",
+ "UNC757",
+ "Parisite",
+ "Pioneer Kitten",
+ "RUBIDIUM",
+ "Lemon Sandstorm"
+ ],
+ "mitreGroupId": "G0117",
+ "mitreUrl": "https://attack.mitre.org/groups/G0117",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Fox Kitten with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0117. Aliases: Fox Kitten, UNC757, Parisite, Pioneer Kitten, RUBIDIUM, Lemon Sandstorm. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Resource Development, Stealth. Mapped techniques: T1078 Valid Accounts, T1190 Exploit Public-Facing Application, T1053.005 Scheduled Task, T1059 Command and Scripting Interpreter, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1136.001 Local Account, T1505.003 Web Shell, T1546.008 Accessibility Features, T1003.001 LSASS Memory, T1003.003 NTDS, T1110 Brute Force, plus 29 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0117. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Fox Kitten (G0117) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1190 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1136.001 OR T1505.003 OR T1546.008 OR T1003.001 OR T1003.003 OR T1110 OR T1552.001 OR T1555.005 OR T1012 OR T1018 OR T1046 OR T1083 OR T1087.001 OR T1087.002) OR threat.technique.id:(T1078 OR T1190 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1136.001 OR T1505.003 OR T1546.008 OR T1003.001 OR T1003.003 OR T1110 OR T1552.001 OR T1555.005 OR T1012 OR T1018 OR T1046 OR T1083 OR T1087.001 OR T1087.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Fox Kitten (G0117) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1190 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1136.001 OR T1505.003 OR T1546.008 OR T1003.001 OR T1003.003 OR T1110 OR T1552.001 OR T1555.005 OR T1012 OR T1018 OR T1046 OR T1083 OR T1087.001 OR T1087.002) OR threat.technique.id:(T1078 OR T1190 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1136.001 OR T1505.003 OR T1546.008 OR T1003.001 OR T1003.003 OR T1110 OR T1552.001 OR T1555.005 OR T1012 OR T1018 OR T1046 OR T1083 OR T1087.001 OR T1087.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Fox Kitten with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1190 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1136.001 OR T1505.003 OR T1546.008 OR T1003.001 OR T1003.003 OR T1110 OR T1552.001 OR T1555.005 OR T1012 OR T1018 OR T1046 OR T1083 OR T1087.001 OR T1087.002) OR threat.technique.id:(T1078 OR T1190 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1136.001 OR T1505.003 OR T1546.008 OR T1003.001 OR T1003.003 OR T1110 OR T1552.001 OR T1555.005 OR T1012 OR T1018 OR T1046 OR T1083 OR T1087.001 OR T1087.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0119-indrik-spider.json b/app/playbooks/threat-groups/apt-g0119-indrik-spider.json
new file mode 100644
index 0000000..f16285b
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0119-indrik-spider.json
@@ -0,0 +1,120 @@
+{
+ "id": "apt-g0119",
+ "num": 143,
+ "name": "MITRE ATT&CK Group — Indrik Spider",
+ "fullName": "Indrik Spider (G0119) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Indrik Spider](https://attack.mitre.org/groups/G0119) is a Russia-based cybercriminal group that has been active since at least 2014. [Indrik Spider](https://attack.mitre.org/groups/G0119) initially started with the [Dridex](https://attack.mitre.org/software/S0384) banking Trojan, and then by 2017 they began running ransomware operations using [BitPaymer](https://attack.mitre.org/software/S0570), [WastedLocker](https://attack.mitre.org/software/S0612), and Hades ransomware. Following U.S. sanctions and an indictment in 2019, [Indrik Spider](https://attack.mitre.org/groups/G0119) changed their tactics and diversified their toolset. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Indrik Spider.",
+ "mitre": "T1078, T1078.002, T1047, T1059.001, T1059.003, T1059.007, T1204.002, T1112, T1136, T1136.001, T1484.001, T1003.001, T1552.001, T1555.005, T1558.003, T1007, T1012, T1018, T1021.001, T1021.004, T1074.001, T1105, T1567.002, T1486",
+ "aliases": [
+ "Indrik Spider",
+ "Evil Corp",
+ "Manatee Tempest",
+ "DEV-0243",
+ "UNC2165"
+ ],
+ "mitreGroupId": "G0119",
+ "mitreUrl": "https://attack.mitre.org/groups/G0119",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Indrik Spider with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0119. Aliases: Indrik Spider, Evil Corp, Manatee Tempest, DEV-0243, UNC2165. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact, Defense Impairment, Reconnaissance, Resource Development, Stealth. Mapped techniques: T1078 Valid Accounts, T1078.002 Domain Accounts, T1047 Windows Management Instrumentation, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1059.007 JavaScript, T1204.002 Malicious File, T1112 Modify Registry, T1136 Create Account, T1136.001 Local Account, T1484.001 Group Policy Modification, T1003.001 LSASS Memory, plus 21 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0119. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Indrik Spider (G0119) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1078.002 OR T1047 OR T1059.001 OR T1059.003 OR T1059.007 OR T1204.002 OR T1112 OR T1136 OR T1136.001 OR T1484.001 OR T1003.001 OR T1552.001 OR T1555.005 OR T1558.003 OR T1007 OR T1012 OR T1018 OR T1021.001 OR T1021.004) OR threat.technique.id:(T1078 OR T1078.002 OR T1047 OR T1059.001 OR T1059.003 OR T1059.007 OR T1204.002 OR T1112 OR T1136 OR T1136.001 OR T1484.001 OR T1003.001 OR T1552.001 OR T1555.005 OR T1558.003 OR T1007 OR T1012 OR T1018 OR T1021.001 OR T1021.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Indrik Spider (G0119) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1078.002 OR T1047 OR T1059.001 OR T1059.003 OR T1059.007 OR T1204.002 OR T1112 OR T1136 OR T1136.001 OR T1484.001 OR T1003.001 OR T1552.001 OR T1555.005 OR T1558.003 OR T1007 OR T1012 OR T1018 OR T1021.001 OR T1021.004) OR threat.technique.id:(T1078 OR T1078.002 OR T1047 OR T1059.001 OR T1059.003 OR T1059.007 OR T1204.002 OR T1112 OR T1136 OR T1136.001 OR T1484.001 OR T1003.001 OR T1552.001 OR T1555.005 OR T1558.003 OR T1007 OR T1012 OR T1018 OR T1021.001 OR T1021.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Indrik Spider with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1078.002 OR T1047 OR T1059.001 OR T1059.003 OR T1059.007 OR T1204.002 OR T1112 OR T1136 OR T1136.001 OR T1484.001 OR T1003.001 OR T1552.001 OR T1555.005 OR T1558.003 OR T1007 OR T1012 OR T1018 OR T1021.001 OR T1021.004) OR threat.technique.id:(T1078 OR T1078.002 OR T1047 OR T1059.001 OR T1059.003 OR T1059.007 OR T1204.002 OR T1112 OR T1136 OR T1136.001 OR T1484.001 OR T1003.001 OR T1552.001 OR T1555.005 OR T1558.003 OR T1007 OR T1012 OR T1018 OR T1021.001 OR T1021.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0120-evilnum.json b/app/playbooks/threat-groups/apt-g0120-evilnum.json
new file mode 100644
index 0000000..9f4f7d5
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0120-evilnum.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0120",
+ "num": 144,
+ "name": "MITRE ATT&CK Group — Evilnum",
+ "fullName": "Evilnum (G0120) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Evilnum](https://attack.mitre.org/groups/G0120) is a financially motivated threat group that has been active since at least 2018. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Evilnum.",
+ "mitre": "T1566.002, T1059.007, T1204.001, T1574.001, T1548.002, T1539, T1555, T1497.001, T1105, T1219.002, T1070.004",
+ "aliases": [
+ "Evilnum"
+ ],
+ "mitreGroupId": "G0120",
+ "mitreUrl": "https://attack.mitre.org/groups/G0120",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Evilnum with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0120. Aliases: Evilnum. Primary mapped tactics: Initial Access, Execution, Privilege Escalation, Credential Access, Discovery, Command and Control, Stealth. Mapped techniques: T1566.002 Spearphishing Link, T1059.007 JavaScript, T1204.001 Malicious Link, T1574.001 DLL, T1548.002 Bypass User Account Control, T1539 Steal Web Session Cookie, T1555 Credentials from Password Stores, T1497.001 System Checks, T1105 Ingress Tool Transfer, T1219.002 Remote Desktop Software, T1070.004 File Deletion. Source: https://attack.mitre.org/groups/G0120. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Evilnum (G0120) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.002 OR T1059.007 OR T1204.001 OR T1574.001 OR T1548.002 OR T1539 OR T1555 OR T1497.001 OR T1105 OR T1219.002 OR T1070.004) OR threat.technique.id:(T1566.002 OR T1059.007 OR T1204.001 OR T1574.001 OR T1548.002 OR T1539 OR T1555 OR T1497.001 OR T1105 OR T1219.002 OR T1070.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Evilnum (G0120) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.002 OR T1059.007 OR T1204.001 OR T1574.001 OR T1548.002 OR T1539 OR T1555 OR T1497.001 OR T1105 OR T1219.002 OR T1070.004) OR threat.technique.id:(T1566.002 OR T1059.007 OR T1204.001 OR T1574.001 OR T1548.002 OR T1539 OR T1555 OR T1497.001 OR T1105 OR T1219.002 OR T1070.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Evilnum with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1566.002 OR T1059.007 OR T1204.001 OR T1574.001 OR T1548.002 OR T1539 OR T1555 OR T1497.001 OR T1105 OR T1219.002 OR T1070.004) OR threat.technique.id:(T1566.002 OR T1059.007 OR T1204.001 OR T1574.001 OR T1548.002 OR T1539 OR T1555 OR T1497.001 OR T1105 OR T1219.002 OR T1070.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.007\"\n[[rule.threat.technique]]\nid = \"T1204.001\"\n[[rule.threat.technique]]\nid = \"T1574.001\"\n[[rule.threat.technique]]\nid = \"T1548.002\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.007\"\n[[rule.threat.technique]]\nid = \"T1204.001\"\n[[rule.threat.technique]]\nid = \"T1574.001\"\n[[rule.threat.technique]]\nid = \"T1548.002\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.007\"\n[[rule.threat.technique]]\nid = \"T1204.001\"\n[[rule.threat.technique]]\nid = \"T1574.001\"\n[[rule.threat.technique]]\nid = \"T1548.002\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.007\"\n[[rule.threat.technique]]\nid = \"T1204.001\"\n[[rule.threat.technique]]\nid = \"T1574.001\"\n[[rule.threat.technique]]\nid = \"T1548.002\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0121-sidewinder.json b/app/playbooks/threat-groups/apt-g0121-sidewinder.json
new file mode 100644
index 0000000..4c7ffa1
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0121-sidewinder.json
@@ -0,0 +1,118 @@
+{
+ "id": "apt-g0121",
+ "num": 145,
+ "name": "MITRE ATT&CK Group — Sidewinder",
+ "fullName": "Sidewinder (G0121) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Sidewinder](https://attack.mitre.org/groups/G0121) is a suspected Indian threat actor group that has been active since at least 2012. They have been observed targeting government, military, and business entities throughout Asia, primarily focusing on Pakistan, China, Nepal, and Afghanistan. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Sidewinder.",
+ "mitre": "T1566.001, T1566.002, T1059.001, T1059.005, T1059.007, T1203, T1204.001, T1204.002, T1559.002, T1574.001, T1547.001, T1016, T1033, T1057, T1082, T1083, T1124, T1518, T1518.001, T1074.001, T1119, T1071.001, T1105, T1020",
+ "aliases": [
+ "Sidewinder",
+ "T-APT-04",
+ "Rattlesnake"
+ ],
+ "mitreGroupId": "G0121",
+ "mitreUrl": "https://attack.mitre.org/groups/G0121",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Sidewinder with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0121. Aliases: Sidewinder, T-APT-04, Rattlesnake. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Discovery, Collection, Command and Control, Exfiltration, Reconnaissance, Stealth. Mapped techniques: T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link, T1059.001 PowerShell, T1059.005 Visual Basic, T1059.007 JavaScript, T1203 Exploitation for Client Execution, T1204.001 Malicious Link, T1204.002 Malicious File, T1559.002 Dynamic Data Exchange, T1574.001 DLL, T1547.001 Registry Run Keys / Startup Folder, T1016 System Network Configuration Discovery, plus 18 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0121. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Sidewinder (G0121) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1566.002 OR T1059.001 OR T1059.005 OR T1059.007 OR T1203 OR T1204.001 OR T1204.002 OR T1559.002 OR T1574.001 OR T1547.001 OR T1016 OR T1033 OR T1057 OR T1082 OR T1083 OR T1124 OR T1518 OR T1518.001 OR T1074.001) OR threat.technique.id:(T1566.001 OR T1566.002 OR T1059.001 OR T1059.005 OR T1059.007 OR T1203 OR T1204.001 OR T1204.002 OR T1559.002 OR T1574.001 OR T1547.001 OR T1016 OR T1033 OR T1057 OR T1082 OR T1083 OR T1124 OR T1518 OR T1518.001 OR T1074.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Sidewinder (G0121) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1566.002 OR T1059.001 OR T1059.005 OR T1059.007 OR T1203 OR T1204.001 OR T1204.002 OR T1559.002 OR T1574.001 OR T1547.001 OR T1016 OR T1033 OR T1057 OR T1082 OR T1083 OR T1124 OR T1518 OR T1518.001 OR T1074.001) OR threat.technique.id:(T1566.001 OR T1566.002 OR T1059.001 OR T1059.005 OR T1059.007 OR T1203 OR T1204.001 OR T1204.002 OR T1559.002 OR T1574.001 OR T1547.001 OR T1016 OR T1033 OR T1057 OR T1082 OR T1083 OR T1124 OR T1518 OR T1518.001 OR T1074.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Sidewinder with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1566.001 OR T1566.002 OR T1059.001 OR T1059.005 OR T1059.007 OR T1203 OR T1204.001 OR T1204.002 OR T1559.002 OR T1574.001 OR T1547.001 OR T1016 OR T1033 OR T1057 OR T1082 OR T1083 OR T1124 OR T1518 OR T1518.001 OR T1074.001) OR threat.technique.id:(T1566.001 OR T1566.002 OR T1059.001 OR T1059.005 OR T1059.007 OR T1203 OR T1204.001 OR T1204.002 OR T1559.002 OR T1574.001 OR T1547.001 OR T1016 OR T1033 OR T1057 OR T1082 OR T1083 OR T1124 OR T1518 OR T1518.001 OR T1074.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1059.007\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1059.007\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1059.007\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1059.007\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0122-silent-librarian.json b/app/playbooks/threat-groups/apt-g0122-silent-librarian.json
new file mode 100644
index 0000000..0298a5c
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0122-silent-librarian.json
@@ -0,0 +1,118 @@
+{
+ "id": "apt-g0122",
+ "num": 146,
+ "name": "MITRE ATT&CK Group — Silent Librarian",
+ "fullName": "Silent Librarian (G0122) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Silent Librarian](https://attack.mitre.org/groups/G0122) is a group that has targeted research and proprietary data at universities, government agencies, and private sector companies worldwide since at least 2013. Members of [Silent Librarian](https://attack.mitre.org/groups/G0122) are known to have been affiliated with the Iran-based Mabna Institute which has conducted cyber intrusions at the behest of the government of Iran, specifically the Islamic Revolutionary Guard Corps (IRGC). This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Silent Librarian.",
+ "mitre": "T1078, T1110.003, T1114, T1114.003, T1589.002, T1589.003, T1594, T1598.003, T1583.001, T1585.002, T1588.002, T1588.004, T1608.005",
+ "aliases": [
+ "Silent Librarian",
+ "TA407",
+ "COBALT DICKENS"
+ ],
+ "mitreGroupId": "G0122",
+ "mitreUrl": "https://attack.mitre.org/groups/G0122",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Silent Librarian with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0122. Aliases: Silent Librarian, TA407, COBALT DICKENS. Primary mapped tactics: Initial Access, Persistence, Privilege Escalation, Credential Access, Collection, Reconnaissance, Resource Development, Stealth. Mapped techniques: T1078 Valid Accounts, T1110.003 Password Spraying, T1114 Email Collection, T1114.003 Email Forwarding Rule, T1589.002 Email Addresses, T1589.003 Employee Names, T1594 Search Victim-Owned Websites, T1598.003 Spearphishing Link, T1583.001 Domains, T1585.002 Email Accounts, T1588.002 Tool, T1588.004 Digital Certificates, plus 1 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0122. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Silent Librarian (G0122) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1110.003 OR T1114 OR T1114.003 OR T1589.002 OR T1589.003 OR T1594 OR T1598.003 OR T1583.001 OR T1585.002 OR T1588.002 OR T1588.004 OR T1608.005) OR threat.technique.id:(T1078 OR T1110.003 OR T1114 OR T1114.003 OR T1589.002 OR T1589.003 OR T1594 OR T1598.003 OR T1583.001 OR T1585.002 OR T1588.002 OR T1588.004 OR T1608.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Silent Librarian (G0122) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1110.003 OR T1114 OR T1114.003 OR T1589.002 OR T1589.003 OR T1594 OR T1598.003 OR T1583.001 OR T1585.002 OR T1588.002 OR T1588.004 OR T1608.005) OR threat.technique.id:(T1078 OR T1110.003 OR T1114 OR T1114.003 OR T1589.002 OR T1589.003 OR T1594 OR T1598.003 OR T1583.001 OR T1585.002 OR T1588.002 OR T1588.004 OR T1608.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Silent Librarian with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1110.003 OR T1114 OR T1114.003 OR T1589.002 OR T1589.003 OR T1594 OR T1598.003 OR T1583.001 OR T1585.002 OR T1588.002 OR T1588.004 OR T1608.005) OR threat.technique.id:(T1078 OR T1110.003 OR T1114 OR T1114.003 OR T1589.002 OR T1589.003 OR T1594 OR T1598.003 OR T1583.001 OR T1585.002 OR T1588.002 OR T1588.004 OR T1608.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1110.003\"\n[[rule.threat.technique]]\nid = \"T1114\"\n[[rule.threat.technique]]\nid = \"T1114.003\"\n[[rule.threat.technique]]\nid = \"T1589.002\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1110.003\"\n[[rule.threat.technique]]\nid = \"T1114\"\n[[rule.threat.technique]]\nid = \"T1114.003\"\n[[rule.threat.technique]]\nid = \"T1589.002\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1110.003\"\n[[rule.threat.technique]]\nid = \"T1114\"\n[[rule.threat.technique]]\nid = \"T1114.003\"\n[[rule.threat.technique]]\nid = \"T1589.002\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1110.003\"\n[[rule.threat.technique]]\nid = \"T1114\"\n[[rule.threat.technique]]\nid = \"T1114.003\"\n[[rule.threat.technique]]\nid = \"T1589.002\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0123-volatile-cedar.json b/app/playbooks/threat-groups/apt-g0123-volatile-cedar.json
new file mode 100644
index 0000000..9075c9a
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0123-volatile-cedar.json
@@ -0,0 +1,117 @@
+{
+ "id": "apt-g0123",
+ "num": 147,
+ "name": "MITRE ATT&CK Group — Volatile Cedar",
+ "fullName": "Volatile Cedar (G0123) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Volatile Cedar](https://attack.mitre.org/groups/G0123) is a Lebanese threat group that has targeted individuals, companies, and institutions worldwide. [Volatile Cedar](https://attack.mitre.org/groups/G0123) has been operating since 2012 and is motivated by political and ideological interests. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Volatile Cedar.",
+ "mitre": "T1190, T1505.003, T1105, T1595.002, T1595.003",
+ "aliases": [
+ "Volatile Cedar",
+ "Lebanese Cedar"
+ ],
+ "mitreGroupId": "G0123",
+ "mitreUrl": "https://attack.mitre.org/groups/G0123",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Volatile Cedar with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0123. Aliases: Volatile Cedar, Lebanese Cedar. Primary mapped tactics: Initial Access, Persistence, Command and Control, Reconnaissance. Mapped techniques: T1190 Exploit Public-Facing Application, T1505.003 Web Shell, T1105 Ingress Tool Transfer, T1595.002 Vulnerability Scanning, T1595.003 Wordlist Scanning. Source: https://attack.mitre.org/groups/G0123. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Volatile Cedar (G0123) ATT&CK technique pivots\n(rule.threat.technique.id:(T1190 OR T1505.003 OR T1105 OR T1595.002 OR T1595.003) OR threat.technique.id:(T1190 OR T1505.003 OR T1105 OR T1595.002 OR T1595.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Volatile Cedar (G0123) ATT&CK technique pivots\n(rule.threat.technique.id:(T1190 OR T1505.003 OR T1105 OR T1595.002 OR T1595.003) OR threat.technique.id:(T1190 OR T1505.003 OR T1105 OR T1595.002 OR T1595.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Volatile Cedar with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1190 OR T1505.003 OR T1105 OR T1595.002 OR T1595.003) OR threat.technique.id:(T1190 OR T1505.003 OR T1105 OR T1595.002 OR T1595.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1505.003\"\n[[rule.threat.technique]]\nid = \"T1105\"\n[[rule.threat.technique]]\nid = \"T1595.002\"\n[[rule.threat.technique]]\nid = \"T1595.003\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1505.003\"\n[[rule.threat.technique]]\nid = \"T1105\"\n[[rule.threat.technique]]\nid = \"T1595.002\"\n[[rule.threat.technique]]\nid = \"T1595.003\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1505.003\"\n[[rule.threat.technique]]\nid = \"T1105\"\n[[rule.threat.technique]]\nid = \"T1595.002\"\n[[rule.threat.technique]]\nid = \"T1595.003\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1505.003\"\n[[rule.threat.technique]]\nid = \"T1105\"\n[[rule.threat.technique]]\nid = \"T1595.002\"\n[[rule.threat.technique]]\nid = \"T1595.003\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0124-windigo.json b/app/playbooks/threat-groups/apt-g0124-windigo.json
new file mode 100644
index 0000000..bed4f49
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0124-windigo.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0124",
+ "num": 148,
+ "name": "MITRE ATT&CK Group — Windigo",
+ "fullName": "Windigo (G0124) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "The [Windigo](https://attack.mitre.org/groups/G0124) group has been operating since at least 2011, compromising thousands of Linux and Unix servers using the [Ebury](https://attack.mitre.org/software/S0377) SSH backdoor to create a spam botnet. Despite law enforcement intervention against the creators, [Windigo](https://attack.mitre.org/groups/G0124) operators continued updating [Ebury](https://attack.mitre.org/software/S0377) through 2019. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Windigo.",
+ "mitre": "T1189, T1059, T1082, T1083, T1518, T1005, T1090",
+ "aliases": [
+ "Windigo"
+ ],
+ "mitreGroupId": "G0124",
+ "mitreUrl": "https://attack.mitre.org/groups/G0124",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Windigo with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0124. Aliases: Windigo. Primary mapped tactics: Initial Access, Execution, Discovery, Collection, Command and Control. Mapped techniques: T1189 Drive-by Compromise, T1059 Command and Scripting Interpreter, T1082 System Information Discovery, T1083 File and Directory Discovery, T1518 Software Discovery, T1005 Data from Local System, T1090 Proxy. Source: https://attack.mitre.org/groups/G0124. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Windigo (G0124) ATT&CK technique pivots\n(rule.threat.technique.id:(T1189 OR T1059 OR T1082 OR T1083 OR T1518 OR T1005 OR T1090) OR threat.technique.id:(T1189 OR T1059 OR T1082 OR T1083 OR T1518 OR T1005 OR T1090) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Windigo (G0124) ATT&CK technique pivots\n(rule.threat.technique.id:(T1189 OR T1059 OR T1082 OR T1083 OR T1518 OR T1005 OR T1090) OR threat.technique.id:(T1189 OR T1059 OR T1082 OR T1083 OR T1518 OR T1005 OR T1090) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Windigo with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1189 OR T1059 OR T1082 OR T1083 OR T1518 OR T1005 OR T1090) OR threat.technique.id:(T1189 OR T1059 OR T1082 OR T1083 OR T1518 OR T1005 OR T1090) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1059\"\n[[rule.threat.technique]]\nid = \"T1082\"\n[[rule.threat.technique]]\nid = \"T1083\"\n[[rule.threat.technique]]\nid = \"T1518\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1059\"\n[[rule.threat.technique]]\nid = \"T1082\"\n[[rule.threat.technique]]\nid = \"T1083\"\n[[rule.threat.technique]]\nid = \"T1518\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1059\"\n[[rule.threat.technique]]\nid = \"T1082\"\n[[rule.threat.technique]]\nid = \"T1083\"\n[[rule.threat.technique]]\nid = \"T1518\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1059\"\n[[rule.threat.technique]]\nid = \"T1082\"\n[[rule.threat.technique]]\nid = \"T1083\"\n[[rule.threat.technique]]\nid = \"T1518\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0125-hafnium.json b/app/playbooks/threat-groups/apt-g0125-hafnium.json
new file mode 100644
index 0000000..39bf27e
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0125-hafnium.json
@@ -0,0 +1,118 @@
+{
+ "id": "apt-g0125",
+ "num": 149,
+ "name": "MITRE ATT&CK Group — HAFNIUM",
+ "fullName": "HAFNIUM (G0125) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[HAFNIUM](https://attack.mitre.org/groups/G0125) is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. [HAFNIUM](https://attack.mitre.org/groups/G0125) primarily targets entities in the US across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. [HAFNIUM](https://attack.mitre.org/groups/G0125) has targeted remote management tools and cloud software for intial access and has demonstrated an ability to quickly operationalize exploits for identified vulnerabilities in edge devices. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with HAFNIUM.",
+ "mitre": "T1078.003, T1078.004, T1190, T1199, T1059.001, T1059.003, T1098, T1136.002, T1505.003, T1068, T1003.001, T1003.003, T1110.003, T1555.006, T1016, T1016.001, T1018, T1033, T1057, T1083, T1550.001, T1005, T1114.002, T1119",
+ "aliases": [
+ "HAFNIUM",
+ "Operation Exchange Marauder",
+ "Silk Typhoon"
+ ],
+ "mitreGroupId": "G0125",
+ "mitreUrl": "https://attack.mitre.org/groups/G0125",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile HAFNIUM with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0125. Aliases: HAFNIUM, Operation Exchange Marauder, Silk Typhoon. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Defense Impairment, Reconnaissance, Resource Development, Stealth. Mapped techniques: T1078.003 Local Accounts, T1078.004 Cloud Accounts, T1190 Exploit Public-Facing Application, T1199 Trusted Relationship, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1098 Account Manipulation, T1136.002 Domain Account, T1505.003 Web Shell, T1068 Exploitation for Privilege Escalation, T1003.001 LSASS Memory, T1003.003 NTDS, plus 32 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0125. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - HAFNIUM (G0125) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078.003 OR T1078.004 OR T1190 OR T1199 OR T1059.001 OR T1059.003 OR T1098 OR T1136.002 OR T1505.003 OR T1068 OR T1003.001 OR T1003.003 OR T1110.003 OR T1555.006 OR T1016 OR T1016.001 OR T1018 OR T1033 OR T1057 OR T1083) OR threat.technique.id:(T1078.003 OR T1078.004 OR T1190 OR T1199 OR T1059.001 OR T1059.003 OR T1098 OR T1136.002 OR T1505.003 OR T1068 OR T1003.001 OR T1003.003 OR T1110.003 OR T1555.006 OR T1016 OR T1016.001 OR T1018 OR T1033 OR T1057 OR T1083) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - HAFNIUM (G0125) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078.003 OR T1078.004 OR T1190 OR T1199 OR T1059.001 OR T1059.003 OR T1098 OR T1136.002 OR T1505.003 OR T1068 OR T1003.001 OR T1003.003 OR T1110.003 OR T1555.006 OR T1016 OR T1016.001 OR T1018 OR T1033 OR T1057 OR T1083) OR threat.technique.id:(T1078.003 OR T1078.004 OR T1190 OR T1199 OR T1059.001 OR T1059.003 OR T1098 OR T1136.002 OR T1505.003 OR T1068 OR T1003.001 OR T1003.003 OR T1110.003 OR T1555.006 OR T1016 OR T1016.001 OR T1018 OR T1033 OR T1057 OR T1083) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile HAFNIUM with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078.003 OR T1078.004 OR T1190 OR T1199 OR T1059.001 OR T1059.003 OR T1098 OR T1136.002 OR T1505.003 OR T1068 OR T1003.001 OR T1003.003 OR T1110.003 OR T1555.006 OR T1016 OR T1016.001 OR T1018 OR T1033 OR T1057 OR T1083) OR threat.technique.id:(T1078.003 OR T1078.004 OR T1190 OR T1199 OR T1059.001 OR T1059.003 OR T1098 OR T1136.002 OR T1505.003 OR T1068 OR T1003.001 OR T1003.003 OR T1110.003 OR T1555.006 OR T1016 OR T1016.001 OR T1018 OR T1033 OR T1057 OR T1083) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1078.004\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1199\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1078.004\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1199\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1078.004\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1199\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1078.004\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1199\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0126-higaisa.json b/app/playbooks/threat-groups/apt-g0126-higaisa.json
new file mode 100644
index 0000000..b8a6e98
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0126-higaisa.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0126",
+ "num": 150,
+ "name": "MITRE ATT&CK Group — Higaisa",
+ "fullName": "Higaisa (G0126) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Higaisa](https://attack.mitre.org/groups/G0126) is a threat group suspected to have South Korean origins. [Higaisa](https://attack.mitre.org/groups/G0126) has targeted government, public, and trade organizations in North Korea; however, they have also carried out attacks in China, Japan, Russia, Poland, and other nations. [Higaisa](https://attack.mitre.org/groups/G0126) was first disclosed in early 2019 but is assessed to have operated as early as 2009. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Higaisa.",
+ "mitre": "T1566.001, T1053.005, T1059.003, T1059.005, T1059.007, T1106, T1203, T1204.002, T1574.001, T1547.001, T1016, T1057, T1082, T1124, T1680, T1001.003, T1071.001, T1090.001, T1573.001, T1029, T1041, T1027.001, T1027.013, T1027.015",
+ "aliases": [
+ "Higaisa"
+ ],
+ "mitreGroupId": "G0126",
+ "mitreUrl": "https://attack.mitre.org/groups/G0126",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Higaisa with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0126. Aliases: Higaisa. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Discovery, Command and Control, Exfiltration, Stealth. Mapped techniques: T1566.001 Spearphishing Attachment, T1053.005 Scheduled Task, T1059.003 Windows Command Shell, T1059.005 Visual Basic, T1059.007 JavaScript, T1106 Native API, T1203 Exploitation for Client Execution, T1204.002 Malicious File, T1574.001 DLL, T1547.001 Registry Run Keys / Startup Folder, T1016 System Network Configuration Discovery, T1057 Process Discovery, plus 16 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0126. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Higaisa (G0126) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1053.005 OR T1059.003 OR T1059.005 OR T1059.007 OR T1106 OR T1203 OR T1204.002 OR T1574.001 OR T1547.001 OR T1016 OR T1057 OR T1082 OR T1124 OR T1680 OR T1001.003 OR T1071.001 OR T1090.001 OR T1573.001 OR T1029) OR threat.technique.id:(T1566.001 OR T1053.005 OR T1059.003 OR T1059.005 OR T1059.007 OR T1106 OR T1203 OR T1204.002 OR T1574.001 OR T1547.001 OR T1016 OR T1057 OR T1082 OR T1124 OR T1680 OR T1001.003 OR T1071.001 OR T1090.001 OR T1573.001 OR T1029) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Higaisa (G0126) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1053.005 OR T1059.003 OR T1059.005 OR T1059.007 OR T1106 OR T1203 OR T1204.002 OR T1574.001 OR T1547.001 OR T1016 OR T1057 OR T1082 OR T1124 OR T1680 OR T1001.003 OR T1071.001 OR T1090.001 OR T1573.001 OR T1029) OR threat.technique.id:(T1566.001 OR T1053.005 OR T1059.003 OR T1059.005 OR T1059.007 OR T1106 OR T1203 OR T1204.002 OR T1574.001 OR T1547.001 OR T1016 OR T1057 OR T1082 OR T1124 OR T1680 OR T1001.003 OR T1071.001 OR T1090.001 OR T1573.001 OR T1029) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Higaisa with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1566.001 OR T1053.005 OR T1059.003 OR T1059.005 OR T1059.007 OR T1106 OR T1203 OR T1204.002 OR T1574.001 OR T1547.001 OR T1016 OR T1057 OR T1082 OR T1124 OR T1680 OR T1001.003 OR T1071.001 OR T1090.001 OR T1573.001 OR T1029) OR threat.technique.id:(T1566.001 OR T1053.005 OR T1059.003 OR T1059.005 OR T1059.007 OR T1106 OR T1203 OR T1204.002 OR T1574.001 OR T1547.001 OR T1016 OR T1057 OR T1082 OR T1124 OR T1680 OR T1001.003 OR T1071.001 OR T1090.001 OR T1573.001 OR T1029) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1059.007\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1059.007\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1059.007\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1059.007\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0127-ta551.json b/app/playbooks/threat-groups/apt-g0127-ta551.json
new file mode 100644
index 0000000..3af6d0b
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0127-ta551.json
@@ -0,0 +1,118 @@
+{
+ "id": "apt-g0127",
+ "num": 151,
+ "name": "MITRE ATT&CK Group — TA551",
+ "fullName": "TA551 (G0127) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[TA551](https://attack.mitre.org/groups/G0127) is a financially-motivated threat group that has been active since at least 2018. The group has primarily targeted English, German, Italian, and Japanese speakers through email-based malware distribution campaigns. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with TA551.",
+ "mitre": "T1566.001, T1059.003, T1204.002, T1071.001, T1105, T1132.001, T1568.002, T1589.002, T1027.003, T1027.010, T1036, T1218.005, T1218.010, T1218.011",
+ "aliases": [
+ "TA551",
+ "GOLD CABIN",
+ "Shathak"
+ ],
+ "mitreGroupId": "G0127",
+ "mitreUrl": "https://attack.mitre.org/groups/G0127",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile TA551 with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0127. Aliases: TA551, GOLD CABIN, Shathak. Primary mapped tactics: Initial Access, Execution, Command and Control, Reconnaissance, Stealth. Mapped techniques: T1566.001 Spearphishing Attachment, T1059.003 Windows Command Shell, T1204.002 Malicious File, T1071.001 Web Protocols, T1105 Ingress Tool Transfer, T1132.001 Standard Encoding, T1568.002 Domain Generation Algorithms, T1589.002 Email Addresses, T1027.003 Steganography, T1027.010 Command Obfuscation, T1036 Masquerading, T1218.005 Mshta, plus 2 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0127. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - TA551 (G0127) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1059.003 OR T1204.002 OR T1071.001 OR T1105 OR T1132.001 OR T1568.002 OR T1589.002 OR T1027.003 OR T1027.010 OR T1036 OR T1218.005 OR T1218.010 OR T1218.011) OR threat.technique.id:(T1566.001 OR T1059.003 OR T1204.002 OR T1071.001 OR T1105 OR T1132.001 OR T1568.002 OR T1589.002 OR T1027.003 OR T1027.010 OR T1036 OR T1218.005 OR T1218.010 OR T1218.011) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - TA551 (G0127) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1059.003 OR T1204.002 OR T1071.001 OR T1105 OR T1132.001 OR T1568.002 OR T1589.002 OR T1027.003 OR T1027.010 OR T1036 OR T1218.005 OR T1218.010 OR T1218.011) OR threat.technique.id:(T1566.001 OR T1059.003 OR T1204.002 OR T1071.001 OR T1105 OR T1132.001 OR T1568.002 OR T1589.002 OR T1027.003 OR T1027.010 OR T1036 OR T1218.005 OR T1218.010 OR T1218.011) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile TA551 with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1566.001 OR T1059.003 OR T1204.002 OR T1071.001 OR T1105 OR T1132.001 OR T1568.002 OR T1589.002 OR T1027.003 OR T1027.010 OR T1036 OR T1218.005 OR T1218.010 OR T1218.011) OR threat.technique.id:(T1566.001 OR T1059.003 OR T1204.002 OR T1071.001 OR T1105 OR T1132.001 OR T1568.002 OR T1589.002 OR T1027.003 OR T1027.010 OR T1036 OR T1218.005 OR T1218.010 OR T1218.011) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1071.001\"\n[[rule.threat.technique]]\nid = \"T1105\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1071.001\"\n[[rule.threat.technique]]\nid = \"T1105\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1071.001\"\n[[rule.threat.technique]]\nid = \"T1105\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1071.001\"\n[[rule.threat.technique]]\nid = \"T1105\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0128-zirconium.json b/app/playbooks/threat-groups/apt-g0128-zirconium.json
new file mode 100644
index 0000000..b51c3ba
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0128-zirconium.json
@@ -0,0 +1,118 @@
+{
+ "id": "apt-g0128",
+ "num": 152,
+ "name": "MITRE ATT&CK Group — ZIRCONIUM",
+ "fullName": "ZIRCONIUM (G0128) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[ZIRCONIUM](https://attack.mitre.org/groups/G0128) is a threat group operating out of China, active since at least 2017, that has targeted individuals associated with the 2020 US presidential election and prominent leaders in the international affairs community. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with ZIRCONIUM.",
+ "mitre": "T1566.002, T1059.003, T1059.006, T1204.001, T1547.001, T1068, T1555.003, T1012, T1016, T1033, T1082, T1124, T1090.003, T1102.002, T1105, T1573.001, T1665, T1041, T1567.002, T1598, T1598.003, T1583.001, T1583.006, T1584.008",
+ "aliases": [
+ "ZIRCONIUM",
+ "APT31",
+ "Violet Typhoon"
+ ],
+ "mitreGroupId": "G0128",
+ "mitreUrl": "https://attack.mitre.org/groups/G0128",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile ZIRCONIUM with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0128. Aliases: ZIRCONIUM, APT31, Violet Typhoon. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Command and Control, Exfiltration, Reconnaissance, Resource Development, Stealth. Mapped techniques: T1566.002 Spearphishing Link, T1059.003 Windows Command Shell, T1059.006 Python, T1204.001 Malicious Link, T1547.001 Registry Run Keys / Startup Folder, T1068 Exploitation for Privilege Escalation, T1555.003 Credentials from Web Browsers, T1012 Query Registry, T1016 System Network Configuration Discovery, T1033 System Owner/User Discovery, T1082 System Information Discovery, T1124 System Time Discovery, plus 17 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0128. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - ZIRCONIUM (G0128) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.002 OR T1059.003 OR T1059.006 OR T1204.001 OR T1547.001 OR T1068 OR T1555.003 OR T1012 OR T1016 OR T1033 OR T1082 OR T1124 OR T1090.003 OR T1102.002 OR T1105 OR T1573.001 OR T1665 OR T1041 OR T1567.002 OR T1598) OR threat.technique.id:(T1566.002 OR T1059.003 OR T1059.006 OR T1204.001 OR T1547.001 OR T1068 OR T1555.003 OR T1012 OR T1016 OR T1033 OR T1082 OR T1124 OR T1090.003 OR T1102.002 OR T1105 OR T1573.001 OR T1665 OR T1041 OR T1567.002 OR T1598) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - ZIRCONIUM (G0128) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.002 OR T1059.003 OR T1059.006 OR T1204.001 OR T1547.001 OR T1068 OR T1555.003 OR T1012 OR T1016 OR T1033 OR T1082 OR T1124 OR T1090.003 OR T1102.002 OR T1105 OR T1573.001 OR T1665 OR T1041 OR T1567.002 OR T1598) OR threat.technique.id:(T1566.002 OR T1059.003 OR T1059.006 OR T1204.001 OR T1547.001 OR T1068 OR T1555.003 OR T1012 OR T1016 OR T1033 OR T1082 OR T1124 OR T1090.003 OR T1102.002 OR T1105 OR T1573.001 OR T1665 OR T1041 OR T1567.002 OR T1598) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile ZIRCONIUM with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1566.002 OR T1059.003 OR T1059.006 OR T1204.001 OR T1547.001 OR T1068 OR T1555.003 OR T1012 OR T1016 OR T1033 OR T1082 OR T1124 OR T1090.003 OR T1102.002 OR T1105 OR T1573.001 OR T1665 OR T1041 OR T1567.002 OR T1598) OR threat.technique.id:(T1566.002 OR T1059.003 OR T1059.006 OR T1204.001 OR T1547.001 OR T1068 OR T1555.003 OR T1012 OR T1016 OR T1033 OR T1082 OR T1124 OR T1090.003 OR T1102.002 OR T1105 OR T1573.001 OR T1665 OR T1041 OR T1567.002 OR T1598) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.006\"\n[[rule.threat.technique]]\nid = \"T1204.001\"\n[[rule.threat.technique]]\nid = \"T1547.001\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.006\"\n[[rule.threat.technique]]\nid = \"T1204.001\"\n[[rule.threat.technique]]\nid = \"T1547.001\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.006\"\n[[rule.threat.technique]]\nid = \"T1204.001\"\n[[rule.threat.technique]]\nid = \"T1547.001\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.006\"\n[[rule.threat.technique]]\nid = \"T1204.001\"\n[[rule.threat.technique]]\nid = \"T1547.001\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0129-mustang-panda.json b/app/playbooks/threat-groups/apt-g0129-mustang-panda.json
new file mode 100644
index 0000000..2be81cd
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0129-mustang-panda.json
@@ -0,0 +1,131 @@
+{
+ "id": "apt-g0129",
+ "num": 153,
+ "name": "MITRE ATT&CK Group — Mustang Panda",
+ "fullName": "Mustang Panda (G0129) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Mustang Panda](https://attack.mitre.org/groups/G0129) is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. [Mustang Panda](https://attack.mitre.org/groups/G0129) has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. [Mustang Panda](https://attack.mitre.org/groups/G0129) has targeted government, diplomatic, and non-governmental organizations, including think tanks, religious institutions, and research entities, across the United States, Europe, and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan, and Vietnam. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Mustang Panda.",
+ "mitre": "T1091, T1566.001, T1566.002, T1047, T1053.005, T1059, T1059.001, T1059.003, T1059.005, T1059.007, T1072, T1106, T1129, T1203, T1204.001, T1204.002, T1574.001, T1574.005, T1176.002, T1205, T1505.003, T1546.003, T1547.001, T1003",
+ "aliases": [
+ "Mustang Panda",
+ "TA416",
+ "RedDelta",
+ "BRONZE PRESIDENT",
+ "STATELY TAURUS",
+ "FIREANT",
+ "CAMARO DRAGON",
+ "EARTH PRETA",
+ "HIVE0154",
+ "TWILL TYPHOON",
+ "TANTALUM",
+ "LUMINOUS MOTH",
+ "UNC6384",
+ "TEMP.Hex",
+ "Red Lich",
+ "ClumsyToad"
+ ],
+ "mitreGroupId": "G0129",
+ "mitreUrl": "https://attack.mitre.org/groups/G0129",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Mustang Panda with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0129. Aliases: Mustang Panda, TA416, RedDelta, BRONZE PRESIDENT, STATELY TAURUS, FIREANT, CAMARO DRAGON, EARTH PRETA, HIVE0154, TWILL TYPHOON, TANTALUM, LUMINOUS MOTH. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Defense Impairment, Reconnaissance, Resource Development, Stealth. Mapped techniques: T1091 Replication Through Removable Media, T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link, T1047 Windows Management Instrumentation, T1053.005 Scheduled Task, T1059 Command and Scripting Interpreter, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1059.005 Visual Basic, T1059.007 JavaScript, T1072 Software Deployment Tools, T1106 Native API, plus 73 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0129. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Mustang Panda (G0129) ATT&CK technique pivots\n(rule.threat.technique.id:(T1091 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1072 OR T1106 OR T1129 OR T1203 OR T1204.001 OR T1204.002 OR T1574.001 OR T1574.005 OR T1176.002 OR T1205) OR threat.technique.id:(T1091 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1072 OR T1106 OR T1129 OR T1203 OR T1204.001 OR T1204.002 OR T1574.001 OR T1574.005 OR T1176.002 OR T1205) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Mustang Panda (G0129) ATT&CK technique pivots\n(rule.threat.technique.id:(T1091 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1072 OR T1106 OR T1129 OR T1203 OR T1204.001 OR T1204.002 OR T1574.001 OR T1574.005 OR T1176.002 OR T1205) OR threat.technique.id:(T1091 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1072 OR T1106 OR T1129 OR T1203 OR T1204.001 OR T1204.002 OR T1574.001 OR T1574.005 OR T1176.002 OR T1205) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Mustang Panda with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1091 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1072 OR T1106 OR T1129 OR T1203 OR T1204.001 OR T1204.002 OR T1574.001 OR T1574.005 OR T1176.002 OR T1205) OR threat.technique.id:(T1091 OR T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1072 OR T1106 OR T1129 OR T1203 OR T1204.001 OR T1204.002 OR T1574.001 OR T1574.005 OR T1176.002 OR T1205) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1091\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1091\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1091\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1091\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0130-ajax-security-team.json b/app/playbooks/threat-groups/apt-g0130-ajax-security-team.json
new file mode 100644
index 0000000..23a9001
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0130-ajax-security-team.json
@@ -0,0 +1,121 @@
+{
+ "id": "apt-g0130",
+ "num": 154,
+ "name": "MITRE ATT&CK Group — Ajax Security Team",
+ "fullName": "Ajax Security Team (G0130) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Ajax Security Team](https://attack.mitre.org/groups/G0130) is a group that has been active since at least 2010 and believed to be operating out of Iran. By 2014 [Ajax Security Team](https://attack.mitre.org/groups/G0130) transitioned from website defacement operations to malware-based cyber espionage campaigns targeting the US defense industrial base and Iranian users of anti-censorship technologies. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Ajax Security Team.",
+ "mitre": "T1566.001, T1566.003, T1204.002, T1056.001, T1555.003, T1105",
+ "aliases": [
+ "Ajax Security Team",
+ "Operation Woolen-Goldfish",
+ "AjaxTM",
+ "Rocket Kitten",
+ "Flying Kitten",
+ "Operation Saffron Rose"
+ ],
+ "mitreGroupId": "G0130",
+ "mitreUrl": "https://attack.mitre.org/groups/G0130",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Ajax Security Team with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0130. Aliases: Ajax Security Team, Operation Woolen-Goldfish, AjaxTM, Rocket Kitten, Flying Kitten, Operation Saffron Rose. Primary mapped tactics: Initial Access, Execution, Credential Access, Collection, Command and Control. Mapped techniques: T1566.001 Spearphishing Attachment, T1566.003 Spearphishing via Service, T1204.002 Malicious File, T1056.001 Keylogging, T1555.003 Credentials from Web Browsers, T1105 Ingress Tool Transfer. Source: https://attack.mitre.org/groups/G0130. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Ajax Security Team (G0130) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1566.003 OR T1204.002 OR T1056.001 OR T1555.003 OR T1105) OR threat.technique.id:(T1566.001 OR T1566.003 OR T1204.002 OR T1056.001 OR T1555.003 OR T1105) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Ajax Security Team (G0130) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1566.003 OR T1204.002 OR T1056.001 OR T1555.003 OR T1105) OR threat.technique.id:(T1566.001 OR T1566.003 OR T1204.002 OR T1056.001 OR T1555.003 OR T1105) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Ajax Security Team with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1566.001 OR T1566.003 OR T1204.002 OR T1056.001 OR T1555.003 OR T1105) OR threat.technique.id:(T1566.001 OR T1566.003 OR T1204.002 OR T1056.001 OR T1555.003 OR T1105) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.003\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1056.001\"\n[[rule.threat.technique]]\nid = \"T1555.003\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.003\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1056.001\"\n[[rule.threat.technique]]\nid = \"T1555.003\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.003\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1056.001\"\n[[rule.threat.technique]]\nid = \"T1555.003\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.003\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1056.001\"\n[[rule.threat.technique]]\nid = \"T1555.003\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0131-tonto-team.json b/app/playbooks/threat-groups/apt-g0131-tonto-team.json
new file mode 100644
index 0000000..2bce248
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0131-tonto-team.json
@@ -0,0 +1,120 @@
+{
+ "id": "apt-g0131",
+ "num": 155,
+ "name": "MITRE ATT&CK Group — Tonto Team",
+ "fullName": "Tonto Team (G0131) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Tonto Team](https://attack.mitre.org/groups/G0131) is a suspected Chinese state-sponsored cyber espionage threat group that has primarily targeted South Korea, Japan, Taiwan, and the United States since at least 2009; by 2020 they expanded operations to include other Asian as well as Eastern European countries. [Tonto Team](https://attack.mitre.org/groups/G0131) has targeted government, military, energy, mining, financial, education, healthcare, and technology organizations, including through the Heartbeat Campaign (2009-2012) and Operation Bitter Biscuit (2017). This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Tonto Team.",
+ "mitre": "T1566.001, T1059.001, T1059.006, T1203, T1204.002, T1574.001, T1505.003, T1068, T1003, T1056.001, T1069.001, T1135, T1210, T1090.002, T1105",
+ "aliases": [
+ "Tonto Team",
+ "Earth Akhlut",
+ "BRONZE HUNTLEY",
+ "CactusPete",
+ "Karma Panda"
+ ],
+ "mitreGroupId": "G0131",
+ "mitreUrl": "https://attack.mitre.org/groups/G0131",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Tonto Team with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0131. Aliases: Tonto Team, Earth Akhlut, BRONZE HUNTLEY, CactusPete, Karma Panda. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Stealth. Mapped techniques: T1566.001 Spearphishing Attachment, T1059.001 PowerShell, T1059.006 Python, T1203 Exploitation for Client Execution, T1204.002 Malicious File, T1574.001 DLL, T1505.003 Web Shell, T1068 Exploitation for Privilege Escalation, T1003 OS Credential Dumping, T1056.001 Keylogging, T1069.001 Local Groups, T1135 Network Share Discovery, plus 3 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0131. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Tonto Team (G0131) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1059.001 OR T1059.006 OR T1203 OR T1204.002 OR T1574.001 OR T1505.003 OR T1068 OR T1003 OR T1056.001 OR T1069.001 OR T1135 OR T1210 OR T1090.002 OR T1105) OR threat.technique.id:(T1566.001 OR T1059.001 OR T1059.006 OR T1203 OR T1204.002 OR T1574.001 OR T1505.003 OR T1068 OR T1003 OR T1056.001 OR T1069.001 OR T1135 OR T1210 OR T1090.002 OR T1105) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Tonto Team (G0131) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1059.001 OR T1059.006 OR T1203 OR T1204.002 OR T1574.001 OR T1505.003 OR T1068 OR T1003 OR T1056.001 OR T1069.001 OR T1135 OR T1210 OR T1090.002 OR T1105) OR threat.technique.id:(T1566.001 OR T1059.001 OR T1059.006 OR T1203 OR T1204.002 OR T1574.001 OR T1505.003 OR T1068 OR T1003 OR T1056.001 OR T1069.001 OR T1135 OR T1210 OR T1090.002 OR T1105) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Tonto Team with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1566.001 OR T1059.001 OR T1059.006 OR T1203 OR T1204.002 OR T1574.001 OR T1505.003 OR T1068 OR T1003 OR T1056.001 OR T1069.001 OR T1135 OR T1210 OR T1090.002 OR T1105) OR threat.technique.id:(T1566.001 OR T1059.001 OR T1059.006 OR T1203 OR T1204.002 OR T1574.001 OR T1505.003 OR T1068 OR T1003 OR T1056.001 OR T1069.001 OR T1135 OR T1210 OR T1090.002 OR T1105) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.006\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.002\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.006\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.002\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.006\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.002\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.006\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.002\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0133-nomadic-octopus.json b/app/playbooks/threat-groups/apt-g0133-nomadic-octopus.json
new file mode 100644
index 0000000..f17ca38
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0133-nomadic-octopus.json
@@ -0,0 +1,117 @@
+{
+ "id": "apt-g0133",
+ "num": 156,
+ "name": "MITRE ATT&CK Group — Nomadic Octopus",
+ "fullName": "Nomadic Octopus (G0133) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Nomadic Octopus](https://attack.mitre.org/groups/G0133) is a Russian-speaking cyber espionage threat group that has primarily targeted Central Asia, including local governments, diplomatic missions, and individuals, since at least 2014. [Nomadic Octopus](https://attack.mitre.org/groups/G0133) has been observed conducting campaigns involving Android and Windows malware, mainly using the Delphi programming language, and building custom variants. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Nomadic Octopus.",
+ "mitre": "T1566.001, T1059.001, T1059.003, T1204.002, T1105, T1036, T1564.003",
+ "aliases": [
+ "Nomadic Octopus",
+ "DustSquad"
+ ],
+ "mitreGroupId": "G0133",
+ "mitreUrl": "https://attack.mitre.org/groups/G0133",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Nomadic Octopus with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0133. Aliases: Nomadic Octopus, DustSquad. Primary mapped tactics: Initial Access, Execution, Command and Control, Stealth. Mapped techniques: T1566.001 Spearphishing Attachment, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1204.002 Malicious File, T1105 Ingress Tool Transfer, T1036 Masquerading, T1564.003 Hidden Window. Source: https://attack.mitre.org/groups/G0133. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Nomadic Octopus (G0133) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1059.001 OR T1059.003 OR T1204.002 OR T1105 OR T1036 OR T1564.003) OR threat.technique.id:(T1566.001 OR T1059.001 OR T1059.003 OR T1204.002 OR T1105 OR T1036 OR T1564.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Nomadic Octopus (G0133) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1059.001 OR T1059.003 OR T1204.002 OR T1105 OR T1036 OR T1564.003) OR threat.technique.id:(T1566.001 OR T1059.001 OR T1059.003 OR T1204.002 OR T1105 OR T1036 OR T1564.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Nomadic Octopus with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1566.001 OR T1059.001 OR T1059.003 OR T1204.002 OR T1105 OR T1036 OR T1564.003) OR threat.technique.id:(T1566.001 OR T1059.001 OR T1059.003 OR T1204.002 OR T1105 OR T1036 OR T1564.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1105\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1105\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1105\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1105\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0134-transparent-tribe.json b/app/playbooks/threat-groups/apt-g0134-transparent-tribe.json
new file mode 100644
index 0000000..37c93f8
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0134-transparent-tribe.json
@@ -0,0 +1,120 @@
+{
+ "id": "apt-g0134",
+ "num": 157,
+ "name": "MITRE ATT&CK Group — Transparent Tribe",
+ "fullName": "Transparent Tribe (G0134) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Transparent Tribe](https://attack.mitre.org/groups/G0134) is a suspected Pakistan-based threat group that has been active since at least 2013, primarily targeting diplomatic, defense, and research organizations in India and Afghanistan. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Transparent Tribe.",
+ "mitre": "T1189, T1566.001, T1566.002, T1059.005, T1203, T1204.001, T1204.002, T1568, T1583.001, T1584.001, T1608.004, T1027.013, T1036.005, T1564.001",
+ "aliases": [
+ "Transparent Tribe",
+ "COPPER FIELDSTONE",
+ "APT36",
+ "Mythic Leopard",
+ "ProjectM"
+ ],
+ "mitreGroupId": "G0134",
+ "mitreUrl": "https://attack.mitre.org/groups/G0134",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Transparent Tribe with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0134. Aliases: Transparent Tribe, COPPER FIELDSTONE, APT36, Mythic Leopard, ProjectM. Primary mapped tactics: Initial Access, Execution, Command and Control, Resource Development, Stealth. Mapped techniques: T1189 Drive-by Compromise, T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link, T1059.005 Visual Basic, T1203 Exploitation for Client Execution, T1204.001 Malicious Link, T1204.002 Malicious File, T1568 Dynamic Resolution, T1583.001 Domains, T1584.001 Domains, T1608.004 Drive-by Target, T1027.013 Encrypted/Encoded File, plus 2 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0134. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Transparent Tribe (G0134) ATT&CK technique pivots\n(rule.threat.technique.id:(T1189 OR T1566.001 OR T1566.002 OR T1059.005 OR T1203 OR T1204.001 OR T1204.002 OR T1568 OR T1583.001 OR T1584.001 OR T1608.004 OR T1027.013 OR T1036.005 OR T1564.001) OR threat.technique.id:(T1189 OR T1566.001 OR T1566.002 OR T1059.005 OR T1203 OR T1204.001 OR T1204.002 OR T1568 OR T1583.001 OR T1584.001 OR T1608.004 OR T1027.013 OR T1036.005 OR T1564.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Transparent Tribe (G0134) ATT&CK technique pivots\n(rule.threat.technique.id:(T1189 OR T1566.001 OR T1566.002 OR T1059.005 OR T1203 OR T1204.001 OR T1204.002 OR T1568 OR T1583.001 OR T1584.001 OR T1608.004 OR T1027.013 OR T1036.005 OR T1564.001) OR threat.technique.id:(T1189 OR T1566.001 OR T1566.002 OR T1059.005 OR T1203 OR T1204.001 OR T1204.002 OR T1568 OR T1583.001 OR T1584.001 OR T1608.004 OR T1027.013 OR T1036.005 OR T1564.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Transparent Tribe with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1189 OR T1566.001 OR T1566.002 OR T1059.005 OR T1203 OR T1204.001 OR T1204.002 OR T1568 OR T1583.001 OR T1584.001 OR T1608.004 OR T1027.013 OR T1036.005 OR T1564.001) OR threat.technique.id:(T1189 OR T1566.001 OR T1566.002 OR T1059.005 OR T1203 OR T1204.001 OR T1204.002 OR T1568 OR T1583.001 OR T1584.001 OR T1608.004 OR T1027.013 OR T1036.005 OR T1564.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1203\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1203\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1203\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1203\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0135-backdoordiplomacy.json b/app/playbooks/threat-groups/apt-g0135-backdoordiplomacy.json
new file mode 100644
index 0000000..8974de9
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0135-backdoordiplomacy.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0135",
+ "num": 158,
+ "name": "MITRE ATT&CK Group — BackdoorDiplomacy",
+ "fullName": "BackdoorDiplomacy (G0135) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[BackdoorDiplomacy](https://attack.mitre.org/groups/G0135) is a cyber espionage threat group that has been active since at least 2017. [BackdoorDiplomacy](https://attack.mitre.org/groups/G0135) has targeted Ministries of Foreign Affairs and telecommunication companies in Africa, Europe, the Middle East, and Asia. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with BackdoorDiplomacy.",
+ "mitre": "T1190, T1574.001, T1505.003, T1055.001, T1046, T1049, T1120, T1074.001, T1095, T1105, T1588.001, T1588.002, T1027, T1036.004, T1036.005",
+ "aliases": [
+ "BackdoorDiplomacy"
+ ],
+ "mitreGroupId": "G0135",
+ "mitreUrl": "https://attack.mitre.org/groups/G0135",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile BackdoorDiplomacy with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0135. Aliases: BackdoorDiplomacy. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Discovery, Collection, Command and Control, Resource Development, Stealth. Mapped techniques: T1190 Exploit Public-Facing Application, T1574.001 DLL, T1505.003 Web Shell, T1055.001 Dynamic-link Library Injection, T1046 Network Service Discovery, T1049 System Network Connections Discovery, T1120 Peripheral Device Discovery, T1074.001 Local Data Staging, T1095 Non-Application Layer Protocol, T1105 Ingress Tool Transfer, T1588.001 Malware, T1588.002 Tool, plus 3 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0135. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - BackdoorDiplomacy (G0135) ATT&CK technique pivots\n(rule.threat.technique.id:(T1190 OR T1574.001 OR T1505.003 OR T1055.001 OR T1046 OR T1049 OR T1120 OR T1074.001 OR T1095 OR T1105 OR T1588.001 OR T1588.002 OR T1027 OR T1036.004 OR T1036.005) OR threat.technique.id:(T1190 OR T1574.001 OR T1505.003 OR T1055.001 OR T1046 OR T1049 OR T1120 OR T1074.001 OR T1095 OR T1105 OR T1588.001 OR T1588.002 OR T1027 OR T1036.004 OR T1036.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - BackdoorDiplomacy (G0135) ATT&CK technique pivots\n(rule.threat.technique.id:(T1190 OR T1574.001 OR T1505.003 OR T1055.001 OR T1046 OR T1049 OR T1120 OR T1074.001 OR T1095 OR T1105 OR T1588.001 OR T1588.002 OR T1027 OR T1036.004 OR T1036.005) OR threat.technique.id:(T1190 OR T1574.001 OR T1505.003 OR T1055.001 OR T1046 OR T1049 OR T1120 OR T1074.001 OR T1095 OR T1105 OR T1588.001 OR T1588.002 OR T1027 OR T1036.004 OR T1036.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile BackdoorDiplomacy with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1190 OR T1574.001 OR T1505.003 OR T1055.001 OR T1046 OR T1049 OR T1120 OR T1074.001 OR T1095 OR T1105 OR T1588.001 OR T1588.002 OR T1027 OR T1036.004 OR T1036.005) OR threat.technique.id:(T1190 OR T1574.001 OR T1505.003 OR T1055.001 OR T1046 OR T1049 OR T1120 OR T1074.001 OR T1095 OR T1105 OR T1588.001 OR T1588.002 OR T1027 OR T1036.004 OR T1036.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1574.001\"\n[[rule.threat.technique]]\nid = \"T1505.003\"\n[[rule.threat.technique]]\nid = \"T1055.001\"\n[[rule.threat.technique]]\nid = \"T1046\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1574.001\"\n[[rule.threat.technique]]\nid = \"T1505.003\"\n[[rule.threat.technique]]\nid = \"T1055.001\"\n[[rule.threat.technique]]\nid = \"T1046\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1574.001\"\n[[rule.threat.technique]]\nid = \"T1505.003\"\n[[rule.threat.technique]]\nid = \"T1055.001\"\n[[rule.threat.technique]]\nid = \"T1046\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1574.001\"\n[[rule.threat.technique]]\nid = \"T1505.003\"\n[[rule.threat.technique]]\nid = \"T1055.001\"\n[[rule.threat.technique]]\nid = \"T1046\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0136-indigozebra.json b/app/playbooks/threat-groups/apt-g0136-indigozebra.json
new file mode 100644
index 0000000..b4be067
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0136-indigozebra.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0136",
+ "num": 159,
+ "name": "MITRE ATT&CK Group — IndigoZebra",
+ "fullName": "IndigoZebra (G0136) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[IndigoZebra](https://attack.mitre.org/groups/G0136) is a suspected Chinese cyber espionage group that has been targeting Central Asian governments since at least 2014. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with IndigoZebra.",
+ "mitre": "T1566.001, T1204.002, T1105, T1583.001, T1583.006, T1586.002, T1588.002",
+ "aliases": [
+ "IndigoZebra"
+ ],
+ "mitreGroupId": "G0136",
+ "mitreUrl": "https://attack.mitre.org/groups/G0136",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile IndigoZebra with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0136. Aliases: IndigoZebra. Primary mapped tactics: Initial Access, Execution, Command and Control, Resource Development. Mapped techniques: T1566.001 Spearphishing Attachment, T1204.002 Malicious File, T1105 Ingress Tool Transfer, T1583.001 Domains, T1583.006 Web Services, T1586.002 Email Accounts, T1588.002 Tool. Source: https://attack.mitre.org/groups/G0136. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - IndigoZebra (G0136) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1204.002 OR T1105 OR T1583.001 OR T1583.006 OR T1586.002 OR T1588.002) OR threat.technique.id:(T1566.001 OR T1204.002 OR T1105 OR T1583.001 OR T1583.006 OR T1586.002 OR T1588.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - IndigoZebra (G0136) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1204.002 OR T1105 OR T1583.001 OR T1583.006 OR T1586.002 OR T1588.002) OR threat.technique.id:(T1566.001 OR T1204.002 OR T1105 OR T1583.001 OR T1583.006 OR T1586.002 OR T1588.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile IndigoZebra with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1566.001 OR T1204.002 OR T1105 OR T1583.001 OR T1583.006 OR T1586.002 OR T1588.002) OR threat.technique.id:(T1566.001 OR T1204.002 OR T1105 OR T1583.001 OR T1583.006 OR T1586.002 OR T1588.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1105\"\n[[rule.threat.technique]]\nid = \"T1583.001\"\n[[rule.threat.technique]]\nid = \"T1583.006\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1105\"\n[[rule.threat.technique]]\nid = \"T1583.001\"\n[[rule.threat.technique]]\nid = \"T1583.006\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1105\"\n[[rule.threat.technique]]\nid = \"T1583.001\"\n[[rule.threat.technique]]\nid = \"T1583.006\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1105\"\n[[rule.threat.technique]]\nid = \"T1583.001\"\n[[rule.threat.technique]]\nid = \"T1583.006\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0137-ferocious-kitten.json b/app/playbooks/threat-groups/apt-g0137-ferocious-kitten.json
new file mode 100644
index 0000000..996a925
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0137-ferocious-kitten.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0137",
+ "num": 160,
+ "name": "MITRE ATT&CK Group — Ferocious Kitten",
+ "fullName": "Ferocious Kitten (G0137) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Ferocious Kitten](https://attack.mitre.org/groups/G0137) is a threat group that has primarily targeted Persian-speaking individuals in Iran since at least 2015. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Ferocious Kitten.",
+ "mitre": "T1566.001, T1204.002, T1583.001, T1588.002, T1036.002, T1036.005",
+ "aliases": [
+ "Ferocious Kitten"
+ ],
+ "mitreGroupId": "G0137",
+ "mitreUrl": "https://attack.mitre.org/groups/G0137",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Ferocious Kitten with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0137. Aliases: Ferocious Kitten. Primary mapped tactics: Initial Access, Execution, Resource Development, Stealth. Mapped techniques: T1566.001 Spearphishing Attachment, T1204.002 Malicious File, T1583.001 Domains, T1588.002 Tool, T1036.002 Right-to-Left Override, T1036.005 Match Legitimate Resource Name or Location. Source: https://attack.mitre.org/groups/G0137. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Ferocious Kitten (G0137) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1204.002 OR T1583.001 OR T1588.002 OR T1036.002 OR T1036.005) OR threat.technique.id:(T1566.001 OR T1204.002 OR T1583.001 OR T1588.002 OR T1036.002 OR T1036.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Ferocious Kitten (G0137) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1204.002 OR T1583.001 OR T1588.002 OR T1036.002 OR T1036.005) OR threat.technique.id:(T1566.001 OR T1204.002 OR T1583.001 OR T1588.002 OR T1036.002 OR T1036.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Ferocious Kitten with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1566.001 OR T1204.002 OR T1583.001 OR T1588.002 OR T1036.002 OR T1036.005) OR threat.technique.id:(T1566.001 OR T1204.002 OR T1583.001 OR T1588.002 OR T1036.002 OR T1036.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1583.001\"\n[[rule.threat.technique]]\nid = \"T1588.002\"\n[[rule.threat.technique]]\nid = \"T1036.002\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1583.001\"\n[[rule.threat.technique]]\nid = \"T1588.002\"\n[[rule.threat.technique]]\nid = \"T1036.002\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1583.001\"\n[[rule.threat.technique]]\nid = \"T1588.002\"\n[[rule.threat.technique]]\nid = \"T1036.002\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1583.001\"\n[[rule.threat.technique]]\nid = \"T1588.002\"\n[[rule.threat.technique]]\nid = \"T1036.002\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0138-andariel.json b/app/playbooks/threat-groups/apt-g0138-andariel.json
new file mode 100644
index 0000000..de670e5
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0138-andariel.json
@@ -0,0 +1,119 @@
+{
+ "id": "apt-g0138",
+ "num": 161,
+ "name": "MITRE ATT&CK Group — Andariel",
+ "fullName": "Andariel (G0138) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Andariel](https://attack.mitre.org/groups/G0138) is a North Korean state-sponsored threat group that has been active since at least 2009. [Andariel](https://attack.mitre.org/groups/G0138) has primarily focused its operations--which have included destructive attacks--against South Korean government agencies, military organizations, and a variety of domestic companies; they have also conducted cyber financial operations against ATMs, banks, and cryptocurrency exchanges. [Andariel](https://attack.mitre.org/groups/G0138)'s notable activity includes Operation Black Mine, Operation GoldenAxe, and Campaign Rifle. [Andariel](https://attack.mitre.org/groups/G0138) is considered a sub-set of [Lazarus Group](https://attack.mitre.org/groups/G0032), and has been attributed to North Korea's Reconnaissance General Bureau. North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name [Lazarus Group](https://attack.mitre.org/groups/G0032) instead of tracking clusters or subgroups. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Andariel.",
+ "mitre": "T1189, T1566.001, T1203, T1204.002, T1049, T1057, T1005, T1105, T1590.005, T1592.002, T1588.001, T1027.003",
+ "aliases": [
+ "Andariel",
+ "Silent Chollima",
+ "PLUTONIUM",
+ "Onyx Sleet"
+ ],
+ "mitreGroupId": "G0138",
+ "mitreUrl": "https://attack.mitre.org/groups/G0138",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Andariel with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0138. Aliases: Andariel, Silent Chollima, PLUTONIUM, Onyx Sleet. Primary mapped tactics: Initial Access, Execution, Discovery, Collection, Command and Control, Reconnaissance, Resource Development, Stealth. Mapped techniques: T1189 Drive-by Compromise, T1566.001 Spearphishing Attachment, T1203 Exploitation for Client Execution, T1204.002 Malicious File, T1049 System Network Connections Discovery, T1057 Process Discovery, T1005 Data from Local System, T1105 Ingress Tool Transfer, T1590.005 IP Addresses, T1592.002 Software, T1588.001 Malware, T1027.003 Steganography. Source: https://attack.mitre.org/groups/G0138. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Andariel (G0138) ATT&CK technique pivots\n(rule.threat.technique.id:(T1189 OR T1566.001 OR T1203 OR T1204.002 OR T1049 OR T1057 OR T1005 OR T1105 OR T1590.005 OR T1592.002 OR T1588.001 OR T1027.003) OR threat.technique.id:(T1189 OR T1566.001 OR T1203 OR T1204.002 OR T1049 OR T1057 OR T1005 OR T1105 OR T1590.005 OR T1592.002 OR T1588.001 OR T1027.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Andariel (G0138) ATT&CK technique pivots\n(rule.threat.technique.id:(T1189 OR T1566.001 OR T1203 OR T1204.002 OR T1049 OR T1057 OR T1005 OR T1105 OR T1590.005 OR T1592.002 OR T1588.001 OR T1027.003) OR threat.technique.id:(T1189 OR T1566.001 OR T1203 OR T1204.002 OR T1049 OR T1057 OR T1005 OR T1105 OR T1590.005 OR T1592.002 OR T1588.001 OR T1027.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Andariel with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1189 OR T1566.001 OR T1203 OR T1204.002 OR T1049 OR T1057 OR T1005 OR T1105 OR T1590.005 OR T1592.002 OR T1588.001 OR T1027.003) OR threat.technique.id:(T1189 OR T1566.001 OR T1203 OR T1204.002 OR T1049 OR T1057 OR T1005 OR T1105 OR T1590.005 OR T1592.002 OR T1588.001 OR T1027.003) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1049\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1049\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1049\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1049\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0139-teamtnt.json b/app/playbooks/threat-groups/apt-g0139-teamtnt.json
new file mode 100644
index 0000000..d445091
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0139-teamtnt.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0139",
+ "num": 162,
+ "name": "MITRE ATT&CK Group — TeamTNT",
+ "fullName": "TeamTNT (G0139) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[TeamTNT](https://attack.mitre.org/groups/G0139) is a threat group that has primarily targeted cloud and containerized environments. The group as been active since at least October 2019 and has mainly focused its efforts on leveraging cloud and container resources to deploy cryptocurrency miners in victim environments. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with TeamTNT.",
+ "mitre": "T1133, T1059.001, T1059.003, T1059.004, T1059.009, T1059.013, T1204.003, T1569.003, T1609, T1610, T1098.004, T1136.001, T1543.002, T1543.003, T1547.001, T1611, T1552.001, T1552.004, T1552.005, T1007, T1016, T1046, T1049, T1057",
+ "aliases": [
+ "TeamTNT"
+ ],
+ "mitreGroupId": "G0139",
+ "mitreUrl": "https://attack.mitre.org/groups/G0139",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile TeamTNT with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0139. Aliases: TeamTNT. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact, Defense Impairment, Reconnaissance, Resource Development, Stealth. Mapped techniques: T1133 External Remote Services, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1059.004 Unix Shell, T1059.009 Cloud API, T1059.013 Container CLI/API, T1204.003 Malicious Image, T1569.003 Systemctl, T1609 Container Administration Command, T1610 Deploy Container, T1098.004 SSH Authorized Keys, T1136.001 Local Account, plus 44 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0139. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - TeamTNT (G0139) ATT&CK technique pivots\n(rule.threat.technique.id:(T1133 OR T1059.001 OR T1059.003 OR T1059.004 OR T1059.009 OR T1059.013 OR T1204.003 OR T1569.003 OR T1609 OR T1610 OR T1098.004 OR T1136.001 OR T1543.002 OR T1543.003 OR T1547.001 OR T1611 OR T1552.001 OR T1552.004 OR T1552.005 OR T1007) OR threat.technique.id:(T1133 OR T1059.001 OR T1059.003 OR T1059.004 OR T1059.009 OR T1059.013 OR T1204.003 OR T1569.003 OR T1609 OR T1610 OR T1098.004 OR T1136.001 OR T1543.002 OR T1543.003 OR T1547.001 OR T1611 OR T1552.001 OR T1552.004 OR T1552.005 OR T1007) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - TeamTNT (G0139) ATT&CK technique pivots\n(rule.threat.technique.id:(T1133 OR T1059.001 OR T1059.003 OR T1059.004 OR T1059.009 OR T1059.013 OR T1204.003 OR T1569.003 OR T1609 OR T1610 OR T1098.004 OR T1136.001 OR T1543.002 OR T1543.003 OR T1547.001 OR T1611 OR T1552.001 OR T1552.004 OR T1552.005 OR T1007) OR threat.technique.id:(T1133 OR T1059.001 OR T1059.003 OR T1059.004 OR T1059.009 OR T1059.013 OR T1204.003 OR T1569.003 OR T1609 OR T1610 OR T1098.004 OR T1136.001 OR T1543.002 OR T1543.003 OR T1547.001 OR T1611 OR T1552.001 OR T1552.004 OR T1552.005 OR T1007) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile TeamTNT with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1133 OR T1059.001 OR T1059.003 OR T1059.004 OR T1059.009 OR T1059.013 OR T1204.003 OR T1569.003 OR T1609 OR T1610 OR T1098.004 OR T1136.001 OR T1543.002 OR T1543.003 OR T1547.001 OR T1611 OR T1552.001 OR T1552.004 OR T1552.005 OR T1007) OR threat.technique.id:(T1133 OR T1059.001 OR T1059.003 OR T1059.004 OR T1059.009 OR T1059.013 OR T1204.003 OR T1569.003 OR T1609 OR T1610 OR T1098.004 OR T1136.001 OR T1543.002 OR T1543.003 OR T1547.001 OR T1611 OR T1552.001 OR T1552.004 OR T1552.005 OR T1007) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.004\"\n[[rule.threat.technique]]\nid = \"T1059.009\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.004\"\n[[rule.threat.technique]]\nid = \"T1059.009\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.004\"\n[[rule.threat.technique]]\nid = \"T1059.009\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.004\"\n[[rule.threat.technique]]\nid = \"T1059.009\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0140-lazyscripter.json b/app/playbooks/threat-groups/apt-g0140-lazyscripter.json
new file mode 100644
index 0000000..cfa8235
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0140-lazyscripter.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0140",
+ "num": 163,
+ "name": "MITRE ATT&CK Group — LazyScripter",
+ "fullName": "LazyScripter (G0140) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[LazyScripter](https://attack.mitre.org/groups/G0140) is threat group that has mainly targeted the airlines industry since at least 2018, primarily using open-source toolsets. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with LazyScripter.",
+ "mitre": "T1566.001, T1566.002, T1059.001, T1059.003, T1059.005, T1059.007, T1204.001, T1204.002, T1547.001, T1071.004, T1102, T1105, T1583.001, T1583.006, T1588.001, T1608.001, T1027.010, T1036, T1218.005, T1218.011",
+ "aliases": [
+ "LazyScripter"
+ ],
+ "mitreGroupId": "G0140",
+ "mitreUrl": "https://attack.mitre.org/groups/G0140",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile LazyScripter with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0140. Aliases: LazyScripter. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Command and Control, Resource Development, Stealth. Mapped techniques: T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1059.005 Visual Basic, T1059.007 JavaScript, T1204.001 Malicious Link, T1204.002 Malicious File, T1547.001 Registry Run Keys / Startup Folder, T1071.004 DNS, T1102 Web Service, T1105 Ingress Tool Transfer, plus 8 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0140. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - LazyScripter (G0140) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1566.002 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1204.001 OR T1204.002 OR T1547.001 OR T1071.004 OR T1102 OR T1105 OR T1583.001 OR T1583.006 OR T1588.001 OR T1608.001 OR T1027.010 OR T1036 OR T1218.005 OR T1218.011) OR threat.technique.id:(T1566.001 OR T1566.002 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1204.001 OR T1204.002 OR T1547.001 OR T1071.004 OR T1102 OR T1105 OR T1583.001 OR T1583.006 OR T1588.001 OR T1608.001 OR T1027.010 OR T1036 OR T1218.005 OR T1218.011) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - LazyScripter (G0140) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1566.002 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1204.001 OR T1204.002 OR T1547.001 OR T1071.004 OR T1102 OR T1105 OR T1583.001 OR T1583.006 OR T1588.001 OR T1608.001 OR T1027.010 OR T1036 OR T1218.005 OR T1218.011) OR threat.technique.id:(T1566.001 OR T1566.002 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1204.001 OR T1204.002 OR T1547.001 OR T1071.004 OR T1102 OR T1105 OR T1583.001 OR T1583.006 OR T1588.001 OR T1608.001 OR T1027.010 OR T1036 OR T1218.005 OR T1218.011) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile LazyScripter with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1566.001 OR T1566.002 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1204.001 OR T1204.002 OR T1547.001 OR T1071.004 OR T1102 OR T1105 OR T1583.001 OR T1583.006 OR T1588.001 OR T1608.001 OR T1027.010 OR T1036 OR T1218.005 OR T1218.011) OR threat.technique.id:(T1566.001 OR T1566.002 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.007 OR T1204.001 OR T1204.002 OR T1547.001 OR T1071.004 OR T1102 OR T1105 OR T1583.001 OR T1583.006 OR T1588.001 OR T1608.001 OR T1027.010 OR T1036 OR T1218.005 OR T1218.011) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.005\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.005\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.005\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.005\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0142-confucius.json b/app/playbooks/threat-groups/apt-g0142-confucius.json
new file mode 100644
index 0000000..cfb27af
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0142-confucius.json
@@ -0,0 +1,117 @@
+{
+ "id": "apt-g0142",
+ "num": 164,
+ "name": "MITRE ATT&CK Group — Confucius",
+ "fullName": "Confucius (G0142) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Confucius](https://attack.mitre.org/groups/G0142) is a cyber espionage group that has primarily targeted military personnel, high-profile personalities, business persons, and government organizations in South Asia since at least 2013. Security researchers have noted similarities between [Confucius](https://attack.mitre.org/groups/G0142) and [Patchwork](https://attack.mitre.org/groups/G0040), particularly in their respective custom malware code and targets. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Confucius.",
+ "mitre": "T1566.001, T1566.002, T1053.005, T1059.001, T1059.005, T1203, T1204.001, T1204.002, T1547.001, T1083, T1680, T1119, T1071.001, T1105, T1041, T1567.002, T1583.006, T1218.005, T1221",
+ "aliases": [
+ "Confucius",
+ "Confucius APT"
+ ],
+ "mitreGroupId": "G0142",
+ "mitreUrl": "https://attack.mitre.org/groups/G0142",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Confucius with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0142. Aliases: Confucius, Confucius APT. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Discovery, Collection, Command and Control, Exfiltration, Resource Development, Stealth. Mapped techniques: T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link, T1053.005 Scheduled Task, T1059.001 PowerShell, T1059.005 Visual Basic, T1203 Exploitation for Client Execution, T1204.001 Malicious Link, T1204.002 Malicious File, T1547.001 Registry Run Keys / Startup Folder, T1083 File and Directory Discovery, T1680 Local Storage Discovery, T1119 Automated Collection, plus 7 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0142. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Confucius (G0142) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.005 OR T1203 OR T1204.001 OR T1204.002 OR T1547.001 OR T1083 OR T1680 OR T1119 OR T1071.001 OR T1105 OR T1041 OR T1567.002 OR T1583.006 OR T1218.005 OR T1221) OR threat.technique.id:(T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.005 OR T1203 OR T1204.001 OR T1204.002 OR T1547.001 OR T1083 OR T1680 OR T1119 OR T1071.001 OR T1105 OR T1041 OR T1567.002 OR T1583.006 OR T1218.005 OR T1221) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Confucius (G0142) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.005 OR T1203 OR T1204.001 OR T1204.002 OR T1547.001 OR T1083 OR T1680 OR T1119 OR T1071.001 OR T1105 OR T1041 OR T1567.002 OR T1583.006 OR T1218.005 OR T1221) OR threat.technique.id:(T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.005 OR T1203 OR T1204.001 OR T1204.002 OR T1547.001 OR T1083 OR T1680 OR T1119 OR T1071.001 OR T1105 OR T1041 OR T1567.002 OR T1583.006 OR T1218.005 OR T1221) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Confucius with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.005 OR T1203 OR T1204.001 OR T1204.002 OR T1547.001 OR T1083 OR T1680 OR T1119 OR T1071.001 OR T1105 OR T1041 OR T1567.002 OR T1583.006 OR T1218.005 OR T1221) OR threat.technique.id:(T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.005 OR T1203 OR T1204.001 OR T1204.002 OR T1547.001 OR T1083 OR T1680 OR T1119 OR T1071.001 OR T1105 OR T1041 OR T1567.002 OR T1583.006 OR T1218.005 OR T1221) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.005\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.005\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.005\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.005\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g0143-aquatic-panda.json b/app/playbooks/threat-groups/apt-g0143-aquatic-panda.json
new file mode 100644
index 0000000..2ab0248
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g0143-aquatic-panda.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g0143",
+ "num": 165,
+ "name": "MITRE ATT&CK Group — Aquatic Panda",
+ "fullName": "Aquatic Panda (G0143) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Aquatic Panda](https://attack.mitre.org/groups/G0143) is a suspected China-based threat group with a dual mission of intelligence collection and industrial espionage. Active since at least May 2020, [Aquatic Panda](https://attack.mitre.org/groups/G0143) has primarily targeted entities in the telecommunications, technology, and government sectors. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Aquatic Panda.",
+ "mitre": "T1078.002, T1047, T1059.001, T1059.003, T1059.004, T1574.001, T1574.006, T1112, T1543.003, T1003.001, T1007, T1033, T1082, T1087, T1518.001, T1654, T1021, T1021.001, T1021.002, T1021.004, T1550.002, T1005, T1560.001, T1105",
+ "aliases": [
+ "Aquatic Panda"
+ ],
+ "mitreGroupId": "G0143",
+ "mitreUrl": "https://attack.mitre.org/groups/G0143",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Aquatic Panda with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G0143. Aliases: Aquatic Panda. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Defense Impairment, Reconnaissance, Resource Development, Stealth. Mapped techniques: T1078.002 Domain Accounts, T1047 Windows Management Instrumentation, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1059.004 Unix Shell, T1574.001 DLL, T1574.006 Dynamic Linker Hijacking, T1112 Modify Registry, T1543.003 Windows Service, T1003.001 LSASS Memory, T1007 System Service Discovery, T1033 System Owner/User Discovery, plus 23 additional mapped technique(s). Source: https://attack.mitre.org/groups/G0143. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Aquatic Panda (G0143) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078.002 OR T1047 OR T1059.001 OR T1059.003 OR T1059.004 OR T1574.001 OR T1574.006 OR T1112 OR T1543.003 OR T1003.001 OR T1007 OR T1033 OR T1082 OR T1087 OR T1518.001 OR T1654 OR T1021 OR T1021.001 OR T1021.002 OR T1021.004) OR threat.technique.id:(T1078.002 OR T1047 OR T1059.001 OR T1059.003 OR T1059.004 OR T1574.001 OR T1574.006 OR T1112 OR T1543.003 OR T1003.001 OR T1007 OR T1033 OR T1082 OR T1087 OR T1518.001 OR T1654 OR T1021 OR T1021.001 OR T1021.002 OR T1021.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Aquatic Panda (G0143) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078.002 OR T1047 OR T1059.001 OR T1059.003 OR T1059.004 OR T1574.001 OR T1574.006 OR T1112 OR T1543.003 OR T1003.001 OR T1007 OR T1033 OR T1082 OR T1087 OR T1518.001 OR T1654 OR T1021 OR T1021.001 OR T1021.002 OR T1021.004) OR threat.technique.id:(T1078.002 OR T1047 OR T1059.001 OR T1059.003 OR T1059.004 OR T1574.001 OR T1574.006 OR T1112 OR T1543.003 OR T1003.001 OR T1007 OR T1033 OR T1082 OR T1087 OR T1518.001 OR T1654 OR T1021 OR T1021.001 OR T1021.002 OR T1021.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Aquatic Panda with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078.002 OR T1047 OR T1059.001 OR T1059.003 OR T1059.004 OR T1574.001 OR T1574.006 OR T1112 OR T1543.003 OR T1003.001 OR T1007 OR T1033 OR T1082 OR T1087 OR T1518.001 OR T1654 OR T1021 OR T1021.001 OR T1021.002 OR T1021.004) OR threat.technique.id:(T1078.002 OR T1047 OR T1059.001 OR T1059.003 OR T1059.004 OR T1574.001 OR T1574.006 OR T1112 OR T1543.003 OR T1003.001 OR T1007 OR T1033 OR T1082 OR T1087 OR T1518.001 OR T1654 OR T1021 OR T1021.001 OR T1021.002 OR T1021.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.004\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.004\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.004\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.004\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1001-hexane.json b/app/playbooks/threat-groups/apt-g1001-hexane.json
new file mode 100644
index 0000000..d5370fb
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1001-hexane.json
@@ -0,0 +1,119 @@
+{
+ "id": "apt-g1001",
+ "num": 166,
+ "name": "MITRE ATT&CK Group — HEXANE",
+ "fullName": "HEXANE (G1001) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[HEXANE](https://attack.mitre.org/groups/G1001) is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations since at least 2017. Targeted companies have been located in the Middle East and Africa, including Israel, Saudi Arabia, Kuwait, Morocco, and Tunisia. [HEXANE](https://attack.mitre.org/groups/G1001)'s TTPs appear similar to [APT33](https://attack.mitre.org/groups/G0064) and [OilRig](https://attack.mitre.org/groups/G0049) but due to differences in victims and tools it is tracked as a separate entity. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with HEXANE.",
+ "mitre": "T1053.005, T1059.001, T1059.005, T1204.002, T1546.003, T1056.001, T1110, T1110.003, T1555, T1555.003, T1010, T1016, T1016.001, T1018, T1033, T1049, T1057, T1069.001, T1082, T1518, T1021.001, T1534, T1102.002, T1105",
+ "aliases": [
+ "HEXANE",
+ "Lyceum",
+ "Siamesekitten",
+ "Spirlin"
+ ],
+ "mitreGroupId": "G1001",
+ "mitreUrl": "https://attack.mitre.org/groups/G1001",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile HEXANE with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1001. Aliases: HEXANE, Lyceum, Siamesekitten, Spirlin. Primary mapped tactics: Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Reconnaissance, Resource Development, Stealth. Mapped techniques: T1053.005 Scheduled Task, T1059.001 PowerShell, T1059.005 Visual Basic, T1204.002 Malicious File, T1546.003 Windows Management Instrumentation Event Subscription, T1056.001 Keylogging, T1110 Brute Force, T1110.003 Password Spraying, T1555 Credentials from Password Stores, T1555.003 Credentials from Web Browsers, T1010 Application Window Discovery, T1016 System Network Configuration Discovery, plus 24 additional mapped technique(s). Source: https://attack.mitre.org/groups/G1001. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - HEXANE (G1001) ATT&CK technique pivots\n(rule.threat.technique.id:(T1053.005 OR T1059.001 OR T1059.005 OR T1204.002 OR T1546.003 OR T1056.001 OR T1110 OR T1110.003 OR T1555 OR T1555.003 OR T1010 OR T1016 OR T1016.001 OR T1018 OR T1033 OR T1049 OR T1057 OR T1069.001 OR T1082 OR T1518) OR threat.technique.id:(T1053.005 OR T1059.001 OR T1059.005 OR T1204.002 OR T1546.003 OR T1056.001 OR T1110 OR T1110.003 OR T1555 OR T1555.003 OR T1010 OR T1016 OR T1016.001 OR T1018 OR T1033 OR T1049 OR T1057 OR T1069.001 OR T1082 OR T1518) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - HEXANE (G1001) ATT&CK technique pivots\n(rule.threat.technique.id:(T1053.005 OR T1059.001 OR T1059.005 OR T1204.002 OR T1546.003 OR T1056.001 OR T1110 OR T1110.003 OR T1555 OR T1555.003 OR T1010 OR T1016 OR T1016.001 OR T1018 OR T1033 OR T1049 OR T1057 OR T1069.001 OR T1082 OR T1518) OR threat.technique.id:(T1053.005 OR T1059.001 OR T1059.005 OR T1204.002 OR T1546.003 OR T1056.001 OR T1110 OR T1110.003 OR T1555 OR T1555.003 OR T1010 OR T1016 OR T1016.001 OR T1018 OR T1033 OR T1049 OR T1057 OR T1069.001 OR T1082 OR T1518) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile HEXANE with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1053.005 OR T1059.001 OR T1059.005 OR T1204.002 OR T1546.003 OR T1056.001 OR T1110 OR T1110.003 OR T1555 OR T1555.003 OR T1010 OR T1016 OR T1016.001 OR T1018 OR T1033 OR T1049 OR T1057 OR T1069.001 OR T1082 OR T1518) OR threat.technique.id:(T1053.005 OR T1059.001 OR T1059.005 OR T1204.002 OR T1546.003 OR T1056.001 OR T1110 OR T1110.003 OR T1555 OR T1555.003 OR T1010 OR T1016 OR T1016.001 OR T1018 OR T1033 OR T1049 OR T1057 OR T1069.001 OR T1082 OR T1518) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1546.003\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1546.003\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1546.003\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1546.003\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1002-bitter.json b/app/playbooks/threat-groups/apt-g1002-bitter.json
new file mode 100644
index 0000000..bbd66d5
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1002-bitter.json
@@ -0,0 +1,117 @@
+{
+ "id": "apt-g1002",
+ "num": 167,
+ "name": "MITRE ATT&CK Group — BITTER",
+ "fullName": "BITTER (G1002) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[BITTER](https://attack.mitre.org/groups/G1002) is a suspected South Asian cyber espionage threat group that has been active since at least 2013. [BITTER](https://attack.mitre.org/groups/G1002) has targeted government, energy, and engineering organizations in Pakistan, China, Bangladesh, and Saudi Arabia. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with BITTER.",
+ "mitre": "T1566.001, T1053.005, T1203, T1204.002, T1559.002, T1068, T1071.001, T1095, T1105, T1568, T1573, T1583.001, T1588.002, T1608.001, T1027.013, T1036.004",
+ "aliases": [
+ "BITTER",
+ "T-APT-17"
+ ],
+ "mitreGroupId": "G1002",
+ "mitreUrl": "https://attack.mitre.org/groups/G1002",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile BITTER with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1002. Aliases: BITTER, T-APT-17. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Command and Control, Resource Development, Stealth. Mapped techniques: T1566.001 Spearphishing Attachment, T1053.005 Scheduled Task, T1203 Exploitation for Client Execution, T1204.002 Malicious File, T1559.002 Dynamic Data Exchange, T1068 Exploitation for Privilege Escalation, T1071.001 Web Protocols, T1095 Non-Application Layer Protocol, T1105 Ingress Tool Transfer, T1568 Dynamic Resolution, T1573 Encrypted Channel, T1583.001 Domains, plus 4 additional mapped technique(s). Source: https://attack.mitre.org/groups/G1002. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - BITTER (G1002) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1053.005 OR T1203 OR T1204.002 OR T1559.002 OR T1068 OR T1071.001 OR T1095 OR T1105 OR T1568 OR T1573 OR T1583.001 OR T1588.002 OR T1608.001 OR T1027.013 OR T1036.004) OR threat.technique.id:(T1566.001 OR T1053.005 OR T1203 OR T1204.002 OR T1559.002 OR T1068 OR T1071.001 OR T1095 OR T1105 OR T1568 OR T1573 OR T1583.001 OR T1588.002 OR T1608.001 OR T1027.013 OR T1036.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - BITTER (G1002) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1053.005 OR T1203 OR T1204.002 OR T1559.002 OR T1068 OR T1071.001 OR T1095 OR T1105 OR T1568 OR T1573 OR T1583.001 OR T1588.002 OR T1608.001 OR T1027.013 OR T1036.004) OR threat.technique.id:(T1566.001 OR T1053.005 OR T1203 OR T1204.002 OR T1559.002 OR T1068 OR T1071.001 OR T1095 OR T1105 OR T1568 OR T1573 OR T1583.001 OR T1588.002 OR T1608.001 OR T1027.013 OR T1036.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile BITTER with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1566.001 OR T1053.005 OR T1203 OR T1204.002 OR T1559.002 OR T1068 OR T1071.001 OR T1095 OR T1105 OR T1568 OR T1573 OR T1583.001 OR T1588.002 OR T1608.001 OR T1027.013 OR T1036.004) OR threat.technique.id:(T1566.001 OR T1053.005 OR T1203 OR T1204.002 OR T1559.002 OR T1068 OR T1071.001 OR T1095 OR T1105 OR T1568 OR T1573 OR T1583.001 OR T1588.002 OR T1608.001 OR T1027.013 OR T1036.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1559.002\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1559.002\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1559.002\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1559.002\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1003-ember-bear.json b/app/playbooks/threat-groups/apt-g1003-ember-bear.json
new file mode 100644
index 0000000..2b3b07a
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1003-ember-bear.json
@@ -0,0 +1,122 @@
+{
+ "id": "apt-g1003",
+ "num": 168,
+ "name": "MITRE ATT&CK Group — Ember Bear",
+ "fullName": "Ember Bear (G1003) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Ember Bear](https://attack.mitre.org/groups/G1003) is a Russian state-sponsored cyber espionage group that has been active since at least 2020, linked to Russia's General Staff Main Intelligence Directorate (GRU) 161st Specialist Training Center (Unit 29155). [Ember Bear](https://attack.mitre.org/groups/G1003) has primarily focused operations against Ukrainian government and telecommunication entities, but has also operated against critical infrastructure entities in Europe and the Americas. [Ember Bear](https://attack.mitre.org/groups/G1003) conducted the [WhisperGate](https://attack.mitre.org/software/S0689) destructive wiper attacks against Ukraine in early 2022. There is some confusion as to whether [Ember Bear](https://attack.mitre.org/groups/G1003) overlaps with another Russian-linked entity referred to as [Saint Bear](https://attack.mitre.org/groups/G1031). At present available evidence strongly suggests these are distinct activities with different behavioral profiles. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Ember Bear.",
+ "mitre": "T1078.001, T1133, T1190, T1195, T1047, T1053.005, T1059.001, T1203, T1112, T1505.003, T1003, T1003.001, T1003.002, T1003.004, T1110, T1110.003, T1552.001, T1018, T1046, T1654, T1021, T1210, T1550.002, T1570",
+ "aliases": [
+ "Ember Bear",
+ "UNC2589",
+ "Bleeding Bear",
+ "DEV-0586",
+ "Cadet Blizzard",
+ "Frozenvista",
+ "UAC-0056"
+ ],
+ "mitreGroupId": "G1003",
+ "mitreUrl": "https://attack.mitre.org/groups/G1003",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Ember Bear with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1003. Aliases: Ember Bear, UNC2589, Bleeding Bear, DEV-0586, Cadet Blizzard, Frozenvista, UAC-0056. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact, Defense Impairment, Reconnaissance, Resource Development, Stealth. Mapped techniques: T1078.001 Default Accounts, T1133 External Remote Services, T1190 Exploit Public-Facing Application, T1195 Supply Chain Compromise, T1047 Windows Management Instrumentation, T1053.005 Scheduled Task, T1059.001 PowerShell, T1203 Exploitation for Client Execution, T1112 Modify Registry, T1505.003 Web Shell, T1003 OS Credential Dumping, T1003.001 LSASS Memory, plus 35 additional mapped technique(s). Source: https://attack.mitre.org/groups/G1003. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Ember Bear (G1003) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078.001 OR T1133 OR T1190 OR T1195 OR T1047 OR T1053.005 OR T1059.001 OR T1203 OR T1112 OR T1505.003 OR T1003 OR T1003.001 OR T1003.002 OR T1003.004 OR T1110 OR T1110.003 OR T1552.001 OR T1018 OR T1046 OR T1654) OR threat.technique.id:(T1078.001 OR T1133 OR T1190 OR T1195 OR T1047 OR T1053.005 OR T1059.001 OR T1203 OR T1112 OR T1505.003 OR T1003 OR T1003.001 OR T1003.002 OR T1003.004 OR T1110 OR T1110.003 OR T1552.001 OR T1018 OR T1046 OR T1654) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Ember Bear (G1003) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078.001 OR T1133 OR T1190 OR T1195 OR T1047 OR T1053.005 OR T1059.001 OR T1203 OR T1112 OR T1505.003 OR T1003 OR T1003.001 OR T1003.002 OR T1003.004 OR T1110 OR T1110.003 OR T1552.001 OR T1018 OR T1046 OR T1654) OR threat.technique.id:(T1078.001 OR T1133 OR T1190 OR T1195 OR T1047 OR T1053.005 OR T1059.001 OR T1203 OR T1112 OR T1505.003 OR T1003 OR T1003.001 OR T1003.002 OR T1003.004 OR T1110 OR T1110.003 OR T1552.001 OR T1018 OR T1046 OR T1654) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Ember Bear with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078.001 OR T1133 OR T1190 OR T1195 OR T1047 OR T1053.005 OR T1059.001 OR T1203 OR T1112 OR T1505.003 OR T1003 OR T1003.001 OR T1003.002 OR T1003.004 OR T1110 OR T1110.003 OR T1552.001 OR T1018 OR T1046 OR T1654) OR threat.technique.id:(T1078.001 OR T1133 OR T1190 OR T1195 OR T1047 OR T1053.005 OR T1059.001 OR T1203 OR T1112 OR T1505.003 OR T1003 OR T1003.001 OR T1003.002 OR T1003.004 OR T1110 OR T1110.003 OR T1552.001 OR T1018 OR T1046 OR T1654) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.001\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1195\"\n[[rule.threat.technique]]\nid = \"T1047\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.001\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1195\"\n[[rule.threat.technique]]\nid = \"T1047\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.001\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1195\"\n[[rule.threat.technique]]\nid = \"T1047\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.001\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1195\"\n[[rule.threat.technique]]\nid = \"T1047\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1004-lapsus.json b/app/playbooks/threat-groups/apt-g1004-lapsus.json
new file mode 100644
index 0000000..2bfd7eb
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1004-lapsus.json
@@ -0,0 +1,118 @@
+{
+ "id": "apt-g1004",
+ "num": 169,
+ "name": "MITRE ATT&CK Group — LAPSUS$",
+ "fullName": "LAPSUS$ (G1004) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[LAPSUS$](https://attack.mitre.org/groups/G1004) is cyber criminal threat group that has been active since at least mid-2021. [LAPSUS$](https://attack.mitre.org/groups/G1004) specializes in large-scale social engineering and extortion operations, including destructive attacks without the use of ransomware. The group has targeted organizations globally, including in the government, manufacturing, higher education, energy, healthcare, technology, telecommunications, and media sectors. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with LAPSUS$.",
+ "mitre": "T1078, T1078.004, T1133, T1199, T1204, T1098.003, T1136.003, T1068, T1003.003, T1003.006, T1111, T1552.008, T1555.003, T1555.005, T1621, T1069.002, T1087.002, T1005, T1114.003, T1213.001, T1213.002, T1213.003, T1213.005, T1090",
+ "aliases": [
+ "LAPSUS$",
+ "DEV-0537",
+ "Strawberry Tempest"
+ ],
+ "mitreGroupId": "G1004",
+ "mitreUrl": "https://attack.mitre.org/groups/G1004",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile LAPSUS$ with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1004. Aliases: LAPSUS$, DEV-0537, Strawberry Tempest. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Collection, Command and Control, Impact, Defense Impairment, Reconnaissance, Resource Development, Stealth. Mapped techniques: T1078 Valid Accounts, T1078.004 Cloud Accounts, T1133 External Remote Services, T1199 Trusted Relationship, T1204 User Execution, T1098.003 Additional Cloud Roles, T1136.003 Cloud Account, T1068 Exploitation for Privilege Escalation, T1003.003 NTDS, T1003.006 DCSync, T1111 Multi-Factor Authentication Interception, T1552.008 Chat Messages, plus 31 additional mapped technique(s). Source: https://attack.mitre.org/groups/G1004. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - LAPSUS$ (G1004) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1078.004 OR T1133 OR T1199 OR T1204 OR T1098.003 OR T1136.003 OR T1068 OR T1003.003 OR T1003.006 OR T1111 OR T1552.008 OR T1555.003 OR T1555.005 OR T1621 OR T1069.002 OR T1087.002 OR T1005 OR T1114.003 OR T1213.001) OR threat.technique.id:(T1078 OR T1078.004 OR T1133 OR T1199 OR T1204 OR T1098.003 OR T1136.003 OR T1068 OR T1003.003 OR T1003.006 OR T1111 OR T1552.008 OR T1555.003 OR T1555.005 OR T1621 OR T1069.002 OR T1087.002 OR T1005 OR T1114.003 OR T1213.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - LAPSUS$ (G1004) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1078.004 OR T1133 OR T1199 OR T1204 OR T1098.003 OR T1136.003 OR T1068 OR T1003.003 OR T1003.006 OR T1111 OR T1552.008 OR T1555.003 OR T1555.005 OR T1621 OR T1069.002 OR T1087.002 OR T1005 OR T1114.003 OR T1213.001) OR threat.technique.id:(T1078 OR T1078.004 OR T1133 OR T1199 OR T1204 OR T1098.003 OR T1136.003 OR T1068 OR T1003.003 OR T1003.006 OR T1111 OR T1552.008 OR T1555.003 OR T1555.005 OR T1621 OR T1069.002 OR T1087.002 OR T1005 OR T1114.003 OR T1213.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile LAPSUS$ with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1078.004 OR T1133 OR T1199 OR T1204 OR T1098.003 OR T1136.003 OR T1068 OR T1003.003 OR T1003.006 OR T1111 OR T1552.008 OR T1555.003 OR T1555.005 OR T1621 OR T1069.002 OR T1087.002 OR T1005 OR T1114.003 OR T1213.001) OR threat.technique.id:(T1078 OR T1078.004 OR T1133 OR T1199 OR T1204 OR T1098.003 OR T1136.003 OR T1068 OR T1003.003 OR T1003.006 OR T1111 OR T1552.008 OR T1555.003 OR T1555.005 OR T1621 OR T1069.002 OR T1087.002 OR T1005 OR T1114.003 OR T1213.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.004\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1199\"\n[[rule.threat.technique]]\nid = \"T1204\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.004\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1199\"\n[[rule.threat.technique]]\nid = \"T1204\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.004\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1199\"\n[[rule.threat.technique]]\nid = \"T1204\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.004\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1199\"\n[[rule.threat.technique]]\nid = \"T1204\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1005-polonium.json b/app/playbooks/threat-groups/apt-g1005-polonium.json
new file mode 100644
index 0000000..45eca9d
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1005-polonium.json
@@ -0,0 +1,117 @@
+{
+ "id": "apt-g1005",
+ "num": 170,
+ "name": "MITRE ATT&CK Group — POLONIUM",
+ "fullName": "POLONIUM (G1005) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[POLONIUM](https://attack.mitre.org/groups/G1005) is a Lebanon-based group that has primarily targeted Israeli organizations, including critical manufacturing, information technology, and defense industry companies, since at least February 2022. Security researchers assess [POLONIUM](https://attack.mitre.org/groups/G1005) has coordinated their operations with multiple actors affiliated with Iran’s Ministry of Intelligence and Security (MOIS), based on victim overlap as well as common techniques and tooling. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with POLONIUM.",
+ "mitre": "T1078, T1199, T1090, T1102.002, T1567.002, T1583.006, T1588.002",
+ "aliases": [
+ "POLONIUM",
+ "Plaid Rain"
+ ],
+ "mitreGroupId": "G1005",
+ "mitreUrl": "https://attack.mitre.org/groups/G1005",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile POLONIUM with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1005. Aliases: POLONIUM, Plaid Rain. Primary mapped tactics: Initial Access, Persistence, Privilege Escalation, Command and Control, Exfiltration, Resource Development, Stealth. Mapped techniques: T1078 Valid Accounts, T1199 Trusted Relationship, T1090 Proxy, T1102.002 Bidirectional Communication, T1567.002 Exfiltration to Cloud Storage, T1583.006 Web Services, T1588.002 Tool. Source: https://attack.mitre.org/groups/G1005. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - POLONIUM (G1005) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1199 OR T1090 OR T1102.002 OR T1567.002 OR T1583.006 OR T1588.002) OR threat.technique.id:(T1078 OR T1199 OR T1090 OR T1102.002 OR T1567.002 OR T1583.006 OR T1588.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - POLONIUM (G1005) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1199 OR T1090 OR T1102.002 OR T1567.002 OR T1583.006 OR T1588.002) OR threat.technique.id:(T1078 OR T1199 OR T1090 OR T1102.002 OR T1567.002 OR T1583.006 OR T1588.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile POLONIUM with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1199 OR T1090 OR T1102.002 OR T1567.002 OR T1583.006 OR T1588.002) OR threat.technique.id:(T1078 OR T1199 OR T1090 OR T1102.002 OR T1567.002 OR T1583.006 OR T1588.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1199\"\n[[rule.threat.technique]]\nid = \"T1090\"\n[[rule.threat.technique]]\nid = \"T1102.002\"\n[[rule.threat.technique]]\nid = \"T1567.002\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1199\"\n[[rule.threat.technique]]\nid = \"T1090\"\n[[rule.threat.technique]]\nid = \"T1102.002\"\n[[rule.threat.technique]]\nid = \"T1567.002\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1199\"\n[[rule.threat.technique]]\nid = \"T1090\"\n[[rule.threat.technique]]\nid = \"T1102.002\"\n[[rule.threat.technique]]\nid = \"T1567.002\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1199\"\n[[rule.threat.technique]]\nid = \"T1090\"\n[[rule.threat.technique]]\nid = \"T1102.002\"\n[[rule.threat.technique]]\nid = \"T1567.002\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1006-earth-lusca.json b/app/playbooks/threat-groups/apt-g1006-earth-lusca.json
new file mode 100644
index 0000000..7700236
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1006-earth-lusca.json
@@ -0,0 +1,120 @@
+{
+ "id": "apt-g1006",
+ "num": 171,
+ "name": "MITRE ATT&CK Group — Earth Lusca",
+ "fullName": "Earth Lusca (G1006) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Earth Lusca](https://attack.mitre.org/groups/G1006) is a suspected China-based cyber espionage group that has been active since at least April 2019. [Earth Lusca](https://attack.mitre.org/groups/G1006) has targeted organizations in Australia, China, Hong Kong, Mongolia, Nepal, the Philippines, Taiwan, Thailand, Vietnam, the United Arab Emirates, Nigeria, Germany, France, and the United States. Targets included government institutions, news media outlets, gambling companies, educational institutions, COVID-19 research organizations, telecommunications companies, religious movements banned in China, and cryptocurrency trading platforms; security researchers assess some [Earth Lusca](https://attack.mitre.org/groups/G1006) operations may be financially motivated. [Earth Lusca](https://attack.mitre.org/groups/G1006) has used malware commonly used by other Chinese threat groups, including [APT41](https://attack.mitre.org/groups/G0096) and the [Winnti Group](https://attack.mitre.org/groups/G0044) cluster, however security researchers assess [Earth Lusca](https://attack.mitre.org/groups/G1006)'s techniques and infrastructure are separate. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Earth Lusca.",
+ "mitre": "T1189, T1190, T1566.002, T1047, T1053.005, T1059.001, T1059.005, T1059.006, T1059.007, T1204.001, T1204.002, T1574.001, T1098.004, T1112, T1543.003, T1547.012, T1548.002, T1003.001, T1003.006, T1007, T1016, T1018, T1033, T1049",
+ "aliases": [
+ "Earth Lusca",
+ "TAG-22",
+ "Charcoal Typhoon",
+ "CHROMIUM",
+ "ControlX"
+ ],
+ "mitreGroupId": "G1006",
+ "mitreUrl": "https://attack.mitre.org/groups/G1006",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Earth Lusca with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1006. Aliases: Earth Lusca, TAG-22, Charcoal Typhoon, CHROMIUM, ControlX. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Defense Impairment, Reconnaissance, Resource Development, Stealth. Mapped techniques: T1189 Drive-by Compromise, T1190 Exploit Public-Facing Application, T1566.002 Spearphishing Link, T1047 Windows Management Instrumentation, T1053.005 Scheduled Task, T1059.001 PowerShell, T1059.005 Visual Basic, T1059.006 Python, T1059.007 JavaScript, T1204.001 Malicious Link, T1204.002 Malicious File, T1574.001 DLL, plus 32 additional mapped technique(s). Source: https://attack.mitre.org/groups/G1006. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Earth Lusca (G1006) ATT&CK technique pivots\n(rule.threat.technique.id:(T1189 OR T1190 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.005 OR T1059.006 OR T1059.007 OR T1204.001 OR T1204.002 OR T1574.001 OR T1098.004 OR T1112 OR T1543.003 OR T1547.012 OR T1548.002 OR T1003.001 OR T1003.006 OR T1007) OR threat.technique.id:(T1189 OR T1190 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.005 OR T1059.006 OR T1059.007 OR T1204.001 OR T1204.002 OR T1574.001 OR T1098.004 OR T1112 OR T1543.003 OR T1547.012 OR T1548.002 OR T1003.001 OR T1003.006 OR T1007) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Earth Lusca (G1006) ATT&CK technique pivots\n(rule.threat.technique.id:(T1189 OR T1190 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.005 OR T1059.006 OR T1059.007 OR T1204.001 OR T1204.002 OR T1574.001 OR T1098.004 OR T1112 OR T1543.003 OR T1547.012 OR T1548.002 OR T1003.001 OR T1003.006 OR T1007) OR threat.technique.id:(T1189 OR T1190 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.005 OR T1059.006 OR T1059.007 OR T1204.001 OR T1204.002 OR T1574.001 OR T1098.004 OR T1112 OR T1543.003 OR T1547.012 OR T1548.002 OR T1003.001 OR T1003.006 OR T1007) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Earth Lusca with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1189 OR T1190 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.005 OR T1059.006 OR T1059.007 OR T1204.001 OR T1204.002 OR T1574.001 OR T1098.004 OR T1112 OR T1543.003 OR T1547.012 OR T1548.002 OR T1003.001 OR T1003.006 OR T1007) OR threat.technique.id:(T1189 OR T1190 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.005 OR T1059.006 OR T1059.007 OR T1204.001 OR T1204.002 OR T1574.001 OR T1098.004 OR T1112 OR T1543.003 OR T1547.012 OR T1548.002 OR T1003.001 OR T1003.006 OR T1007) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1007-aoqin-dragon.json b/app/playbooks/threat-groups/apt-g1007-aoqin-dragon.json
new file mode 100644
index 0000000..edb2eff
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1007-aoqin-dragon.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g1007",
+ "num": 172,
+ "name": "MITRE ATT&CK Group — Aoqin Dragon",
+ "fullName": "Aoqin Dragon (G1007) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Aoqin Dragon](https://attack.mitre.org/groups/G1007) is a suspected Chinese cyber espionage threat group that has been active since at least 2013. [Aoqin Dragon](https://attack.mitre.org/groups/G1007) has primarily targeted government, education, and telecommunication organizations in Australia, Cambodia, Hong Kong, Singapore, and Vietnam. Security researchers noted a potential association between [Aoqin Dragon](https://attack.mitre.org/groups/G1007) and UNC94, based on malware, infrastructure, and targets. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Aoqin Dragon.",
+ "mitre": "T1091, T1203, T1204.002, T1083, T1570, T1587.001, T1588.002, T1027.002, T1036",
+ "aliases": [
+ "Aoqin Dragon"
+ ],
+ "mitreGroupId": "G1007",
+ "mitreUrl": "https://attack.mitre.org/groups/G1007",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Aoqin Dragon with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1007. Aliases: Aoqin Dragon. Primary mapped tactics: Initial Access, Execution, Discovery, Lateral Movement, Resource Development, Stealth. Mapped techniques: T1091 Replication Through Removable Media, T1203 Exploitation for Client Execution, T1204.002 Malicious File, T1083 File and Directory Discovery, T1570 Lateral Tool Transfer, T1587.001 Malware, T1588.002 Tool, T1027.002 Software Packing, T1036 Masquerading. Source: https://attack.mitre.org/groups/G1007. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Aoqin Dragon (G1007) ATT&CK technique pivots\n(rule.threat.technique.id:(T1091 OR T1203 OR T1204.002 OR T1083 OR T1570 OR T1587.001 OR T1588.002 OR T1027.002 OR T1036) OR threat.technique.id:(T1091 OR T1203 OR T1204.002 OR T1083 OR T1570 OR T1587.001 OR T1588.002 OR T1027.002 OR T1036) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Aoqin Dragon (G1007) ATT&CK technique pivots\n(rule.threat.technique.id:(T1091 OR T1203 OR T1204.002 OR T1083 OR T1570 OR T1587.001 OR T1588.002 OR T1027.002 OR T1036) OR threat.technique.id:(T1091 OR T1203 OR T1204.002 OR T1083 OR T1570 OR T1587.001 OR T1588.002 OR T1027.002 OR T1036) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Aoqin Dragon with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1091 OR T1203 OR T1204.002 OR T1083 OR T1570 OR T1587.001 OR T1588.002 OR T1027.002 OR T1036) OR threat.technique.id:(T1091 OR T1203 OR T1204.002 OR T1083 OR T1570 OR T1587.001 OR T1588.002 OR T1027.002 OR T1036) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1091\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1083\"\n[[rule.threat.technique]]\nid = \"T1570\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1091\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1083\"\n[[rule.threat.technique]]\nid = \"T1570\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1091\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1083\"\n[[rule.threat.technique]]\nid = \"T1570\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1091\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1083\"\n[[rule.threat.technique]]\nid = \"T1570\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1008-sidecopy.json b/app/playbooks/threat-groups/apt-g1008-sidecopy.json
new file mode 100644
index 0000000..afede2f
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1008-sidecopy.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g1008",
+ "num": 173,
+ "name": "MITRE ATT&CK Group — SideCopy",
+ "fullName": "SideCopy (G1008) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[SideCopy](https://attack.mitre.org/groups/G1008) is a Pakistani threat group that has primarily targeted South Asian countries, including Indian and Afghani government personnel, since at least 2019. [SideCopy](https://attack.mitre.org/groups/G1008)'s name comes from its infection chain that tries to mimic that of [Sidewinder](https://attack.mitre.org/groups/G0121), a suspected Indian threat group. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with SideCopy.",
+ "mitre": "T1566.001, T1059.005, T1106, T1204.002, T1574.001, T1016, T1082, T1518, T1518.001, T1614, T1105, T1598.002, T1584.001, T1608.001, T1036.005, T1218.005",
+ "aliases": [
+ "SideCopy"
+ ],
+ "mitreGroupId": "G1008",
+ "mitreUrl": "https://attack.mitre.org/groups/G1008",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile SideCopy with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1008. Aliases: SideCopy. Primary mapped tactics: Initial Access, Execution, Discovery, Command and Control, Reconnaissance, Resource Development, Stealth. Mapped techniques: T1566.001 Spearphishing Attachment, T1059.005 Visual Basic, T1106 Native API, T1204.002 Malicious File, T1574.001 DLL, T1016 System Network Configuration Discovery, T1082 System Information Discovery, T1518 Software Discovery, T1518.001 Security Software Discovery, T1614 System Location Discovery, T1105 Ingress Tool Transfer, T1598.002 Spearphishing Attachment, plus 4 additional mapped technique(s). Source: https://attack.mitre.org/groups/G1008. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - SideCopy (G1008) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1059.005 OR T1106 OR T1204.002 OR T1574.001 OR T1016 OR T1082 OR T1518 OR T1518.001 OR T1614 OR T1105 OR T1598.002 OR T1584.001 OR T1608.001 OR T1036.005 OR T1218.005) OR threat.technique.id:(T1566.001 OR T1059.005 OR T1106 OR T1204.002 OR T1574.001 OR T1016 OR T1082 OR T1518 OR T1518.001 OR T1614 OR T1105 OR T1598.002 OR T1584.001 OR T1608.001 OR T1036.005 OR T1218.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - SideCopy (G1008) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1059.005 OR T1106 OR T1204.002 OR T1574.001 OR T1016 OR T1082 OR T1518 OR T1518.001 OR T1614 OR T1105 OR T1598.002 OR T1584.001 OR T1608.001 OR T1036.005 OR T1218.005) OR threat.technique.id:(T1566.001 OR T1059.005 OR T1106 OR T1204.002 OR T1574.001 OR T1016 OR T1082 OR T1518 OR T1518.001 OR T1614 OR T1105 OR T1598.002 OR T1584.001 OR T1608.001 OR T1036.005 OR T1218.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile SideCopy with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1566.001 OR T1059.005 OR T1106 OR T1204.002 OR T1574.001 OR T1016 OR T1082 OR T1518 OR T1518.001 OR T1614 OR T1105 OR T1598.002 OR T1584.001 OR T1608.001 OR T1036.005 OR T1218.005) OR threat.technique.id:(T1566.001 OR T1059.005 OR T1106 OR T1204.002 OR T1574.001 OR T1016 OR T1082 OR T1518 OR T1518.001 OR T1614 OR T1105 OR T1598.002 OR T1584.001 OR T1608.001 OR T1036.005 OR T1218.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1106\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1574.001\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1106\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1574.001\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1106\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1574.001\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1106\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1574.001\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1009-moses-staff.json b/app/playbooks/threat-groups/apt-g1009-moses-staff.json
new file mode 100644
index 0000000..ed90d7e
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1009-moses-staff.json
@@ -0,0 +1,118 @@
+{
+ "id": "apt-g1009",
+ "num": 174,
+ "name": "MITRE ATT&CK Group — Moses Staff",
+ "fullName": "Moses Staff (G1009) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Moses Staff](https://attack.mitre.org/groups/G1009) is a suspected Iranian threat group that has primarily targeted Israeli companies since at least September 2021. [Moses Staff](https://attack.mitre.org/groups/G1009) openly stated their motivation in attacking Israeli companies is to cause damage by leaking stolen sensitive data and encrypting the victim's networks without a ransom demand. Security researchers assess [Moses Staff](https://attack.mitre.org/groups/G1009) is politically motivated, and has targeted government, finance, travel, energy, manufacturing, and utility companies outside of Israel as well, including those in Italy, India, Germany, Chile, Turkey, the UAE, and the US. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Moses Staff.",
+ "mitre": "T1190, T1505.003, T1016, T1082, T1087.001, T1021.002, T1105, T1553.002, T1686.003, T1587.001, T1588.002, T1027.013",
+ "aliases": [
+ "Moses Staff",
+ "DEV-0500",
+ "Marigold Sandstorm"
+ ],
+ "mitreGroupId": "G1009",
+ "mitreUrl": "https://attack.mitre.org/groups/G1009",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Moses Staff with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1009. Aliases: Moses Staff, DEV-0500, Marigold Sandstorm. Primary mapped tactics: Initial Access, Persistence, Discovery, Lateral Movement, Command and Control, Defense Impairment, Resource Development, Stealth. Mapped techniques: T1190 Exploit Public-Facing Application, T1505.003 Web Shell, T1016 System Network Configuration Discovery, T1082 System Information Discovery, T1087.001 Local Account, T1021.002 SMB/Windows Admin Shares, T1105 Ingress Tool Transfer, T1553.002 Code Signing, T1686.003 Windows Host Firewall, T1587.001 Malware, T1588.002 Tool, T1027.013 Encrypted/Encoded File. Source: https://attack.mitre.org/groups/G1009. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Moses Staff (G1009) ATT&CK technique pivots\n(rule.threat.technique.id:(T1190 OR T1505.003 OR T1016 OR T1082 OR T1087.001 OR T1021.002 OR T1105 OR T1553.002 OR T1686.003 OR T1587.001 OR T1588.002 OR T1027.013) OR threat.technique.id:(T1190 OR T1505.003 OR T1016 OR T1082 OR T1087.001 OR T1021.002 OR T1105 OR T1553.002 OR T1686.003 OR T1587.001 OR T1588.002 OR T1027.013) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Moses Staff (G1009) ATT&CK technique pivots\n(rule.threat.technique.id:(T1190 OR T1505.003 OR T1016 OR T1082 OR T1087.001 OR T1021.002 OR T1105 OR T1553.002 OR T1686.003 OR T1587.001 OR T1588.002 OR T1027.013) OR threat.technique.id:(T1190 OR T1505.003 OR T1016 OR T1082 OR T1087.001 OR T1021.002 OR T1105 OR T1553.002 OR T1686.003 OR T1587.001 OR T1588.002 OR T1027.013) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Moses Staff with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1190 OR T1505.003 OR T1016 OR T1082 OR T1087.001 OR T1021.002 OR T1105 OR T1553.002 OR T1686.003 OR T1587.001 OR T1588.002 OR T1027.013) OR threat.technique.id:(T1190 OR T1505.003 OR T1016 OR T1082 OR T1087.001 OR T1021.002 OR T1105 OR T1553.002 OR T1686.003 OR T1587.001 OR T1588.002 OR T1027.013) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1505.003\"\n[[rule.threat.technique]]\nid = \"T1016\"\n[[rule.threat.technique]]\nid = \"T1082\"\n[[rule.threat.technique]]\nid = \"T1087.001\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1505.003\"\n[[rule.threat.technique]]\nid = \"T1016\"\n[[rule.threat.technique]]\nid = \"T1082\"\n[[rule.threat.technique]]\nid = \"T1087.001\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1505.003\"\n[[rule.threat.technique]]\nid = \"T1016\"\n[[rule.threat.technique]]\nid = \"T1082\"\n[[rule.threat.technique]]\nid = \"T1087.001\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1505.003\"\n[[rule.threat.technique]]\nid = \"T1016\"\n[[rule.threat.technique]]\nid = \"T1082\"\n[[rule.threat.technique]]\nid = \"T1087.001\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1011-exotic-lily.json b/app/playbooks/threat-groups/apt-g1011-exotic-lily.json
new file mode 100644
index 0000000..bde1361
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1011-exotic-lily.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g1011",
+ "num": 175,
+ "name": "MITRE ATT&CK Group — EXOTIC LILY",
+ "fullName": "EXOTIC LILY (G1011) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[EXOTIC LILY](https://attack.mitre.org/groups/G1011) is a financially motivated group that has been closely linked with [Wizard Spider](https://attack.mitre.org/groups/G0102) and the deployment of ransomware including [Conti](https://attack.mitre.org/software/S0575) and [Diavol](https://attack.mitre.org/software/S0659). [EXOTIC LILY](https://attack.mitre.org/groups/G1011) may be acting as an initial access broker for other malicious actors, and has targeted a wide range of industries including IT, cybersecurity, and healthcare since at least September 2021. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with EXOTIC LILY.",
+ "mitre": "T1566.001, T1566.002, T1566.003, T1203, T1204.001, T1204.002, T1102, T1589.002, T1593.001, T1594, T1597, T1583.001, T1585.001, T1585.002, T1608.001",
+ "aliases": [
+ "EXOTIC LILY"
+ ],
+ "mitreGroupId": "G1011",
+ "mitreUrl": "https://attack.mitre.org/groups/G1011",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile EXOTIC LILY with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1011. Aliases: EXOTIC LILY. Primary mapped tactics: Initial Access, Execution, Command and Control, Reconnaissance, Resource Development. Mapped techniques: T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link, T1566.003 Spearphishing via Service, T1203 Exploitation for Client Execution, T1204.001 Malicious Link, T1204.002 Malicious File, T1102 Web Service, T1589.002 Email Addresses, T1593.001 Social Media, T1594 Search Victim-Owned Websites, T1597 Search Closed Sources, T1583.001 Domains, plus 3 additional mapped technique(s). Source: https://attack.mitre.org/groups/G1011. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - EXOTIC LILY (G1011) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1566.002 OR T1566.003 OR T1203 OR T1204.001 OR T1204.002 OR T1102 OR T1589.002 OR T1593.001 OR T1594 OR T1597 OR T1583.001 OR T1585.001 OR T1585.002 OR T1608.001) OR threat.technique.id:(T1566.001 OR T1566.002 OR T1566.003 OR T1203 OR T1204.001 OR T1204.002 OR T1102 OR T1589.002 OR T1593.001 OR T1594 OR T1597 OR T1583.001 OR T1585.001 OR T1585.002 OR T1608.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - EXOTIC LILY (G1011) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1566.002 OR T1566.003 OR T1203 OR T1204.001 OR T1204.002 OR T1102 OR T1589.002 OR T1593.001 OR T1594 OR T1597 OR T1583.001 OR T1585.001 OR T1585.002 OR T1608.001) OR threat.technique.id:(T1566.001 OR T1566.002 OR T1566.003 OR T1203 OR T1204.001 OR T1204.002 OR T1102 OR T1589.002 OR T1593.001 OR T1594 OR T1597 OR T1583.001 OR T1585.001 OR T1585.002 OR T1608.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile EXOTIC LILY with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1566.001 OR T1566.002 OR T1566.003 OR T1203 OR T1204.001 OR T1204.002 OR T1102 OR T1589.002 OR T1593.001 OR T1594 OR T1597 OR T1583.001 OR T1585.001 OR T1585.002 OR T1608.001) OR threat.technique.id:(T1566.001 OR T1566.002 OR T1566.003 OR T1203 OR T1204.001 OR T1204.002 OR T1102 OR T1589.002 OR T1593.001 OR T1594 OR T1597 OR T1583.001 OR T1585.001 OR T1585.002 OR T1608.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1566.003\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.001\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1566.003\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.001\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1566.003\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.001\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1566.003\"\n[[rule.threat.technique]]\nid = \"T1203\"\n[[rule.threat.technique]]\nid = \"T1204.001\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1012-curium.json b/app/playbooks/threat-groups/apt-g1012-curium.json
new file mode 100644
index 0000000..8ae4899
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1012-curium.json
@@ -0,0 +1,120 @@
+{
+ "id": "apt-g1012",
+ "num": 176,
+ "name": "MITRE ATT&CK Group — CURIUM",
+ "fullName": "CURIUM (G1012) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[CURIUM](https://attack.mitre.org/groups/G1012) is an Iranian threat group, first reported in September 2019 and active since at least July 2018, targeting IT service providers in the Middle East. [CURIUM](https://attack.mitre.org/groups/G1012) has since invested in building relationships with potential targets via social media over a period of months to establish trust and confidence before sending malware. Security researchers note [CURIUM](https://attack.mitre.org/groups/G1012) has demonstrated great patience and persistence by chatting with potential targets daily and sending benign files to help lower their security consciousness. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with CURIUM.",
+ "mitre": "T1189, T1566.001, T1566.003, T1059.001, T1204.002, T1505.003, T1082, T1124, T1005, T1041, T1048.002, T1598.003, T1583.001, T1583.003, T1583.004, T1584.006, T1585.001, T1585.002, T1608.004",
+ "aliases": [
+ "CURIUM",
+ "Crimson Sandstorm",
+ "TA456",
+ "Tortoise Shell",
+ "Yellow Liderc"
+ ],
+ "mitreGroupId": "G1012",
+ "mitreUrl": "https://attack.mitre.org/groups/G1012",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile CURIUM with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1012. Aliases: CURIUM, Crimson Sandstorm, TA456, Tortoise Shell, Yellow Liderc. Primary mapped tactics: Initial Access, Execution, Persistence, Discovery, Collection, Exfiltration, Reconnaissance, Resource Development. Mapped techniques: T1189 Drive-by Compromise, T1566.001 Spearphishing Attachment, T1566.003 Spearphishing via Service, T1059.001 PowerShell, T1204.002 Malicious File, T1505.003 Web Shell, T1082 System Information Discovery, T1124 System Time Discovery, T1005 Data from Local System, T1041 Exfiltration Over C2 Channel, T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol, T1598.003 Spearphishing Link, plus 7 additional mapped technique(s). Source: https://attack.mitre.org/groups/G1012. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - CURIUM (G1012) ATT&CK technique pivots\n(rule.threat.technique.id:(T1189 OR T1566.001 OR T1566.003 OR T1059.001 OR T1204.002 OR T1505.003 OR T1082 OR T1124 OR T1005 OR T1041 OR T1048.002 OR T1598.003 OR T1583.001 OR T1583.003 OR T1583.004 OR T1584.006 OR T1585.001 OR T1585.002 OR T1608.004) OR threat.technique.id:(T1189 OR T1566.001 OR T1566.003 OR T1059.001 OR T1204.002 OR T1505.003 OR T1082 OR T1124 OR T1005 OR T1041 OR T1048.002 OR T1598.003 OR T1583.001 OR T1583.003 OR T1583.004 OR T1584.006 OR T1585.001 OR T1585.002 OR T1608.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - CURIUM (G1012) ATT&CK technique pivots\n(rule.threat.technique.id:(T1189 OR T1566.001 OR T1566.003 OR T1059.001 OR T1204.002 OR T1505.003 OR T1082 OR T1124 OR T1005 OR T1041 OR T1048.002 OR T1598.003 OR T1583.001 OR T1583.003 OR T1583.004 OR T1584.006 OR T1585.001 OR T1585.002 OR T1608.004) OR threat.technique.id:(T1189 OR T1566.001 OR T1566.003 OR T1059.001 OR T1204.002 OR T1505.003 OR T1082 OR T1124 OR T1005 OR T1041 OR T1048.002 OR T1598.003 OR T1583.001 OR T1583.003 OR T1583.004 OR T1584.006 OR T1585.001 OR T1585.002 OR T1608.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile CURIUM with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1189 OR T1566.001 OR T1566.003 OR T1059.001 OR T1204.002 OR T1505.003 OR T1082 OR T1124 OR T1005 OR T1041 OR T1048.002 OR T1598.003 OR T1583.001 OR T1583.003 OR T1583.004 OR T1584.006 OR T1585.001 OR T1585.002 OR T1608.004) OR threat.technique.id:(T1189 OR T1566.001 OR T1566.003 OR T1059.001 OR T1204.002 OR T1505.003 OR T1082 OR T1124 OR T1005 OR T1041 OR T1048.002 OR T1598.003 OR T1583.001 OR T1583.003 OR T1583.004 OR T1584.006 OR T1585.001 OR T1585.002 OR T1608.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.003\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1204.002\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.003\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1204.002\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.003\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1204.002\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.003\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1204.002\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1013-metador.json b/app/playbooks/threat-groups/apt-g1013-metador.json
new file mode 100644
index 0000000..9c1f048
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1013-metador.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g1013",
+ "num": 177,
+ "name": "MITRE ATT&CK Group — Metador",
+ "fullName": "Metador (G1013) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Metador](https://attack.mitre.org/groups/G1013) is a suspected cyber espionage group that was first reported in September 2022. [Metador](https://attack.mitre.org/groups/G1013) has targeted a limited number of telecommunication companies, internet service providers, and universities in the Middle East and Africa. Security researchers named the group [Metador](https://attack.mitre.org/groups/G1013) based on the \"I am meta\" string in one of the group's malware samples and the expectation of Spanish-language responses from C2 servers. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Metador.",
+ "mitre": "T1059.003, T1546.003, T1071.001, T1095, T1105, T1588.001, T1588.002, T1027.013, T1070.004",
+ "aliases": [
+ "Metador"
+ ],
+ "mitreGroupId": "G1013",
+ "mitreUrl": "https://attack.mitre.org/groups/G1013",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Metador with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1013. Aliases: Metador. Primary mapped tactics: Execution, Persistence, Privilege Escalation, Command and Control, Resource Development, Stealth. Mapped techniques: T1059.003 Windows Command Shell, T1546.003 Windows Management Instrumentation Event Subscription, T1071.001 Web Protocols, T1095 Non-Application Layer Protocol, T1105 Ingress Tool Transfer, T1588.001 Malware, T1588.002 Tool, T1027.013 Encrypted/Encoded File, T1070.004 File Deletion. Source: https://attack.mitre.org/groups/G1013. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Metador (G1013) ATT&CK technique pivots\n(rule.threat.technique.id:(T1059.003 OR T1546.003 OR T1071.001 OR T1095 OR T1105 OR T1588.001 OR T1588.002 OR T1027.013 OR T1070.004) OR threat.technique.id:(T1059.003 OR T1546.003 OR T1071.001 OR T1095 OR T1105 OR T1588.001 OR T1588.002 OR T1027.013 OR T1070.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Metador (G1013) ATT&CK technique pivots\n(rule.threat.technique.id:(T1059.003 OR T1546.003 OR T1071.001 OR T1095 OR T1105 OR T1588.001 OR T1588.002 OR T1027.013 OR T1070.004) OR threat.technique.id:(T1059.003 OR T1546.003 OR T1071.001 OR T1095 OR T1105 OR T1588.001 OR T1588.002 OR T1027.013 OR T1070.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Metador with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1059.003 OR T1546.003 OR T1071.001 OR T1095 OR T1105 OR T1588.001 OR T1588.002 OR T1027.013 OR T1070.004) OR threat.technique.id:(T1059.003 OR T1546.003 OR T1071.001 OR T1095 OR T1105 OR T1588.001 OR T1588.002 OR T1027.013 OR T1070.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1546.003\"\n[[rule.threat.technique]]\nid = \"T1071.001\"\n[[rule.threat.technique]]\nid = \"T1095\"\n[[rule.threat.technique]]\nid = \"T1105\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1546.003\"\n[[rule.threat.technique]]\nid = \"T1071.001\"\n[[rule.threat.technique]]\nid = \"T1095\"\n[[rule.threat.technique]]\nid = \"T1105\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1546.003\"\n[[rule.threat.technique]]\nid = \"T1071.001\"\n[[rule.threat.technique]]\nid = \"T1095\"\n[[rule.threat.technique]]\nid = \"T1105\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1546.003\"\n[[rule.threat.technique]]\nid = \"T1071.001\"\n[[rule.threat.technique]]\nid = \"T1095\"\n[[rule.threat.technique]]\nid = \"T1105\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1014-luminousmoth.json b/app/playbooks/threat-groups/apt-g1014-luminousmoth.json
new file mode 100644
index 0000000..0a079c3
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1014-luminousmoth.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g1014",
+ "num": 178,
+ "name": "MITRE ATT&CK Group — LuminousMoth",
+ "fullName": "LuminousMoth (G1014) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[LuminousMoth](https://attack.mitre.org/groups/G1014) is a Chinese-speaking cyber espionage group that has been active since at least October 2020. [LuminousMoth](https://attack.mitre.org/groups/G1014) has targeted high-profile organizations, including government entities, in Myanmar, the Philippines, Thailand, and other parts of Southeast Asia. Some security researchers have concluded there is a connection between [LuminousMoth](https://attack.mitre.org/groups/G1014) and [Mustang Panda](https://attack.mitre.org/groups/G0129) based on similar targeting and TTPs, as well as network infrastructure overlaps. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with LuminousMoth.",
+ "mitre": "T1091, T1566.002, T1053.005, T1204.001, T1574.001, T1112, T1547.001, T1539, T1557.002, T1033, T1083, T1005, T1560, T1071.001, T1105, T1030, T1041, T1567.002, T1553.002, T1587.001, T1588.001, T1588.002, T1588.004, T1608.001",
+ "aliases": [
+ "LuminousMoth"
+ ],
+ "mitreGroupId": "G1014",
+ "mitreUrl": "https://attack.mitre.org/groups/G1014",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile LuminousMoth with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1014. Aliases: LuminousMoth. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Defense Impairment, Resource Development, Stealth. Mapped techniques: T1091 Replication Through Removable Media, T1566.002 Spearphishing Link, T1053.005 Scheduled Task, T1204.001 Malicious Link, T1574.001 DLL, T1112 Modify Registry, T1547.001 Registry Run Keys / Startup Folder, T1539 Steal Web Session Cookie, T1557.002 ARP Cache Poisoning, T1033 System Owner/User Discovery, T1083 File and Directory Discovery, T1005 Data from Local System, plus 16 additional mapped technique(s). Source: https://attack.mitre.org/groups/G1014. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - LuminousMoth (G1014) ATT&CK technique pivots\n(rule.threat.technique.id:(T1091 OR T1566.002 OR T1053.005 OR T1204.001 OR T1574.001 OR T1112 OR T1547.001 OR T1539 OR T1557.002 OR T1033 OR T1083 OR T1005 OR T1560 OR T1071.001 OR T1105 OR T1030 OR T1041 OR T1567.002 OR T1553.002 OR T1587.001) OR threat.technique.id:(T1091 OR T1566.002 OR T1053.005 OR T1204.001 OR T1574.001 OR T1112 OR T1547.001 OR T1539 OR T1557.002 OR T1033 OR T1083 OR T1005 OR T1560 OR T1071.001 OR T1105 OR T1030 OR T1041 OR T1567.002 OR T1553.002 OR T1587.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - LuminousMoth (G1014) ATT&CK technique pivots\n(rule.threat.technique.id:(T1091 OR T1566.002 OR T1053.005 OR T1204.001 OR T1574.001 OR T1112 OR T1547.001 OR T1539 OR T1557.002 OR T1033 OR T1083 OR T1005 OR T1560 OR T1071.001 OR T1105 OR T1030 OR T1041 OR T1567.002 OR T1553.002 OR T1587.001) OR threat.technique.id:(T1091 OR T1566.002 OR T1053.005 OR T1204.001 OR T1574.001 OR T1112 OR T1547.001 OR T1539 OR T1557.002 OR T1033 OR T1083 OR T1005 OR T1560 OR T1071.001 OR T1105 OR T1030 OR T1041 OR T1567.002 OR T1553.002 OR T1587.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile LuminousMoth with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1091 OR T1566.002 OR T1053.005 OR T1204.001 OR T1574.001 OR T1112 OR T1547.001 OR T1539 OR T1557.002 OR T1033 OR T1083 OR T1005 OR T1560 OR T1071.001 OR T1105 OR T1030 OR T1041 OR T1567.002 OR T1553.002 OR T1587.001) OR threat.technique.id:(T1091 OR T1566.002 OR T1053.005 OR T1204.001 OR T1574.001 OR T1112 OR T1547.001 OR T1539 OR T1557.002 OR T1033 OR T1083 OR T1005 OR T1560 OR T1071.001 OR T1105 OR T1030 OR T1041 OR T1567.002 OR T1553.002 OR T1587.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1091\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1204.001\"\n[[rule.threat.technique]]\nid = \"T1574.001\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1091\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1204.001\"\n[[rule.threat.technique]]\nid = \"T1574.001\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1091\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1204.001\"\n[[rule.threat.technique]]\nid = \"T1574.001\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1091\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1204.001\"\n[[rule.threat.technique]]\nid = \"T1574.001\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1015-scattered-spider.json b/app/playbooks/threat-groups/apt-g1015-scattered-spider.json
new file mode 100644
index 0000000..c8a26b1
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1015-scattered-spider.json
@@ -0,0 +1,120 @@
+{
+ "id": "apt-g1015",
+ "num": 179,
+ "name": "MITRE ATT&CK Group — Scattered Spider",
+ "fullName": "Scattered Spider (G1015) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Scattered Spider](https://attack.mitre.org/groups/G1015) is a native English-speaking cybercriminal group active since at least 2022. The group initially targeted customer relationship management (CRM) providers, business process outsourcing (BPO) firms, and telecommunications and technology companies before expanding in 2023 to gaming, hospitality, retail, managed service provider (MSP), manufacturing, and financial sectors. [Scattered Spider](https://attack.mitre.org/groups/G1015) relies heavily on social engineering, including impersonating IT and help-desk staff, to gain initial access, bypass multi-factor authentication (MFA), and compromise enterprise networks. The group has adapted its tooling to evade endpoint detection and response (EDR) defenses and used ransomware for financial gain. [Scattered Spider](https://attack.mitre.org/groups/G1015) had expanded into hybrid cloud and identity environments, using help-desk impersonation and MFA bypass to obtain administrator access in Okta, AWS, and Office 365. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Scattered Spider.",
+ "mitre": "T1078, T1078.004, T1133, T1059.001, T1059.004, T1204, T1098, T1098.003, T1136, T1543.002, T1556.006, T1556.009, T1068, T1484.002, T1003.003, T1539, T1552.001, T1552.004, T1555.005, T1621, T1016, T1018, T1069, T1069.002",
+ "aliases": [
+ "Scattered Spider",
+ "Roasted 0ktapus",
+ "Octo Tempest",
+ "Storm-0875",
+ "UNC3944"
+ ],
+ "mitreGroupId": "G1015",
+ "mitreUrl": "https://attack.mitre.org/groups/G1015",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Scattered Spider with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1015. Aliases: Scattered Spider, Roasted 0ktapus, Octo Tempest, Storm-0875, UNC3944. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact, Defense Impairment, Reconnaissance, Resource Development, Stealth. Mapped techniques: T1078 Valid Accounts, T1078.004 Cloud Accounts, T1133 External Remote Services, T1059.001 PowerShell, T1059.004 Unix Shell, T1204 User Execution, T1098 Account Manipulation, T1098.003 Additional Cloud Roles, T1136 Create Account, T1543.002 Systemd Service, T1556.006 Multi-Factor Authentication, T1556.009 Conditional Access Policies, plus 52 additional mapped technique(s). Source: https://attack.mitre.org/groups/G1015. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Scattered Spider (G1015) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1078.004 OR T1133 OR T1059.001 OR T1059.004 OR T1204 OR T1098 OR T1098.003 OR T1136 OR T1543.002 OR T1556.006 OR T1556.009 OR T1068 OR T1484.002 OR T1003.003 OR T1539 OR T1552.001 OR T1552.004 OR T1555.005 OR T1621) OR threat.technique.id:(T1078 OR T1078.004 OR T1133 OR T1059.001 OR T1059.004 OR T1204 OR T1098 OR T1098.003 OR T1136 OR T1543.002 OR T1556.006 OR T1556.009 OR T1068 OR T1484.002 OR T1003.003 OR T1539 OR T1552.001 OR T1552.004 OR T1555.005 OR T1621) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Scattered Spider (G1015) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1078.004 OR T1133 OR T1059.001 OR T1059.004 OR T1204 OR T1098 OR T1098.003 OR T1136 OR T1543.002 OR T1556.006 OR T1556.009 OR T1068 OR T1484.002 OR T1003.003 OR T1539 OR T1552.001 OR T1552.004 OR T1555.005 OR T1621) OR threat.technique.id:(T1078 OR T1078.004 OR T1133 OR T1059.001 OR T1059.004 OR T1204 OR T1098 OR T1098.003 OR T1136 OR T1543.002 OR T1556.006 OR T1556.009 OR T1068 OR T1484.002 OR T1003.003 OR T1539 OR T1552.001 OR T1552.004 OR T1555.005 OR T1621) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Scattered Spider with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1078.004 OR T1133 OR T1059.001 OR T1059.004 OR T1204 OR T1098 OR T1098.003 OR T1136 OR T1543.002 OR T1556.006 OR T1556.009 OR T1068 OR T1484.002 OR T1003.003 OR T1539 OR T1552.001 OR T1552.004 OR T1555.005 OR T1621) OR threat.technique.id:(T1078 OR T1078.004 OR T1133 OR T1059.001 OR T1059.004 OR T1204 OR T1098 OR T1098.003 OR T1136 OR T1543.002 OR T1556.006 OR T1556.009 OR T1068 OR T1484.002 OR T1003.003 OR T1539 OR T1552.001 OR T1552.004 OR T1555.005 OR T1621) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.004\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.004\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.004\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.004\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.004\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.004\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.004\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.004\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1016-fin13.json b/app/playbooks/threat-groups/apt-g1016-fin13.json
new file mode 100644
index 0000000..8dd94b3
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1016-fin13.json
@@ -0,0 +1,117 @@
+{
+ "id": "apt-g1016",
+ "num": 180,
+ "name": "MITRE ATT&CK Group — FIN13",
+ "fullName": "FIN13 (G1016) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[FIN13](https://attack.mitre.org/groups/G1016) is a financially motivated cyber threat group that has targeted the financial, retail, and hospitality industries in Mexico and Latin America, as early as 2016. [FIN13](https://attack.mitre.org/groups/G1016) achieves its objectives by stealing intellectual property, financial data, mergers and acquisition information, or PII. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with FIN13.",
+ "mitre": "T1078.001, T1133, T1190, T1047, T1053.005, T1059.001, T1059.003, T1059.005, T1574.001, T1098.007, T1136.001, T1505.003, T1547.001, T1556, T1134.003, T1003.001, T1003.002, T1003.003, T1056.001, T1552.001, T1016, T1016.001, T1046, T1049",
+ "aliases": [
+ "FIN13",
+ "Elephant Beetle"
+ ],
+ "mitreGroupId": "G1016",
+ "mitreUrl": "https://attack.mitre.org/groups/G1016",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile FIN13 with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1016. Aliases: FIN13, Elephant Beetle. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Impact, Defense Impairment, Reconnaissance, Resource Development, Stealth. Mapped techniques: T1078.001 Default Accounts, T1133 External Remote Services, T1190 Exploit Public-Facing Application, T1047 Windows Management Instrumentation, T1053.005 Scheduled Task, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1059.005 Visual Basic, T1574.001 DLL, T1098.007 Additional Local or Domain Groups, T1136.001 Local Account, T1505.003 Web Shell, plus 41 additional mapped technique(s). Source: https://attack.mitre.org/groups/G1016. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - FIN13 (G1016) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078.001 OR T1133 OR T1190 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1574.001 OR T1098.007 OR T1136.001 OR T1505.003 OR T1547.001 OR T1556 OR T1134.003 OR T1003.001 OR T1003.002 OR T1003.003 OR T1056.001 OR T1552.001) OR threat.technique.id:(T1078.001 OR T1133 OR T1190 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1574.001 OR T1098.007 OR T1136.001 OR T1505.003 OR T1547.001 OR T1556 OR T1134.003 OR T1003.001 OR T1003.002 OR T1003.003 OR T1056.001 OR T1552.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - FIN13 (G1016) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078.001 OR T1133 OR T1190 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1574.001 OR T1098.007 OR T1136.001 OR T1505.003 OR T1547.001 OR T1556 OR T1134.003 OR T1003.001 OR T1003.002 OR T1003.003 OR T1056.001 OR T1552.001) OR threat.technique.id:(T1078.001 OR T1133 OR T1190 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1574.001 OR T1098.007 OR T1136.001 OR T1505.003 OR T1547.001 OR T1556 OR T1134.003 OR T1003.001 OR T1003.002 OR T1003.003 OR T1056.001 OR T1552.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile FIN13 with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078.001 OR T1133 OR T1190 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1574.001 OR T1098.007 OR T1136.001 OR T1505.003 OR T1547.001 OR T1556 OR T1134.003 OR T1003.001 OR T1003.002 OR T1003.003 OR T1056.001 OR T1552.001) OR threat.technique.id:(T1078.001 OR T1133 OR T1190 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1574.001 OR T1098.007 OR T1136.001 OR T1505.003 OR T1547.001 OR T1556 OR T1134.003 OR T1003.001 OR T1003.002 OR T1003.003 OR T1056.001 OR T1552.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.001\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.001\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.001\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.001\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1017-volt-typhoon.json b/app/playbooks/threat-groups/apt-g1017-volt-typhoon.json
new file mode 100644
index 0000000..4b0716c
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1017-volt-typhoon.json
@@ -0,0 +1,123 @@
+{
+ "id": "apt-g1017",
+ "num": 181,
+ "name": "MITRE ATT&CK Group — Volt Typhoon",
+ "fullName": "Volt Typhoon (G1017) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Volt Typhoon](https://attack.mitre.org/groups/G1017) is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021, primarily targeting critical infrastructure organizations in the US and its territories including Guam. [Volt Typhoon](https://attack.mitre.org/groups/G1017)'s targeting and pattern of behavior have been assessed as pre-positioning to enable lateral movement to operational technology (OT) assets for potential destructive or disruptive attacks. [Volt Typhoon](https://attack.mitre.org/groups/G1017) has emphasized stealth in operations using web shells, living-off-the-land (LOTL) binaries, hands on keyboard activities, and stolen credentials.. The group has leveraged compromised SOHO routers to proxy command and control traffic and obscure its infrastructure, activity associated with the KV botnet.. Reporting indicates a separate initial access cluster, SYLVANITE, has been observed exploiting internet-facing edge devices and transferring access to [Volt Typhoon](https://attack.mitre.org/groups/G1017), also tracked as VOLTZITE, for follow-on operations. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Volt Typhoon.",
+ "mitre": "T1078, T1078.002, T1133, T1190, T1047, T1059.001, T1059.003, T1059.004, T1112, T1505.003, T1068, T1003.001, T1003.003, T1056.001, T1552, T1552.004, T1555, T1555.003, T1007, T1010, T1012, T1016, T1016.001, T1018",
+ "aliases": [
+ "Volt Typhoon",
+ "BRONZE SILHOUETTE",
+ "Vanguard Panda",
+ "DEV-0391",
+ "UNC3236",
+ "Voltzite",
+ "Insidious Taurus",
+ "DazedToad"
+ ],
+ "mitreGroupId": "G1017",
+ "mitreUrl": "https://attack.mitre.org/groups/G1017",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Volt Typhoon with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1017. Aliases: Volt Typhoon, BRONZE SILHOUETTE, Vanguard Panda, DEV-0391, UNC3236, Voltzite, Insidious Taurus, DazedToad. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Defense Impairment, Reconnaissance, Resource Development, Stealth. Mapped techniques: T1078 Valid Accounts, T1078.002 Domain Accounts, T1133 External Remote Services, T1190 Exploit Public-Facing Application, T1047 Windows Management Instrumentation, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1059.004 Unix Shell, T1112 Modify Registry, T1505.003 Web Shell, T1068 Exploitation for Privilege Escalation, T1003.001 LSASS Memory, plus 69 additional mapped technique(s). Source: https://attack.mitre.org/groups/G1017. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Volt Typhoon (G1017) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1078.002 OR T1133 OR T1190 OR T1047 OR T1059.001 OR T1059.003 OR T1059.004 OR T1112 OR T1505.003 OR T1068 OR T1003.001 OR T1003.003 OR T1056.001 OR T1552 OR T1552.004 OR T1555 OR T1555.003 OR T1007 OR T1010) OR threat.technique.id:(T1078 OR T1078.002 OR T1133 OR T1190 OR T1047 OR T1059.001 OR T1059.003 OR T1059.004 OR T1112 OR T1505.003 OR T1068 OR T1003.001 OR T1003.003 OR T1056.001 OR T1552 OR T1552.004 OR T1555 OR T1555.003 OR T1007 OR T1010) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Volt Typhoon (G1017) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1078.002 OR T1133 OR T1190 OR T1047 OR T1059.001 OR T1059.003 OR T1059.004 OR T1112 OR T1505.003 OR T1068 OR T1003.001 OR T1003.003 OR T1056.001 OR T1552 OR T1552.004 OR T1555 OR T1555.003 OR T1007 OR T1010) OR threat.technique.id:(T1078 OR T1078.002 OR T1133 OR T1190 OR T1047 OR T1059.001 OR T1059.003 OR T1059.004 OR T1112 OR T1505.003 OR T1068 OR T1003.001 OR T1003.003 OR T1056.001 OR T1552 OR T1552.004 OR T1555 OR T1555.003 OR T1007 OR T1010) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Volt Typhoon with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1078.002 OR T1133 OR T1190 OR T1047 OR T1059.001 OR T1059.003 OR T1059.004 OR T1112 OR T1505.003 OR T1068 OR T1003.001 OR T1003.003 OR T1056.001 OR T1552 OR T1552.004 OR T1555 OR T1555.003 OR T1007 OR T1010) OR threat.technique.id:(T1078 OR T1078.002 OR T1133 OR T1190 OR T1047 OR T1059.001 OR T1059.003 OR T1059.004 OR T1112 OR T1505.003 OR T1068 OR T1003.001 OR T1003.003 OR T1056.001 OR T1552 OR T1552.004 OR T1555 OR T1555.003 OR T1007 OR T1010) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1047\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1047\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1047\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1047\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1018-ta2541.json b/app/playbooks/threat-groups/apt-g1018-ta2541.json
new file mode 100644
index 0000000..fa021b3
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1018-ta2541.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g1018",
+ "num": 182,
+ "name": "MITRE ATT&CK Group — TA2541",
+ "fullName": "TA2541 (G1018) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[TA2541](https://attack.mitre.org/groups/G1018) is a cybercriminal group that has been targeting the aviation, aerospace, transportation, manufacturing, and defense industries since at least 2017. [TA2541](https://attack.mitre.org/groups/G1018) campaigns are typically high volume and involve the use of commodity remote access tools obfuscated by crypters and themes related to aviation, transportation, and travel. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with TA2541.",
+ "mitre": "T1566.001, T1566.002, T1047, T1053.005, T1059.001, T1059.005, T1204.001, T1204.002, T1547.001, T1055, T1055.012, T1016.001, T1082, T1518.001, T1105, T1568, T1573.002, T1685, T1583.001, T1583.006, T1588.001, T1588.002, T1608.001, T1027.002",
+ "aliases": [
+ "TA2541"
+ ],
+ "mitreGroupId": "G1018",
+ "mitreUrl": "https://attack.mitre.org/groups/G1018",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile TA2541 with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1018. Aliases: TA2541. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Discovery, Command and Control, Defense Impairment, Resource Development, Stealth. Mapped techniques: T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link, T1047 Windows Management Instrumentation, T1053.005 Scheduled Task, T1059.001 PowerShell, T1059.005 Visual Basic, T1204.001 Malicious Link, T1204.002 Malicious File, T1547.001 Registry Run Keys / Startup Folder, T1055 Process Injection, T1055.012 Process Hollowing, T1016.001 Internet Connection Discovery, plus 16 additional mapped technique(s). Source: https://attack.mitre.org/groups/G1018. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - TA2541 (G1018) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.005 OR T1204.001 OR T1204.002 OR T1547.001 OR T1055 OR T1055.012 OR T1016.001 OR T1082 OR T1518.001 OR T1105 OR T1568 OR T1573.002 OR T1685 OR T1583.001 OR T1583.006) OR threat.technique.id:(T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.005 OR T1204.001 OR T1204.002 OR T1547.001 OR T1055 OR T1055.012 OR T1016.001 OR T1082 OR T1518.001 OR T1105 OR T1568 OR T1573.002 OR T1685 OR T1583.001 OR T1583.006) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - TA2541 (G1018) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.005 OR T1204.001 OR T1204.002 OR T1547.001 OR T1055 OR T1055.012 OR T1016.001 OR T1082 OR T1518.001 OR T1105 OR T1568 OR T1573.002 OR T1685 OR T1583.001 OR T1583.006) OR threat.technique.id:(T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.005 OR T1204.001 OR T1204.002 OR T1547.001 OR T1055 OR T1055.012 OR T1016.001 OR T1082 OR T1518.001 OR T1105 OR T1568 OR T1573.002 OR T1685 OR T1583.001 OR T1583.006) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile TA2541 with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.005 OR T1204.001 OR T1204.002 OR T1547.001 OR T1055 OR T1055.012 OR T1016.001 OR T1082 OR T1518.001 OR T1105 OR T1568 OR T1573.002 OR T1685 OR T1583.001 OR T1583.006) OR threat.technique.id:(T1566.001 OR T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.005 OR T1204.001 OR T1204.002 OR T1547.001 OR T1055 OR T1055.012 OR T1016.001 OR T1082 OR T1518.001 OR T1105 OR T1568 OR T1573.002 OR T1685 OR T1583.001 OR T1583.006) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1019-moustachedbouncer.json b/app/playbooks/threat-groups/apt-g1019-moustachedbouncer.json
new file mode 100644
index 0000000..d5b45b0
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1019-moustachedbouncer.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g1019",
+ "num": 183,
+ "name": "MITRE ATT&CK Group — MoustachedBouncer",
+ "fullName": "MoustachedBouncer (G1019) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[MoustachedBouncer](https://attack.mitre.org/groups/G1019) is a cyberespionage group that has been active since at least 2014 targeting foreign embassies in Belarus. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with MoustachedBouncer.",
+ "mitre": "T1659, T1059.001, T1059.007, T1068, T1074.002, T1113, T1090, T1027.002",
+ "aliases": [
+ "MoustachedBouncer"
+ ],
+ "mitreGroupId": "G1019",
+ "mitreUrl": "https://attack.mitre.org/groups/G1019",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile MoustachedBouncer with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1019. Aliases: MoustachedBouncer. Primary mapped tactics: Initial Access, Execution, Privilege Escalation, Collection, Command and Control, Stealth. Mapped techniques: T1659 Content Injection, T1059.001 PowerShell, T1059.007 JavaScript, T1068 Exploitation for Privilege Escalation, T1074.002 Remote Data Staging, T1113 Screen Capture, T1090 Proxy, T1027.002 Software Packing. Source: https://attack.mitre.org/groups/G1019. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - MoustachedBouncer (G1019) ATT&CK technique pivots\n(rule.threat.technique.id:(T1659 OR T1059.001 OR T1059.007 OR T1068 OR T1074.002 OR T1113 OR T1090 OR T1027.002) OR threat.technique.id:(T1659 OR T1059.001 OR T1059.007 OR T1068 OR T1074.002 OR T1113 OR T1090 OR T1027.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - MoustachedBouncer (G1019) ATT&CK technique pivots\n(rule.threat.technique.id:(T1659 OR T1059.001 OR T1059.007 OR T1068 OR T1074.002 OR T1113 OR T1090 OR T1027.002) OR threat.technique.id:(T1659 OR T1059.001 OR T1059.007 OR T1068 OR T1074.002 OR T1113 OR T1090 OR T1027.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile MoustachedBouncer with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1659 OR T1059.001 OR T1059.007 OR T1068 OR T1074.002 OR T1113 OR T1090 OR T1027.002) OR threat.technique.id:(T1659 OR T1059.001 OR T1059.007 OR T1068 OR T1074.002 OR T1113 OR T1090 OR T1027.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1659\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.007\"\n[[rule.threat.technique]]\nid = \"T1068\"\n[[rule.threat.technique]]\nid = \"T1074.002\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1659\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.007\"\n[[rule.threat.technique]]\nid = \"T1068\"\n[[rule.threat.technique]]\nid = \"T1074.002\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1659\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.007\"\n[[rule.threat.technique]]\nid = \"T1068\"\n[[rule.threat.technique]]\nid = \"T1074.002\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1659\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.007\"\n[[rule.threat.technique]]\nid = \"T1068\"\n[[rule.threat.technique]]\nid = \"T1074.002\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1020-mustard-tempest.json b/app/playbooks/threat-groups/apt-g1020-mustard-tempest.json
new file mode 100644
index 0000000..3973eb9
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1020-mustard-tempest.json
@@ -0,0 +1,120 @@
+{
+ "id": "apt-g1020",
+ "num": 184,
+ "name": "MITRE ATT&CK Group — Mustard Tempest",
+ "fullName": "Mustard Tempest (G1020) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Mustard Tempest](https://attack.mitre.org/groups/G1020) is an initial access broker that has operated the [SocGholish](https://attack.mitre.org/software/S1124) distribution network since at least 2017. [Mustard Tempest](https://attack.mitre.org/groups/G1020) has partnered with [Indrik Spider](https://attack.mitre.org/groups/G0119) to provide access for the download of additional malware including LockBit, [WastedLocker](https://attack.mitre.org/software/S0612), and remote access tools. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Mustard Tempest.",
+ "mitre": "T1189, T1566.002, T1204.001, T1082, T1105, T1583.004, T1583.008, T1584.001, T1608.001, T1608.004, T1608.006, T1036.005",
+ "aliases": [
+ "Mustard Tempest",
+ "DEV-0206",
+ "TA569",
+ "GOLD PRELUDE",
+ "UNC1543"
+ ],
+ "mitreGroupId": "G1020",
+ "mitreUrl": "https://attack.mitre.org/groups/G1020",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Mustard Tempest with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1020. Aliases: Mustard Tempest, DEV-0206, TA569, GOLD PRELUDE, UNC1543. Primary mapped tactics: Initial Access, Execution, Discovery, Command and Control, Resource Development, Stealth. Mapped techniques: T1189 Drive-by Compromise, T1566.002 Spearphishing Link, T1204.001 Malicious Link, T1082 System Information Discovery, T1105 Ingress Tool Transfer, T1583.004 Server, T1583.008 Malvertising, T1584.001 Domains, T1608.001 Upload Malware, T1608.004 Drive-by Target, T1608.006 SEO Poisoning, T1036.005 Match Legitimate Resource Name or Location. Source: https://attack.mitre.org/groups/G1020. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Mustard Tempest (G1020) ATT&CK technique pivots\n(rule.threat.technique.id:(T1189 OR T1566.002 OR T1204.001 OR T1082 OR T1105 OR T1583.004 OR T1583.008 OR T1584.001 OR T1608.001 OR T1608.004 OR T1608.006 OR T1036.005) OR threat.technique.id:(T1189 OR T1566.002 OR T1204.001 OR T1082 OR T1105 OR T1583.004 OR T1583.008 OR T1584.001 OR T1608.001 OR T1608.004 OR T1608.006 OR T1036.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Mustard Tempest (G1020) ATT&CK technique pivots\n(rule.threat.technique.id:(T1189 OR T1566.002 OR T1204.001 OR T1082 OR T1105 OR T1583.004 OR T1583.008 OR T1584.001 OR T1608.001 OR T1608.004 OR T1608.006 OR T1036.005) OR threat.technique.id:(T1189 OR T1566.002 OR T1204.001 OR T1082 OR T1105 OR T1583.004 OR T1583.008 OR T1584.001 OR T1608.001 OR T1608.004 OR T1608.006 OR T1036.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Mustard Tempest with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1189 OR T1566.002 OR T1204.001 OR T1082 OR T1105 OR T1583.004 OR T1583.008 OR T1584.001 OR T1608.001 OR T1608.004 OR T1608.006 OR T1036.005) OR threat.technique.id:(T1189 OR T1566.002 OR T1204.001 OR T1082 OR T1105 OR T1583.004 OR T1583.008 OR T1584.001 OR T1608.001 OR T1608.004 OR T1608.006 OR T1036.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1204.001\"\n[[rule.threat.technique]]\nid = \"T1082\"\n[[rule.threat.technique]]\nid = \"T1105\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1204.001\"\n[[rule.threat.technique]]\nid = \"T1082\"\n[[rule.threat.technique]]\nid = \"T1105\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1204.001\"\n[[rule.threat.technique]]\nid = \"T1082\"\n[[rule.threat.technique]]\nid = \"T1105\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1204.001\"\n[[rule.threat.technique]]\nid = \"T1082\"\n[[rule.threat.technique]]\nid = \"T1105\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1021-cinnamon-tempest.json b/app/playbooks/threat-groups/apt-g1021-cinnamon-tempest.json
new file mode 100644
index 0000000..e67be22
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1021-cinnamon-tempest.json
@@ -0,0 +1,119 @@
+{
+ "id": "apt-g1021",
+ "num": 185,
+ "name": "MITRE ATT&CK Group — Cinnamon Tempest",
+ "fullName": "Cinnamon Tempest (G1021) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Cinnamon Tempest](https://attack.mitre.org/groups/G1021) is a China-based threat group that has been active since at least 2021 deploying multiple strains of ransomware based on the leaked [Babuk](https://attack.mitre.org/software/S0638) source code. [Cinnamon Tempest](https://attack.mitre.org/groups/G1021) does not operate their ransomware on an affiliate model or purchase access but appears to act independently in all stages of the attack lifecycle. Based on victimology, the short lifespan of each ransomware variant, and use of malware attributed to government-sponsored threat groups, [Cinnamon Tempest](https://attack.mitre.org/groups/G1021) may be motivated by intellectual property theft or cyberespionage rather than financial gain. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Cinnamon Tempest.",
+ "mitre": "T1078, T1078.002, T1190, T1047, T1059.001, T1059.003, T1059.006, T1574.001, T1543.003, T1484.001, T1021.002, T1080, T1090, T1105, T1572, T1567.002, T1657, T1588.002, T1140",
+ "aliases": [
+ "Cinnamon Tempest",
+ "DEV-0401",
+ "Emperor Dragonfly",
+ "BRONZE STARLIGHT"
+ ],
+ "mitreGroupId": "G1021",
+ "mitreUrl": "https://attack.mitre.org/groups/G1021",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Cinnamon Tempest with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1021. Aliases: Cinnamon Tempest, DEV-0401, Emperor Dragonfly, BRONZE STARLIGHT. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Lateral Movement, Command and Control, Exfiltration, Impact, Defense Impairment, Resource Development, Stealth. Mapped techniques: T1078 Valid Accounts, T1078.002 Domain Accounts, T1190 Exploit Public-Facing Application, T1047 Windows Management Instrumentation, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1059.006 Python, T1574.001 DLL, T1543.003 Windows Service, T1484.001 Group Policy Modification, T1021.002 SMB/Windows Admin Shares, T1080 Taint Shared Content, plus 7 additional mapped technique(s). Source: https://attack.mitre.org/groups/G1021. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Cinnamon Tempest (G1021) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1078.002 OR T1190 OR T1047 OR T1059.001 OR T1059.003 OR T1059.006 OR T1574.001 OR T1543.003 OR T1484.001 OR T1021.002 OR T1080 OR T1090 OR T1105 OR T1572 OR T1567.002 OR T1657 OR T1588.002 OR T1140) OR threat.technique.id:(T1078 OR T1078.002 OR T1190 OR T1047 OR T1059.001 OR T1059.003 OR T1059.006 OR T1574.001 OR T1543.003 OR T1484.001 OR T1021.002 OR T1080 OR T1090 OR T1105 OR T1572 OR T1567.002 OR T1657 OR T1588.002 OR T1140) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Cinnamon Tempest (G1021) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1078.002 OR T1190 OR T1047 OR T1059.001 OR T1059.003 OR T1059.006 OR T1574.001 OR T1543.003 OR T1484.001 OR T1021.002 OR T1080 OR T1090 OR T1105 OR T1572 OR T1567.002 OR T1657 OR T1588.002 OR T1140) OR threat.technique.id:(T1078 OR T1078.002 OR T1190 OR T1047 OR T1059.001 OR T1059.003 OR T1059.006 OR T1574.001 OR T1543.003 OR T1484.001 OR T1021.002 OR T1080 OR T1090 OR T1105 OR T1572 OR T1567.002 OR T1657 OR T1588.002 OR T1140) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Cinnamon Tempest with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1078.002 OR T1190 OR T1047 OR T1059.001 OR T1059.003 OR T1059.006 OR T1574.001 OR T1543.003 OR T1484.001 OR T1021.002 OR T1080 OR T1090 OR T1105 OR T1572 OR T1567.002 OR T1657 OR T1588.002 OR T1140) OR threat.technique.id:(T1078 OR T1078.002 OR T1190 OR T1047 OR T1059.001 OR T1059.003 OR T1059.006 OR T1574.001 OR T1543.003 OR T1484.001 OR T1021.002 OR T1080 OR T1090 OR T1105 OR T1572 OR T1567.002 OR T1657 OR T1588.002 OR T1140) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1022-toddycat.json b/app/playbooks/threat-groups/apt-g1022-toddycat.json
new file mode 100644
index 0000000..faf2850
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1022-toddycat.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g1022",
+ "num": 186,
+ "name": "MITRE ATT&CK Group — ToddyCat",
+ "fullName": "ToddyCat (G1022) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[ToddyCat](https://attack.mitre.org/groups/G1022) is a sophisticated threat group that has been active since at least 2020 using custom loaders and malware in multi-stage infection chains against government and military targets across Europe and Asia. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with ToddyCat.",
+ "mitre": "T1078.002, T1190, T1566.003, T1047, T1053.005, T1059.001, T1059.003, T1106, T1018, T1049, T1057, T1069.002, T1083, T1087.002, T1518.001, T1680, T1021.002, T1005, T1074.002, T1560.001, T1095, T1567.002, T1686, T1036.005",
+ "aliases": [
+ "ToddyCat"
+ ],
+ "mitreGroupId": "G1022",
+ "mitreUrl": "https://attack.mitre.org/groups/G1022",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile ToddyCat with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1022. Aliases: ToddyCat. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Defense Impairment, Stealth. Mapped techniques: T1078.002 Domain Accounts, T1190 Exploit Public-Facing Application, T1566.003 Spearphishing via Service, T1047 Windows Management Instrumentation, T1053.005 Scheduled Task, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1106 Native API, T1018 Remote System Discovery, T1049 System Network Connections Discovery, T1057 Process Discovery, T1069.002 Domain Groups, plus 13 additional mapped technique(s). Source: https://attack.mitre.org/groups/G1022. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - ToddyCat (G1022) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078.002 OR T1190 OR T1566.003 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1106 OR T1018 OR T1049 OR T1057 OR T1069.002 OR T1083 OR T1087.002 OR T1518.001 OR T1680 OR T1021.002 OR T1005 OR T1074.002 OR T1560.001) OR threat.technique.id:(T1078.002 OR T1190 OR T1566.003 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1106 OR T1018 OR T1049 OR T1057 OR T1069.002 OR T1083 OR T1087.002 OR T1518.001 OR T1680 OR T1021.002 OR T1005 OR T1074.002 OR T1560.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - ToddyCat (G1022) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078.002 OR T1190 OR T1566.003 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1106 OR T1018 OR T1049 OR T1057 OR T1069.002 OR T1083 OR T1087.002 OR T1518.001 OR T1680 OR T1021.002 OR T1005 OR T1074.002 OR T1560.001) OR threat.technique.id:(T1078.002 OR T1190 OR T1566.003 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1106 OR T1018 OR T1049 OR T1057 OR T1069.002 OR T1083 OR T1087.002 OR T1518.001 OR T1680 OR T1021.002 OR T1005 OR T1074.002 OR T1560.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile ToddyCat with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078.002 OR T1190 OR T1566.003 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1106 OR T1018 OR T1049 OR T1057 OR T1069.002 OR T1083 OR T1087.002 OR T1518.001 OR T1680 OR T1021.002 OR T1005 OR T1074.002 OR T1560.001) OR threat.technique.id:(T1078.002 OR T1190 OR T1566.003 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1106 OR T1018 OR T1049 OR T1057 OR T1069.002 OR T1083 OR T1087.002 OR T1518.001 OR T1680 OR T1021.002 OR T1005 OR T1074.002 OR T1560.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566.003\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566.003\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566.003\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566.003\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1023-apt5.json b/app/playbooks/threat-groups/apt-g1023-apt5.json
new file mode 100644
index 0000000..a685e74
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1023-apt5.json
@@ -0,0 +1,121 @@
+{
+ "id": "apt-g1023",
+ "num": 187,
+ "name": "MITRE ATT&CK Group — APT5",
+ "fullName": "APT5 (G1023) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[APT5](https://attack.mitre.org/groups/G1023) is a China-based espionage actor that has been active since at least 2007 primarily targeting the telecommunications, aerospace, and defense industries throughout the U.S., Europe, and Asia. [APT5](https://attack.mitre.org/groups/G1023) has displayed advanced tradecraft and significant interest in compromising networking devices and their underlying software including through the use of zero-day exploits. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with APT5.",
+ "mitre": "T1078.002, T1078.004, T1190, T1053.003, T1059.001, T1059.003, T1098.007, T1136.001, T1505.003, T1554, T1055, T1003.001, T1003.002, T1056.001, T1049, T1057, T1083, T1654, T1021.001, T1021.004, T1074.001, T1560.001, T1685, T1583.005",
+ "aliases": [
+ "APT5",
+ "Mulberry Typhoon",
+ "MANGANESE",
+ "BRONZE FLEETWOOD",
+ "Keyhole Panda",
+ "UNC2630"
+ ],
+ "mitreGroupId": "G1023",
+ "mitreUrl": "https://attack.mitre.org/groups/G1023",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile APT5 with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1023. Aliases: APT5, Mulberry Typhoon, MANGANESE, BRONZE FLEETWOOD, Keyhole Panda, UNC2630. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Defense Impairment, Resource Development, Stealth. Mapped techniques: T1078.002 Domain Accounts, T1078.004 Cloud Accounts, T1190 Exploit Public-Facing Application, T1053.003 Cron, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1098.007 Additional Local or Domain Groups, T1136.001 Local Account, T1505.003 Web Shell, T1554 Compromise Host Software Binary, T1055 Process Injection, T1003.001 LSASS Memory, plus 17 additional mapped technique(s). Source: https://attack.mitre.org/groups/G1023. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - APT5 (G1023) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078.002 OR T1078.004 OR T1190 OR T1053.003 OR T1059.001 OR T1059.003 OR T1098.007 OR T1136.001 OR T1505.003 OR T1554 OR T1055 OR T1003.001 OR T1003.002 OR T1056.001 OR T1049 OR T1057 OR T1083 OR T1654 OR T1021.001 OR T1021.004) OR threat.technique.id:(T1078.002 OR T1078.004 OR T1190 OR T1053.003 OR T1059.001 OR T1059.003 OR T1098.007 OR T1136.001 OR T1505.003 OR T1554 OR T1055 OR T1003.001 OR T1003.002 OR T1056.001 OR T1049 OR T1057 OR T1083 OR T1654 OR T1021.001 OR T1021.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - APT5 (G1023) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078.002 OR T1078.004 OR T1190 OR T1053.003 OR T1059.001 OR T1059.003 OR T1098.007 OR T1136.001 OR T1505.003 OR T1554 OR T1055 OR T1003.001 OR T1003.002 OR T1056.001 OR T1049 OR T1057 OR T1083 OR T1654 OR T1021.001 OR T1021.004) OR threat.technique.id:(T1078.002 OR T1078.004 OR T1190 OR T1053.003 OR T1059.001 OR T1059.003 OR T1098.007 OR T1136.001 OR T1505.003 OR T1554 OR T1055 OR T1003.001 OR T1003.002 OR T1056.001 OR T1049 OR T1057 OR T1083 OR T1654 OR T1021.001 OR T1021.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile APT5 with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078.002 OR T1078.004 OR T1190 OR T1053.003 OR T1059.001 OR T1059.003 OR T1098.007 OR T1136.001 OR T1505.003 OR T1554 OR T1055 OR T1003.001 OR T1003.002 OR T1056.001 OR T1049 OR T1057 OR T1083 OR T1654 OR T1021.001 OR T1021.004) OR threat.technique.id:(T1078.002 OR T1078.004 OR T1190 OR T1053.003 OR T1059.001 OR T1059.003 OR T1098.007 OR T1136.001 OR T1505.003 OR T1554 OR T1055 OR T1003.001 OR T1003.002 OR T1056.001 OR T1049 OR T1057 OR T1083 OR T1654 OR T1021.001 OR T1021.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1078.004\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1053.003\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1078.004\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1053.003\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1078.004\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1053.003\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1078.004\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1053.003\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1024-akira.json b/app/playbooks/threat-groups/apt-g1024-akira.json
new file mode 100644
index 0000000..b293613
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1024-akira.json
@@ -0,0 +1,119 @@
+{
+ "id": "apt-g1024",
+ "num": 188,
+ "name": "MITRE ATT&CK Group — Akira",
+ "fullName": "Akira (G1024) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Akira](https://attack.mitre.org/groups/G1024) is a ransomware variant and ransomware deployment entity active since at least March 2023. [Akira](https://attack.mitre.org/groups/G1024) uses compromised credentials to access single-factor external access mechanisms such as VPNs for initial access, then various publicly-available tools and techniques for lateral movement. [Akira](https://attack.mitre.org/groups/G1024) operations are associated with \"double extortion\" ransomware activity, where data is exfiltrated from victim environments prior to encryption, with threats to publish files if a ransom is not paid. Technical analysis of [Akira](https://attack.mitre.org/software/S1129) ransomware indicates variants capable of targeting Windows or VMWare ESXi hypervisors and multiple overlaps with [Conti](https://attack.mitre.org/software/S0575) ransomware. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Akira.",
+ "mitre": "T1078, T1133, T1059.001, T1558, T1018, T1482, T1021.001, T1213.002, T1560.001, T1219, T1567.002, T1486, T1531, T1657, T1685, T1027.001, T1036.005",
+ "aliases": [
+ "Akira",
+ "GOLD SAHARA",
+ "PUNK SPIDER",
+ "Howling Scorpius"
+ ],
+ "mitreGroupId": "G1024",
+ "mitreUrl": "https://attack.mitre.org/groups/G1024",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Akira with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1024. Aliases: Akira, GOLD SAHARA, PUNK SPIDER, Howling Scorpius. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact, Defense Impairment, Stealth. Mapped techniques: T1078 Valid Accounts, T1133 External Remote Services, T1059.001 PowerShell, T1558 Steal or Forge Kerberos Tickets, T1018 Remote System Discovery, T1482 Domain Trust Discovery, T1021.001 Remote Desktop Protocol, T1213.002 Sharepoint, T1560.001 Archive via Utility, T1219 Remote Access Tools, T1567.002 Exfiltration to Cloud Storage, T1486 Data Encrypted for Impact, plus 5 additional mapped technique(s). Source: https://attack.mitre.org/groups/G1024. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Akira (G1024) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1133 OR T1059.001 OR T1558 OR T1018 OR T1482 OR T1021.001 OR T1213.002 OR T1560.001 OR T1219 OR T1567.002 OR T1486 OR T1531 OR T1657 OR T1685 OR T1027.001 OR T1036.005) OR threat.technique.id:(T1078 OR T1133 OR T1059.001 OR T1558 OR T1018 OR T1482 OR T1021.001 OR T1213.002 OR T1560.001 OR T1219 OR T1567.002 OR T1486 OR T1531 OR T1657 OR T1685 OR T1027.001 OR T1036.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Akira (G1024) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1133 OR T1059.001 OR T1558 OR T1018 OR T1482 OR T1021.001 OR T1213.002 OR T1560.001 OR T1219 OR T1567.002 OR T1486 OR T1531 OR T1657 OR T1685 OR T1027.001 OR T1036.005) OR threat.technique.id:(T1078 OR T1133 OR T1059.001 OR T1558 OR T1018 OR T1482 OR T1021.001 OR T1213.002 OR T1560.001 OR T1219 OR T1567.002 OR T1486 OR T1531 OR T1657 OR T1685 OR T1027.001 OR T1036.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Akira with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1133 OR T1059.001 OR T1558 OR T1018 OR T1482 OR T1021.001 OR T1213.002 OR T1560.001 OR T1219 OR T1567.002 OR T1486 OR T1531 OR T1657 OR T1685 OR T1027.001 OR T1036.005) OR threat.technique.id:(T1078 OR T1133 OR T1059.001 OR T1558 OR T1018 OR T1482 OR T1021.001 OR T1213.002 OR T1560.001 OR T1219 OR T1567.002 OR T1486 OR T1531 OR T1657 OR T1685 OR T1027.001 OR T1036.005) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1558\"\n[[rule.threat.technique]]\nid = \"T1018\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1558\"\n[[rule.threat.technique]]\nid = \"T1018\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1558\"\n[[rule.threat.technique]]\nid = \"T1018\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1558\"\n[[rule.threat.technique]]\nid = \"T1018\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1026-malteiro.json b/app/playbooks/threat-groups/apt-g1026-malteiro.json
new file mode 100644
index 0000000..3b1e134
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1026-malteiro.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g1026",
+ "num": 189,
+ "name": "MITRE ATT&CK Group — Malteiro",
+ "fullName": "Malteiro (G1026) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Malteiro](https://attack.mitre.org/groups/G1026) is a financially motivated criminal group that is likely based in Brazil and has been active since at least November 2019. The group operates and distributes the [Mispadu](https://attack.mitre.org/software/S1122) banking trojan via a Malware-as-a-Service (MaaS) business model. [Malteiro](https://attack.mitre.org/groups/G1026) mainly targets victims throughout Latin America (particularly Mexico) and Europe (particularly Spain and Portugal). This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Malteiro.",
+ "mitre": "T1566.001, T1059.005, T1204.002, T1055.001, T1555, T1555.003, T1082, T1518.001, T1614.001, T1657, T1027.013, T1140",
+ "aliases": [
+ "Malteiro"
+ ],
+ "mitreGroupId": "G1026",
+ "mitreUrl": "https://attack.mitre.org/groups/G1026",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Malteiro with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1026. Aliases: Malteiro. Primary mapped tactics: Initial Access, Execution, Privilege Escalation, Credential Access, Discovery, Impact, Stealth. Mapped techniques: T1566.001 Spearphishing Attachment, T1059.005 Visual Basic, T1204.002 Malicious File, T1055.001 Dynamic-link Library Injection, T1555 Credentials from Password Stores, T1555.003 Credentials from Web Browsers, T1082 System Information Discovery, T1518.001 Security Software Discovery, T1614.001 System Language Discovery, T1657 Financial Theft, T1027.013 Encrypted/Encoded File, T1140 Deobfuscate/Decode Files or Information. Source: https://attack.mitre.org/groups/G1026. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Malteiro (G1026) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1059.005 OR T1204.002 OR T1055.001 OR T1555 OR T1555.003 OR T1082 OR T1518.001 OR T1614.001 OR T1657 OR T1027.013 OR T1140) OR threat.technique.id:(T1566.001 OR T1059.005 OR T1204.002 OR T1055.001 OR T1555 OR T1555.003 OR T1082 OR T1518.001 OR T1614.001 OR T1657 OR T1027.013 OR T1140) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Malteiro (G1026) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1059.005 OR T1204.002 OR T1055.001 OR T1555 OR T1555.003 OR T1082 OR T1518.001 OR T1614.001 OR T1657 OR T1027.013 OR T1140) OR threat.technique.id:(T1566.001 OR T1059.005 OR T1204.002 OR T1055.001 OR T1555 OR T1555.003 OR T1082 OR T1518.001 OR T1614.001 OR T1657 OR T1027.013 OR T1140) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Malteiro with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1566.001 OR T1059.005 OR T1204.002 OR T1055.001 OR T1555 OR T1555.003 OR T1082 OR T1518.001 OR T1614.001 OR T1657 OR T1027.013 OR T1140) OR threat.technique.id:(T1566.001 OR T1059.005 OR T1204.002 OR T1055.001 OR T1555 OR T1555.003 OR T1082 OR T1518.001 OR T1614.001 OR T1657 OR T1027.013 OR T1140) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1055.001\"\n[[rule.threat.technique]]\nid = \"T1555\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1055.001\"\n[[rule.threat.technique]]\nid = \"T1555\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1055.001\"\n[[rule.threat.technique]]\nid = \"T1555\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1055.001\"\n[[rule.threat.technique]]\nid = \"T1555\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1028-apt-c-23.json b/app/playbooks/threat-groups/apt-g1028-apt-c-23.json
new file mode 100644
index 0000000..26b9cf8
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1028-apt-c-23.json
@@ -0,0 +1,123 @@
+{
+ "id": "apt-g1028",
+ "num": 190,
+ "name": "MITRE ATT&CK Group — APT-C-23",
+ "fullName": "APT-C-23 (G1028) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[APT-C-23](https://attack.mitre.org/groups/G1028) is a threat group that has been active since at least 2014. [APT-C-23](https://attack.mitre.org/groups/G1028) has primarily focused its operations on the Middle East, including Israeli military assets. [APT-C-23](https://attack.mitre.org/groups/G1028) has developed mobile spyware targeting Android and iOS devices since 2017. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with APT-C-23.",
+ "mitre": "",
+ "aliases": [
+ "APT-C-23",
+ "Mantis",
+ "Arid Viper",
+ "Desert Falcon",
+ "TAG-63",
+ "Grey Karkadann",
+ "Big Bang APT",
+ "Two-tailed Scorpion"
+ ],
+ "mitreGroupId": "G1028",
+ "mitreUrl": "https://attack.mitre.org/groups/G1028",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile APT-C-23 with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1028. Aliases: APT-C-23, Mantis, Arid Viper, Desert Falcon, TAG-63, Grey Karkadann, Big Bang APT, Two-tailed Scorpion. Primary mapped tactics: No explicit tactics mapped. Mapped techniques: No ATT&CK techniques are currently mapped in MITRE CTI for this group.. Source: https://attack.mitre.org/groups/G1028. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - APT-C-23 (G1028) ATT&CK technique pivots\n(rule.threat.technique.id:(Gxxxx) OR threat.technique.id:(Gxxxx) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - APT-C-23 (G1028) ATT&CK technique pivots\n(rule.threat.technique.id:(Gxxxx) OR threat.technique.id:(Gxxxx) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile APT-C-23 with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(Gxxxx) OR threat.technique.id:(Gxxxx) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''"
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''"
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''"
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''"
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1030-agrius.json b/app/playbooks/threat-groups/apt-g1030-agrius.json
new file mode 100644
index 0000000..ae7bee5
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1030-agrius.json
@@ -0,0 +1,120 @@
+{
+ "id": "apt-g1030",
+ "num": 191,
+ "name": "MITRE ATT&CK Group — Agrius",
+ "fullName": "Agrius (G1030) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Agrius](https://attack.mitre.org/groups/G1030) is an Iranian threat actor active since 2020 notable for a series of ransomware and wiper operations in the Middle East, with an emphasis on Israeli targets. Public reporting has linked [Agrius](https://attack.mitre.org/groups/G1030) to Iran's Ministry of Intelligence and Security (MOIS). This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Agrius.",
+ "mitre": "T1078.002, T1190, T1059.003, T1505.003, T1543.003, T1003.001, T1003.002, T1110, T1110.003, T1018, T1046, T1021.001, T1570, T1005, T1074.001, T1119, T1560.001, T1041, T1685, T1583, T1036, T1140",
+ "aliases": [
+ "Agrius",
+ "Pink Sandstorm",
+ "AMERICIUM",
+ "Agonizing Serpens",
+ "BlackShadow"
+ ],
+ "mitreGroupId": "G1030",
+ "mitreUrl": "https://attack.mitre.org/groups/G1030",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Agrius with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1030. Aliases: Agrius, Pink Sandstorm, AMERICIUM, Agonizing Serpens, BlackShadow. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Defense Impairment, Resource Development, Stealth. Mapped techniques: T1078.002 Domain Accounts, T1190 Exploit Public-Facing Application, T1059.003 Windows Command Shell, T1505.003 Web Shell, T1543.003 Windows Service, T1003.001 LSASS Memory, T1003.002 Security Account Manager, T1110 Brute Force, T1110.003 Password Spraying, T1018 Remote System Discovery, T1046 Network Service Discovery, T1021.001 Remote Desktop Protocol, plus 10 additional mapped technique(s). Source: https://attack.mitre.org/groups/G1030. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Agrius (G1030) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078.002 OR T1190 OR T1059.003 OR T1505.003 OR T1543.003 OR T1003.001 OR T1003.002 OR T1110 OR T1110.003 OR T1018 OR T1046 OR T1021.001 OR T1570 OR T1005 OR T1074.001 OR T1119 OR T1560.001 OR T1041 OR T1685 OR T1583) OR threat.technique.id:(T1078.002 OR T1190 OR T1059.003 OR T1505.003 OR T1543.003 OR T1003.001 OR T1003.002 OR T1110 OR T1110.003 OR T1018 OR T1046 OR T1021.001 OR T1570 OR T1005 OR T1074.001 OR T1119 OR T1560.001 OR T1041 OR T1685 OR T1583) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Agrius (G1030) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078.002 OR T1190 OR T1059.003 OR T1505.003 OR T1543.003 OR T1003.001 OR T1003.002 OR T1110 OR T1110.003 OR T1018 OR T1046 OR T1021.001 OR T1570 OR T1005 OR T1074.001 OR T1119 OR T1560.001 OR T1041 OR T1685 OR T1583) OR threat.technique.id:(T1078.002 OR T1190 OR T1059.003 OR T1505.003 OR T1543.003 OR T1003.001 OR T1003.002 OR T1110 OR T1110.003 OR T1018 OR T1046 OR T1021.001 OR T1570 OR T1005 OR T1074.001 OR T1119 OR T1560.001 OR T1041 OR T1685 OR T1583) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Agrius with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078.002 OR T1190 OR T1059.003 OR T1505.003 OR T1543.003 OR T1003.001 OR T1003.002 OR T1110 OR T1110.003 OR T1018 OR T1046 OR T1021.001 OR T1570 OR T1005 OR T1074.001 OR T1119 OR T1560.001 OR T1041 OR T1685 OR T1583) OR threat.technique.id:(T1078.002 OR T1190 OR T1059.003 OR T1505.003 OR T1543.003 OR T1003.001 OR T1003.002 OR T1110 OR T1110.003 OR T1018 OR T1046 OR T1021.001 OR T1570 OR T1005 OR T1074.001 OR T1119 OR T1560.001 OR T1041 OR T1685 OR T1583) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1505.003\"\n[[rule.threat.technique]]\nid = \"T1543.003\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1505.003\"\n[[rule.threat.technique]]\nid = \"T1543.003\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1505.003\"\n[[rule.threat.technique]]\nid = \"T1543.003\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1505.003\"\n[[rule.threat.technique]]\nid = \"T1543.003\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1031-saint-bear.json b/app/playbooks/threat-groups/apt-g1031-saint-bear.json
new file mode 100644
index 0000000..b0bc45e
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1031-saint-bear.json
@@ -0,0 +1,120 @@
+{
+ "id": "apt-g1031",
+ "num": 192,
+ "name": "MITRE ATT&CK Group — Saint Bear",
+ "fullName": "Saint Bear (G1031) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Saint Bear](https://attack.mitre.org/groups/G1031) is a Russian-nexus threat actor active since early 2021, primarily targeting entities in Ukraine and Georgia. The group is notable for a specific remote access tool, [Saint Bot](https://attack.mitre.org/software/S1018), and information stealer, [OutSteel](https://attack.mitre.org/software/S1017) in campaigns. [Saint Bear](https://attack.mitre.org/groups/G1031) typically relies on phishing or web staging of malicious documents and related file types for initial access, spoofing government or related entities. [Saint Bear](https://attack.mitre.org/groups/G1031) has previously been confused with [Ember Bear](https://attack.mitre.org/groups/G1003) operations, but analysis of behaviors, tools, and targeting indicates these are distinct clusters. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Saint Bear.",
+ "mitre": "T1566.001, T1059, T1059.001, T1059.003, T1059.007, T1203, T1204.001, T1204.002, T1112, T1497, T1553.002, T1685, T1589.002, T1583.006, T1608.001, T1027.002, T1027.013, T1684.001",
+ "aliases": [
+ "Saint Bear",
+ "Storm-0587",
+ "TA471",
+ "UAC-0056",
+ "Lorec53"
+ ],
+ "mitreGroupId": "G1031",
+ "mitreUrl": "https://attack.mitre.org/groups/G1031",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Saint Bear with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1031. Aliases: Saint Bear, Storm-0587, TA471, UAC-0056, Lorec53. Primary mapped tactics: Initial Access, Execution, Persistence, Discovery, Defense Impairment, Reconnaissance, Resource Development, Stealth. Mapped techniques: T1566.001 Spearphishing Attachment, T1059 Command and Scripting Interpreter, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1059.007 JavaScript, T1203 Exploitation for Client Execution, T1204.001 Malicious Link, T1204.002 Malicious File, T1112 Modify Registry, T1497 Virtualization/Sandbox Evasion, T1553.002 Code Signing, T1685 Disable or Modify Tools, plus 6 additional mapped technique(s). Source: https://attack.mitre.org/groups/G1031. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Saint Bear (G1031) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1059 OR T1059.001 OR T1059.003 OR T1059.007 OR T1203 OR T1204.001 OR T1204.002 OR T1112 OR T1497 OR T1553.002 OR T1685 OR T1589.002 OR T1583.006 OR T1608.001 OR T1027.002 OR T1027.013 OR T1684.001) OR threat.technique.id:(T1566.001 OR T1059 OR T1059.001 OR T1059.003 OR T1059.007 OR T1203 OR T1204.001 OR T1204.002 OR T1112 OR T1497 OR T1553.002 OR T1685 OR T1589.002 OR T1583.006 OR T1608.001 OR T1027.002 OR T1027.013 OR T1684.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Saint Bear (G1031) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.001 OR T1059 OR T1059.001 OR T1059.003 OR T1059.007 OR T1203 OR T1204.001 OR T1204.002 OR T1112 OR T1497 OR T1553.002 OR T1685 OR T1589.002 OR T1583.006 OR T1608.001 OR T1027.002 OR T1027.013 OR T1684.001) OR threat.technique.id:(T1566.001 OR T1059 OR T1059.001 OR T1059.003 OR T1059.007 OR T1203 OR T1204.001 OR T1204.002 OR T1112 OR T1497 OR T1553.002 OR T1685 OR T1589.002 OR T1583.006 OR T1608.001 OR T1027.002 OR T1027.013 OR T1684.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Saint Bear with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1566.001 OR T1059 OR T1059.001 OR T1059.003 OR T1059.007 OR T1203 OR T1204.001 OR T1204.002 OR T1112 OR T1497 OR T1553.002 OR T1685 OR T1589.002 OR T1583.006 OR T1608.001 OR T1027.002 OR T1027.013 OR T1684.001) OR threat.technique.id:(T1566.001 OR T1059 OR T1059.001 OR T1059.003 OR T1059.007 OR T1203 OR T1204.001 OR T1204.002 OR T1112 OR T1497 OR T1553.002 OR T1685 OR T1589.002 OR T1583.006 OR T1608.001 OR T1027.002 OR T1027.013 OR T1684.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.007\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.007\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.007\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.007\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1032-inc-ransom.json b/app/playbooks/threat-groups/apt-g1032-inc-ransom.json
new file mode 100644
index 0000000..f075734
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1032-inc-ransom.json
@@ -0,0 +1,117 @@
+{
+ "id": "apt-g1032",
+ "num": 193,
+ "name": "MITRE ATT&CK Group — INC Ransom",
+ "fullName": "INC Ransom (G1032) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[INC Ransom](https://attack.mitre.org/groups/G1032) is a ransomware and data extortion threat group associated with the deployment of [INC Ransomware](https://attack.mitre.org/software/S1139) that has been active since at least July 2023. [INC Ransom](https://attack.mitre.org/groups/G1032) has targeted organizations worldwide most commonly in the industrial, healthcare, and education sectors in the US and Europe. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with INC Ransom.",
+ "mitre": "T1078, T1190, T1566, T1047, T1059.003, T1569.002, T1046, T1049, T1069.002, T1087.002, T1135, T1021.001, T1570, T1074, T1560.001, T1071, T1105, T1219, T1537, T1486, T1657, T1685, T1588.002, T1036.005",
+ "aliases": [
+ "INC Ransom",
+ "GOLD IONIC"
+ ],
+ "mitreGroupId": "G1032",
+ "mitreUrl": "https://attack.mitre.org/groups/G1032",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile INC Ransom with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1032. Aliases: INC Ransom, GOLD IONIC. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact, Defense Impairment, Resource Development, Stealth. Mapped techniques: T1078 Valid Accounts, T1190 Exploit Public-Facing Application, T1566 Phishing, T1047 Windows Management Instrumentation, T1059.003 Windows Command Shell, T1569.002 Service Execution, T1046 Network Service Discovery, T1049 System Network Connections Discovery, T1069.002 Domain Groups, T1087.002 Domain Account, T1135 Network Share Discovery, T1021.001 Remote Desktop Protocol, plus 13 additional mapped technique(s). Source: https://attack.mitre.org/groups/G1032. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - INC Ransom (G1032) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1190 OR T1566 OR T1047 OR T1059.003 OR T1569.002 OR T1046 OR T1049 OR T1069.002 OR T1087.002 OR T1135 OR T1021.001 OR T1570 OR T1074 OR T1560.001 OR T1071 OR T1105 OR T1219 OR T1537 OR T1486) OR threat.technique.id:(T1078 OR T1190 OR T1566 OR T1047 OR T1059.003 OR T1569.002 OR T1046 OR T1049 OR T1069.002 OR T1087.002 OR T1135 OR T1021.001 OR T1570 OR T1074 OR T1560.001 OR T1071 OR T1105 OR T1219 OR T1537 OR T1486) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - INC Ransom (G1032) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1190 OR T1566 OR T1047 OR T1059.003 OR T1569.002 OR T1046 OR T1049 OR T1069.002 OR T1087.002 OR T1135 OR T1021.001 OR T1570 OR T1074 OR T1560.001 OR T1071 OR T1105 OR T1219 OR T1537 OR T1486) OR threat.technique.id:(T1078 OR T1190 OR T1566 OR T1047 OR T1059.003 OR T1569.002 OR T1046 OR T1049 OR T1069.002 OR T1087.002 OR T1135 OR T1021.001 OR T1570 OR T1074 OR T1560.001 OR T1071 OR T1105 OR T1219 OR T1537 OR T1486) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile INC Ransom with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1190 OR T1566 OR T1047 OR T1059.003 OR T1569.002 OR T1046 OR T1049 OR T1069.002 OR T1087.002 OR T1135 OR T1021.001 OR T1570 OR T1074 OR T1560.001 OR T1071 OR T1105 OR T1219 OR T1537 OR T1486) OR threat.technique.id:(T1078 OR T1190 OR T1566 OR T1047 OR T1059.003 OR T1569.002 OR T1046 OR T1049 OR T1069.002 OR T1087.002 OR T1135 OR T1021.001 OR T1570 OR T1074 OR T1560.001 OR T1071 OR T1105 OR T1219 OR T1537 OR T1486) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1033-star-blizzard.json b/app/playbooks/threat-groups/apt-g1033-star-blizzard.json
new file mode 100644
index 0000000..4b13155
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1033-star-blizzard.json
@@ -0,0 +1,120 @@
+{
+ "id": "apt-g1033",
+ "num": 194,
+ "name": "MITRE ATT&CK Group — Star Blizzard",
+ "fullName": "Star Blizzard (G1033) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Star Blizzard](https://attack.mitre.org/groups/G1033) is a cyber espionage and influence group originating in Russia that has been active since at least 2019. [Star Blizzard](https://attack.mitre.org/groups/G1033) campaigns align closely with Russian state interests and have included persistent phishing and credential theft against academic, defense, government, NGO, and think tank organizations in NATO countries, particularly the US and the UK. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Star Blizzard.",
+ "mitre": "T1078, T1566.001, T1059.007, T1204.002, T1539, T1550.004, T1114.002, T1114.003, T1589, T1593, T1598.002, T1598.003, T1583, T1583.001, T1585.001, T1585.002, T1586.002, T1588.002, T1608.001, T1684.001",
+ "aliases": [
+ "Star Blizzard",
+ "SEABORGIUM",
+ "Callisto Group",
+ "TA446",
+ "COLDRIVER"
+ ],
+ "mitreGroupId": "G1033",
+ "mitreUrl": "https://attack.mitre.org/groups/G1033",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Star Blizzard with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1033. Aliases: Star Blizzard, SEABORGIUM, Callisto Group, TA446, COLDRIVER. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Lateral Movement, Collection, Reconnaissance, Resource Development, Stealth. Mapped techniques: T1078 Valid Accounts, T1566.001 Spearphishing Attachment, T1059.007 JavaScript, T1204.002 Malicious File, T1539 Steal Web Session Cookie, T1550.004 Web Session Cookie, T1114.002 Remote Email Collection, T1114.003 Email Forwarding Rule, T1589 Gather Victim Identity Information, T1593 Search Open Websites/Domains, T1598.002 Spearphishing Attachment, T1598.003 Spearphishing Link, plus 8 additional mapped technique(s). Source: https://attack.mitre.org/groups/G1033. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Star Blizzard (G1033) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1566.001 OR T1059.007 OR T1204.002 OR T1539 OR T1550.004 OR T1114.002 OR T1114.003 OR T1589 OR T1593 OR T1598.002 OR T1598.003 OR T1583 OR T1583.001 OR T1585.001 OR T1585.002 OR T1586.002 OR T1588.002 OR T1608.001 OR T1684.001) OR threat.technique.id:(T1078 OR T1566.001 OR T1059.007 OR T1204.002 OR T1539 OR T1550.004 OR T1114.002 OR T1114.003 OR T1589 OR T1593 OR T1598.002 OR T1598.003 OR T1583 OR T1583.001 OR T1585.001 OR T1585.002 OR T1586.002 OR T1588.002 OR T1608.001 OR T1684.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Star Blizzard (G1033) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1566.001 OR T1059.007 OR T1204.002 OR T1539 OR T1550.004 OR T1114.002 OR T1114.003 OR T1589 OR T1593 OR T1598.002 OR T1598.003 OR T1583 OR T1583.001 OR T1585.001 OR T1585.002 OR T1586.002 OR T1588.002 OR T1608.001 OR T1684.001) OR threat.technique.id:(T1078 OR T1566.001 OR T1059.007 OR T1204.002 OR T1539 OR T1550.004 OR T1114.002 OR T1114.003 OR T1589 OR T1593 OR T1598.002 OR T1598.003 OR T1583 OR T1583.001 OR T1585.001 OR T1585.002 OR T1586.002 OR T1588.002 OR T1608.001 OR T1684.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Star Blizzard with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1566.001 OR T1059.007 OR T1204.002 OR T1539 OR T1550.004 OR T1114.002 OR T1114.003 OR T1589 OR T1593 OR T1598.002 OR T1598.003 OR T1583 OR T1583.001 OR T1585.001 OR T1585.002 OR T1586.002 OR T1588.002 OR T1608.001 OR T1684.001) OR threat.technique.id:(T1078 OR T1566.001 OR T1059.007 OR T1204.002 OR T1539 OR T1550.004 OR T1114.002 OR T1114.003 OR T1589 OR T1593 OR T1598.002 OR T1598.003 OR T1583 OR T1583.001 OR T1585.001 OR T1585.002 OR T1586.002 OR T1588.002 OR T1608.001 OR T1684.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.007\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1539\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.007\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1539\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.007\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1539\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1059.007\"\n[[rule.threat.technique]]\nid = \"T1204.002\"\n[[rule.threat.technique]]\nid = \"T1539\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1034-daggerfly.json b/app/playbooks/threat-groups/apt-g1034-daggerfly.json
new file mode 100644
index 0000000..44c7da0
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1034-daggerfly.json
@@ -0,0 +1,118 @@
+{
+ "id": "apt-g1034",
+ "num": 195,
+ "name": "MITRE ATT&CK Group — Daggerfly",
+ "fullName": "Daggerfly (G1034) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Daggerfly](https://attack.mitre.org/groups/G1034) is a People's Republic of China-linked APT entity active since at least 2012. [Daggerfly](https://attack.mitre.org/groups/G1034) has targeted individuals, government and NGO entities, and telecommunication companies in Asia and Africa. [Daggerfly](https://attack.mitre.org/groups/G1034) is associated with exclusive use of [MgBot](https://attack.mitre.org/software/S1146) malware and is noted for several potential supply chain infection campaigns. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Daggerfly.",
+ "mitre": "T1189, T1195.002, T1053.005, T1059.001, T1204.001, T1574.001, T1136.001, T1003.002, T1012, T1082, T1071.001, T1105, T1553.002, T1584.004, T1587.002, T1036.003, T1218.011",
+ "aliases": [
+ "Daggerfly",
+ "Evasive Panda",
+ "BRONZE HIGHLAND"
+ ],
+ "mitreGroupId": "G1034",
+ "mitreUrl": "https://attack.mitre.org/groups/G1034",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Daggerfly with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1034. Aliases: Daggerfly, Evasive Panda, BRONZE HIGHLAND. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Command and Control, Defense Impairment, Resource Development, Stealth. Mapped techniques: T1189 Drive-by Compromise, T1195.002 Compromise Software Supply Chain, T1053.005 Scheduled Task, T1059.001 PowerShell, T1204.001 Malicious Link, T1574.001 DLL, T1136.001 Local Account, T1003.002 Security Account Manager, T1012 Query Registry, T1082 System Information Discovery, T1071.001 Web Protocols, T1105 Ingress Tool Transfer, plus 5 additional mapped technique(s). Source: https://attack.mitre.org/groups/G1034. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Daggerfly (G1034) ATT&CK technique pivots\n(rule.threat.technique.id:(T1189 OR T1195.002 OR T1053.005 OR T1059.001 OR T1204.001 OR T1574.001 OR T1136.001 OR T1003.002 OR T1012 OR T1082 OR T1071.001 OR T1105 OR T1553.002 OR T1584.004 OR T1587.002 OR T1036.003 OR T1218.011) OR threat.technique.id:(T1189 OR T1195.002 OR T1053.005 OR T1059.001 OR T1204.001 OR T1574.001 OR T1136.001 OR T1003.002 OR T1012 OR T1082 OR T1071.001 OR T1105 OR T1553.002 OR T1584.004 OR T1587.002 OR T1036.003 OR T1218.011) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Daggerfly (G1034) ATT&CK technique pivots\n(rule.threat.technique.id:(T1189 OR T1195.002 OR T1053.005 OR T1059.001 OR T1204.001 OR T1574.001 OR T1136.001 OR T1003.002 OR T1012 OR T1082 OR T1071.001 OR T1105 OR T1553.002 OR T1584.004 OR T1587.002 OR T1036.003 OR T1218.011) OR threat.technique.id:(T1189 OR T1195.002 OR T1053.005 OR T1059.001 OR T1204.001 OR T1574.001 OR T1136.001 OR T1003.002 OR T1012 OR T1082 OR T1071.001 OR T1105 OR T1553.002 OR T1584.004 OR T1587.002 OR T1036.003 OR T1218.011) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Daggerfly with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1189 OR T1195.002 OR T1053.005 OR T1059.001 OR T1204.001 OR T1574.001 OR T1136.001 OR T1003.002 OR T1012 OR T1082 OR T1071.001 OR T1105 OR T1553.002 OR T1584.004 OR T1587.002 OR T1036.003 OR T1218.011) OR threat.technique.id:(T1189 OR T1195.002 OR T1053.005 OR T1059.001 OR T1204.001 OR T1574.001 OR T1136.001 OR T1003.002 OR T1012 OR T1082 OR T1071.001 OR T1105 OR T1553.002 OR T1584.004 OR T1587.002 OR T1036.003 OR T1218.011) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1195.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1204.001\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1195.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1204.001\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1195.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1204.001\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1195.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1204.001\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1035-winter-vivern.json b/app/playbooks/threat-groups/apt-g1035-winter-vivern.json
new file mode 100644
index 0000000..c55dced
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1035-winter-vivern.json
@@ -0,0 +1,118 @@
+{
+ "id": "apt-g1035",
+ "num": 196,
+ "name": "MITRE ATT&CK Group — Winter Vivern",
+ "fullName": "Winter Vivern (G1035) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "Winter Vivern is a group linked to Russian and Belorussian interests active since at least 2020 targeting various European government and NGO entities, along with sporadic targeting of Indian and US victims. The group leverages a combination of document-based phishing activity and server-side exploitation for initial access, leveraging adversary-controlled and -created infrastructure for follow-on command and control. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Winter Vivern.",
+ "mitre": "T1189, T1190, T1566.001, T1053.005, T1059, T1059.001, T1059.003, T1059.007, T1204.001, T1056.003, T1033, T1082, T1083, T1113, T1114.001, T1119, T1071.001, T1105, T1020, T1041, T1595.002, T1583.001, T1583.003, T1584.006",
+ "aliases": [
+ "Winter Vivern",
+ "TA473",
+ "UAC-0114"
+ ],
+ "mitreGroupId": "G1035",
+ "mitreUrl": "https://attack.mitre.org/groups/G1035",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Winter Vivern with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1035. Aliases: Winter Vivern, TA473, UAC-0114. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Collection, Command and Control, Exfiltration, Reconnaissance, Resource Development, Stealth. Mapped techniques: T1189 Drive-by Compromise, T1190 Exploit Public-Facing Application, T1566.001 Spearphishing Attachment, T1053.005 Scheduled Task, T1059 Command and Scripting Interpreter, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1059.007 JavaScript, T1204.001 Malicious Link, T1056.003 Web Portal Capture, T1033 System Owner/User Discovery, T1082 System Information Discovery, plus 15 additional mapped technique(s). Source: https://attack.mitre.org/groups/G1035. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Winter Vivern (G1035) ATT&CK technique pivots\n(rule.threat.technique.id:(T1189 OR T1190 OR T1566.001 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.007 OR T1204.001 OR T1056.003 OR T1033 OR T1082 OR T1083 OR T1113 OR T1114.001 OR T1119 OR T1071.001 OR T1105 OR T1020 OR T1041) OR threat.technique.id:(T1189 OR T1190 OR T1566.001 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.007 OR T1204.001 OR T1056.003 OR T1033 OR T1082 OR T1083 OR T1113 OR T1114.001 OR T1119 OR T1071.001 OR T1105 OR T1020 OR T1041) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Winter Vivern (G1035) ATT&CK technique pivots\n(rule.threat.technique.id:(T1189 OR T1190 OR T1566.001 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.007 OR T1204.001 OR T1056.003 OR T1033 OR T1082 OR T1083 OR T1113 OR T1114.001 OR T1119 OR T1071.001 OR T1105 OR T1020 OR T1041) OR threat.technique.id:(T1189 OR T1190 OR T1566.001 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.007 OR T1204.001 OR T1056.003 OR T1033 OR T1082 OR T1083 OR T1113 OR T1114.001 OR T1119 OR T1071.001 OR T1105 OR T1020 OR T1041) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Winter Vivern with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1189 OR T1190 OR T1566.001 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.007 OR T1204.001 OR T1056.003 OR T1033 OR T1082 OR T1083 OR T1113 OR T1114.001 OR T1119 OR T1071.001 OR T1105 OR T1020 OR T1041) OR threat.technique.id:(T1189 OR T1190 OR T1566.001 OR T1053.005 OR T1059 OR T1059.001 OR T1059.003 OR T1059.007 OR T1204.001 OR T1056.003 OR T1033 OR T1082 OR T1083 OR T1113 OR T1114.001 OR T1119 OR T1071.001 OR T1105 OR T1020 OR T1041) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1189\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1036-moonstone-sleet.json b/app/playbooks/threat-groups/apt-g1036-moonstone-sleet.json
new file mode 100644
index 0000000..859c470
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1036-moonstone-sleet.json
@@ -0,0 +1,117 @@
+{
+ "id": "apt-g1036",
+ "num": 197,
+ "name": "MITRE ATT&CK Group — Moonstone Sleet",
+ "fullName": "Moonstone Sleet (G1036) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Moonstone Sleet](https://attack.mitre.org/groups/G1036) is a North Korean-linked threat actor executing both financially motivated attacks and espionage operations. The group previously overlapped significantly with another North Korean-linked entity, [Lazarus Group](https://attack.mitre.org/groups/G0032), but has differentiated its tradecraft since 2023. [Moonstone Sleet](https://attack.mitre.org/groups/G1036) is notable for creating fake companies and personas to interact with victim entities, as well as developing unique malware such as a variant delivered via a fully functioning game. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Moonstone Sleet.",
+ "mitre": "T1195.002, T1566.001, T1566.003, T1053.005, T1204.002, T1569.002, T1547.001, T1003.001, T1016, T1033, T1082, T1217, T1071.001, T1105, T1486, T1589.002, T1591, T1598, T1598.003, T1583.001, T1583.003, T1585.001, T1585.002, T1587",
+ "aliases": [
+ "Moonstone Sleet",
+ "Storm-1789"
+ ],
+ "mitreGroupId": "G1036",
+ "mitreUrl": "https://attack.mitre.org/groups/G1036",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Moonstone Sleet with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1036. Aliases: Moonstone Sleet, Storm-1789. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Command and Control, Impact, Reconnaissance, Resource Development, Stealth. Mapped techniques: T1195.002 Compromise Software Supply Chain, T1566.001 Spearphishing Attachment, T1566.003 Spearphishing via Service, T1053.005 Scheduled Task, T1204.002 Malicious File, T1569.002 Service Execution, T1547.001 Registry Run Keys / Startup Folder, T1003.001 LSASS Memory, T1016 System Network Configuration Discovery, T1033 System Owner/User Discovery, T1082 System Information Discovery, T1217 Browser Information Discovery, plus 18 additional mapped technique(s). Source: https://attack.mitre.org/groups/G1036. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Moonstone Sleet (G1036) ATT&CK technique pivots\n(rule.threat.technique.id:(T1195.002 OR T1566.001 OR T1566.003 OR T1053.005 OR T1204.002 OR T1569.002 OR T1547.001 OR T1003.001 OR T1016 OR T1033 OR T1082 OR T1217 OR T1071.001 OR T1105 OR T1486 OR T1589.002 OR T1591 OR T1598 OR T1598.003 OR T1583.001) OR threat.technique.id:(T1195.002 OR T1566.001 OR T1566.003 OR T1053.005 OR T1204.002 OR T1569.002 OR T1547.001 OR T1003.001 OR T1016 OR T1033 OR T1082 OR T1217 OR T1071.001 OR T1105 OR T1486 OR T1589.002 OR T1591 OR T1598 OR T1598.003 OR T1583.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Moonstone Sleet (G1036) ATT&CK technique pivots\n(rule.threat.technique.id:(T1195.002 OR T1566.001 OR T1566.003 OR T1053.005 OR T1204.002 OR T1569.002 OR T1547.001 OR T1003.001 OR T1016 OR T1033 OR T1082 OR T1217 OR T1071.001 OR T1105 OR T1486 OR T1589.002 OR T1591 OR T1598 OR T1598.003 OR T1583.001) OR threat.technique.id:(T1195.002 OR T1566.001 OR T1566.003 OR T1053.005 OR T1204.002 OR T1569.002 OR T1547.001 OR T1003.001 OR T1016 OR T1033 OR T1082 OR T1217 OR T1071.001 OR T1105 OR T1486 OR T1589.002 OR T1591 OR T1598 OR T1598.003 OR T1583.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Moonstone Sleet with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1195.002 OR T1566.001 OR T1566.003 OR T1053.005 OR T1204.002 OR T1569.002 OR T1547.001 OR T1003.001 OR T1016 OR T1033 OR T1082 OR T1217 OR T1071.001 OR T1105 OR T1486 OR T1589.002 OR T1591 OR T1598 OR T1598.003 OR T1583.001) OR threat.technique.id:(T1195.002 OR T1566.001 OR T1566.003 OR T1053.005 OR T1204.002 OR T1569.002 OR T1547.001 OR T1003.001 OR T1016 OR T1033 OR T1082 OR T1217 OR T1071.001 OR T1105 OR T1486 OR T1589.002 OR T1591 OR T1598 OR T1598.003 OR T1583.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1195.002\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.003\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1204.002\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1195.002\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.003\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1204.002\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1195.002\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.003\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1204.002\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1195.002\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.003\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1204.002\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1037-ta577.json b/app/playbooks/threat-groups/apt-g1037-ta577.json
new file mode 100644
index 0000000..e7bb548
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1037-ta577.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g1037",
+ "num": 198,
+ "name": "MITRE ATT&CK Group — TA577",
+ "fullName": "TA577 (G1037) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[TA577](https://attack.mitre.org/groups/G1037) is an initial access broker (IAB) that has distributed [QakBot](https://attack.mitre.org/software/S0650) and [Pikabot](https://attack.mitre.org/software/S1145), and was among the first observed groups distributing [Latrodectus](https://attack.mitre.org/software/S1160) in 2023. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with TA577.",
+ "mitre": "T1566.002, T1059.003, T1059.007, T1204.001, T1586.002, T1027.009",
+ "aliases": [
+ "TA577"
+ ],
+ "mitreGroupId": "G1037",
+ "mitreUrl": "https://attack.mitre.org/groups/G1037",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile TA577 with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1037. Aliases: TA577. Primary mapped tactics: Initial Access, Execution, Resource Development, Stealth. Mapped techniques: T1566.002 Spearphishing Link, T1059.003 Windows Command Shell, T1059.007 JavaScript, T1204.001 Malicious Link, T1586.002 Email Accounts, T1027.009 Embedded Payloads. Source: https://attack.mitre.org/groups/G1037. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - TA577 (G1037) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.002 OR T1059.003 OR T1059.007 OR T1204.001 OR T1586.002 OR T1027.009) OR threat.technique.id:(T1566.002 OR T1059.003 OR T1059.007 OR T1204.001 OR T1586.002 OR T1027.009) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - TA577 (G1037) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.002 OR T1059.003 OR T1059.007 OR T1204.001 OR T1586.002 OR T1027.009) OR threat.technique.id:(T1566.002 OR T1059.003 OR T1059.007 OR T1204.001 OR T1586.002 OR T1027.009) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile TA577 with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1566.002 OR T1059.003 OR T1059.007 OR T1204.001 OR T1586.002 OR T1027.009) OR threat.technique.id:(T1566.002 OR T1059.003 OR T1059.007 OR T1204.001 OR T1586.002 OR T1027.009) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.007\"\n[[rule.threat.technique]]\nid = \"T1204.001\"\n[[rule.threat.technique]]\nid = \"T1586.002\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.007\"\n[[rule.threat.technique]]\nid = \"T1204.001\"\n[[rule.threat.technique]]\nid = \"T1586.002\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.007\"\n[[rule.threat.technique]]\nid = \"T1204.001\"\n[[rule.threat.technique]]\nid = \"T1586.002\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.007\"\n[[rule.threat.technique]]\nid = \"T1204.001\"\n[[rule.threat.technique]]\nid = \"T1586.002\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1038-ta578.json b/app/playbooks/threat-groups/apt-g1038-ta578.json
new file mode 100644
index 0000000..9a1b6d8
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1038-ta578.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g1038",
+ "num": 199,
+ "name": "MITRE ATT&CK Group — TA578",
+ "fullName": "TA578 (G1038) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[TA578](https://attack.mitre.org/groups/G1038) is a threat actor that has used contact forms and email to initiate communications with victims and to distribute malware including [Latrodectus](https://attack.mitre.org/software/S1160), [IcedID](https://attack.mitre.org/software/S0483), and [Bumblebee](https://attack.mitre.org/software/S1039). This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with TA578.",
+ "mitre": "T1059.007, T1204.001, T1594, T1583.006",
+ "aliases": [
+ "TA578"
+ ],
+ "mitreGroupId": "G1038",
+ "mitreUrl": "https://attack.mitre.org/groups/G1038",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile TA578 with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1038. Aliases: TA578. Primary mapped tactics: Execution, Reconnaissance, Resource Development. Mapped techniques: T1059.007 JavaScript, T1204.001 Malicious Link, T1594 Search Victim-Owned Websites, T1583.006 Web Services. Source: https://attack.mitre.org/groups/G1038. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - TA578 (G1038) ATT&CK technique pivots\n(rule.threat.technique.id:(T1059.007 OR T1204.001 OR T1594 OR T1583.006) OR threat.technique.id:(T1059.007 OR T1204.001 OR T1594 OR T1583.006) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - TA578 (G1038) ATT&CK technique pivots\n(rule.threat.technique.id:(T1059.007 OR T1204.001 OR T1594 OR T1583.006) OR threat.technique.id:(T1059.007 OR T1204.001 OR T1594 OR T1583.006) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile TA578 with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1059.007 OR T1204.001 OR T1594 OR T1583.006) OR threat.technique.id:(T1059.007 OR T1204.001 OR T1594 OR T1583.006) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1059.007\"\n[[rule.threat.technique]]\nid = \"T1204.001\"\n[[rule.threat.technique]]\nid = \"T1594\"\n[[rule.threat.technique]]\nid = \"T1583.006\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1059.007\"\n[[rule.threat.technique]]\nid = \"T1204.001\"\n[[rule.threat.technique]]\nid = \"T1594\"\n[[rule.threat.technique]]\nid = \"T1583.006\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1059.007\"\n[[rule.threat.technique]]\nid = \"T1204.001\"\n[[rule.threat.technique]]\nid = \"T1594\"\n[[rule.threat.technique]]\nid = \"T1583.006\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1059.007\"\n[[rule.threat.technique]]\nid = \"T1204.001\"\n[[rule.threat.technique]]\nid = \"T1594\"\n[[rule.threat.technique]]\nid = \"T1583.006\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1039-redcurl.json b/app/playbooks/threat-groups/apt-g1039-redcurl.json
new file mode 100644
index 0000000..37067ed
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1039-redcurl.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g1039",
+ "num": 200,
+ "name": "MITRE ATT&CK Group — RedCurl",
+ "fullName": "RedCurl (G1039) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[RedCurl](https://attack.mitre.org/groups/G1039) is a threat actor active since 2018 notable for corporate espionage targeting a variety of locations, including Ukraine, Canada and the United Kingdom, and a variety of industries, including but not limited to travel agencies, insurance companies, and banks. [RedCurl](https://attack.mitre.org/groups/G1039) is allegedly a Russian-speaking threat actor. The group’s operations typically start with spearphishing emails to gain initial access, then the group executes discovery and collection commands and scripts to find corporate data. The group concludes operations by exfiltrating files to the C2 servers. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with RedCurl.",
+ "mitre": "T1199, T1566.001, T1566.002, T1053.005, T1059.001, T1059.003, T1059.005, T1059.006, T1204.001, T1204.002, T1547.001, T1003.001, T1056.002, T1552.001, T1552.002, T1555.003, T1046, T1082, T1083, T1087.001, T1087.002, T1087.003, T1080, T1005",
+ "aliases": [
+ "RedCurl"
+ ],
+ "mitreGroupId": "G1039",
+ "mitreUrl": "https://attack.mitre.org/groups/G1039",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile RedCurl with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1039. Aliases: RedCurl. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Resource Development, Stealth. Mapped techniques: T1199 Trusted Relationship, T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link, T1053.005 Scheduled Task, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1059.005 Visual Basic, T1059.006 Python, T1204.001 Malicious Link, T1204.002 Malicious File, T1547.001 Registry Run Keys / Startup Folder, T1003.001 LSASS Memory, plus 29 additional mapped technique(s). Source: https://attack.mitre.org/groups/G1039. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - RedCurl (G1039) ATT&CK technique pivots\n(rule.threat.technique.id:(T1199 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.006 OR T1204.001 OR T1204.002 OR T1547.001 OR T1003.001 OR T1056.002 OR T1552.001 OR T1552.002 OR T1555.003 OR T1046 OR T1082 OR T1083 OR T1087.001) OR threat.technique.id:(T1199 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.006 OR T1204.001 OR T1204.002 OR T1547.001 OR T1003.001 OR T1056.002 OR T1552.001 OR T1552.002 OR T1555.003 OR T1046 OR T1082 OR T1083 OR T1087.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - RedCurl (G1039) ATT&CK technique pivots\n(rule.threat.technique.id:(T1199 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.006 OR T1204.001 OR T1204.002 OR T1547.001 OR T1003.001 OR T1056.002 OR T1552.001 OR T1552.002 OR T1555.003 OR T1046 OR T1082 OR T1083 OR T1087.001) OR threat.technique.id:(T1199 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.006 OR T1204.001 OR T1204.002 OR T1547.001 OR T1003.001 OR T1056.002 OR T1552.001 OR T1552.002 OR T1555.003 OR T1046 OR T1082 OR T1083 OR T1087.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile RedCurl with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1199 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.006 OR T1204.001 OR T1204.002 OR T1547.001 OR T1003.001 OR T1056.002 OR T1552.001 OR T1552.002 OR T1555.003 OR T1046 OR T1082 OR T1083 OR T1087.001) OR threat.technique.id:(T1199 OR T1566.001 OR T1566.002 OR T1053.005 OR T1059.001 OR T1059.003 OR T1059.005 OR T1059.006 OR T1204.001 OR T1204.002 OR T1547.001 OR T1003.001 OR T1056.002 OR T1552.001 OR T1552.002 OR T1555.003 OR T1046 OR T1082 OR T1083 OR T1087.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1199\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1199\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1199\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1199\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1040-play.json b/app/playbooks/threat-groups/apt-g1040-play.json
new file mode 100644
index 0000000..7b69e73
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1040-play.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g1040",
+ "num": 201,
+ "name": "MITRE ATT&CK Group — Play",
+ "fullName": "Play (G1040) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Play](https://attack.mitre.org/groups/G1040) is a ransomware group that has been active since at least 2022 deploying [Playcrypt](https://attack.mitre.org/software/S1162) ransomware against the business, government, critical infrastructure, healthcare, and media sectors in North America, South America, and Europe. [Play](https://attack.mitre.org/groups/G1040) actors employ a double-extortion model, encrypting systems after exfiltrating data, and are presumed by security researchers to operate as a closed group. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Play.",
+ "mitre": "T1078, T1078.002, T1078.003, T1133, T1190, T1059.001, T1059.003, T1003.001, T1016, T1018, T1057, T1082, T1083, T1518.001, T1021.002, T1560.001, T1105, T1030, T1048, T1657, T1685, T1685.005, T1587.001, T1588.002",
+ "aliases": [
+ "Play"
+ ],
+ "mitreGroupId": "G1040",
+ "mitreUrl": "https://attack.mitre.org/groups/G1040",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Play with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1040. Aliases: Play. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact, Defense Impairment, Resource Development, Stealth. Mapped techniques: T1078 Valid Accounts, T1078.002 Domain Accounts, T1078.003 Local Accounts, T1133 External Remote Services, T1190 Exploit Public-Facing Application, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1003.001 LSASS Memory, T1016 System Network Configuration Discovery, T1018 Remote System Discovery, T1057 Process Discovery, T1082 System Information Discovery, plus 14 additional mapped technique(s). Source: https://attack.mitre.org/groups/G1040. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Play (G1040) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1078.002 OR T1078.003 OR T1133 OR T1190 OR T1059.001 OR T1059.003 OR T1003.001 OR T1016 OR T1018 OR T1057 OR T1082 OR T1083 OR T1518.001 OR T1021.002 OR T1560.001 OR T1105 OR T1030 OR T1048 OR T1657) OR threat.technique.id:(T1078 OR T1078.002 OR T1078.003 OR T1133 OR T1190 OR T1059.001 OR T1059.003 OR T1003.001 OR T1016 OR T1018 OR T1057 OR T1082 OR T1083 OR T1518.001 OR T1021.002 OR T1560.001 OR T1105 OR T1030 OR T1048 OR T1657) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Play (G1040) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1078.002 OR T1078.003 OR T1133 OR T1190 OR T1059.001 OR T1059.003 OR T1003.001 OR T1016 OR T1018 OR T1057 OR T1082 OR T1083 OR T1518.001 OR T1021.002 OR T1560.001 OR T1105 OR T1030 OR T1048 OR T1657) OR threat.technique.id:(T1078 OR T1078.002 OR T1078.003 OR T1133 OR T1190 OR T1059.001 OR T1059.003 OR T1003.001 OR T1016 OR T1018 OR T1057 OR T1082 OR T1083 OR T1518.001 OR T1021.002 OR T1560.001 OR T1105 OR T1030 OR T1048 OR T1657) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Play with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1078.002 OR T1078.003 OR T1133 OR T1190 OR T1059.001 OR T1059.003 OR T1003.001 OR T1016 OR T1018 OR T1057 OR T1082 OR T1083 OR T1518.001 OR T1021.002 OR T1560.001 OR T1105 OR T1030 OR T1048 OR T1657) OR threat.technique.id:(T1078 OR T1078.002 OR T1078.003 OR T1133 OR T1190 OR T1059.001 OR T1059.003 OR T1003.001 OR T1016 OR T1018 OR T1057 OR T1082 OR T1083 OR T1518.001 OR T1021.002 OR T1560.001 OR T1105 OR T1030 OR T1048 OR T1657) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1041-sea-turtle.json b/app/playbooks/threat-groups/apt-g1041-sea-turtle.json
new file mode 100644
index 0000000..bf24800
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1041-sea-turtle.json
@@ -0,0 +1,120 @@
+{
+ "id": "apt-g1041",
+ "num": 202,
+ "name": "MITRE ATT&CK Group — Sea Turtle",
+ "fullName": "Sea Turtle (G1041) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Sea Turtle](https://attack.mitre.org/groups/G1041) is a Türkiye-linked threat actor active since at least 2017 performing espionage and service provider compromise operations against victims in Asia, Europe, and North America. [Sea Turtle](https://attack.mitre.org/groups/G1041) is notable for targeting registrars managing ccTLDs and complex DNS-based intrusions where the threat actor compromised DNS providers to hijack DNS resolution for ultimate victims, enabling [Sea Turtle](https://attack.mitre.org/groups/G1041) to spoof log in portals and other applications for credential collection. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Sea Turtle.",
+ "mitre": "T1078, T1078.003, T1133, T1190, T1199, T1566, T1059.004, T1203, T1505.003, T1557, T1074.002, T1114.001, T1213.006, T1560.001, T1071.001, T1685.006, T1690, T1583, T1583.001, T1583.002, T1583.003, T1584.002, T1588.002, T1588.004",
+ "aliases": [
+ "Sea Turtle",
+ "Teal Kurma",
+ "Marbled Dust",
+ "Cosmic Wolf",
+ "SILICON"
+ ],
+ "mitreGroupId": "G1041",
+ "mitreUrl": "https://attack.mitre.org/groups/G1041",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Sea Turtle with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1041. Aliases: Sea Turtle, Teal Kurma, Marbled Dust, Cosmic Wolf, SILICON. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Collection, Command and Control, Defense Impairment, Resource Development, Stealth. Mapped techniques: T1078 Valid Accounts, T1078.003 Local Accounts, T1133 External Remote Services, T1190 Exploit Public-Facing Application, T1199 Trusted Relationship, T1566 Phishing, T1059.004 Unix Shell, T1203 Exploitation for Client Execution, T1505.003 Web Shell, T1557 Adversary-in-the-Middle, T1074.002 Remote Data Staging, T1114.001 Local Email Collection, plus 15 additional mapped technique(s). Source: https://attack.mitre.org/groups/G1041. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Sea Turtle (G1041) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1078.003 OR T1133 OR T1190 OR T1199 OR T1566 OR T1059.004 OR T1203 OR T1505.003 OR T1557 OR T1074.002 OR T1114.001 OR T1213.006 OR T1560.001 OR T1071.001 OR T1685.006 OR T1690 OR T1583 OR T1583.001 OR T1583.002) OR threat.technique.id:(T1078 OR T1078.003 OR T1133 OR T1190 OR T1199 OR T1566 OR T1059.004 OR T1203 OR T1505.003 OR T1557 OR T1074.002 OR T1114.001 OR T1213.006 OR T1560.001 OR T1071.001 OR T1685.006 OR T1690 OR T1583 OR T1583.001 OR T1583.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Sea Turtle (G1041) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1078.003 OR T1133 OR T1190 OR T1199 OR T1566 OR T1059.004 OR T1203 OR T1505.003 OR T1557 OR T1074.002 OR T1114.001 OR T1213.006 OR T1560.001 OR T1071.001 OR T1685.006 OR T1690 OR T1583 OR T1583.001 OR T1583.002) OR threat.technique.id:(T1078 OR T1078.003 OR T1133 OR T1190 OR T1199 OR T1566 OR T1059.004 OR T1203 OR T1505.003 OR T1557 OR T1074.002 OR T1114.001 OR T1213.006 OR T1560.001 OR T1071.001 OR T1685.006 OR T1690 OR T1583 OR T1583.001 OR T1583.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Sea Turtle with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1078.003 OR T1133 OR T1190 OR T1199 OR T1566 OR T1059.004 OR T1203 OR T1505.003 OR T1557 OR T1074.002 OR T1114.001 OR T1213.006 OR T1560.001 OR T1071.001 OR T1685.006 OR T1690 OR T1583 OR T1583.001 OR T1583.002) OR threat.technique.id:(T1078 OR T1078.003 OR T1133 OR T1190 OR T1199 OR T1566 OR T1059.004 OR T1203 OR T1505.003 OR T1557 OR T1074.002 OR T1114.001 OR T1213.006 OR T1560.001 OR T1071.001 OR T1685.006 OR T1690 OR T1583 OR T1583.001 OR T1583.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1199\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1199\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1199\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1199\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1042-redecho.json b/app/playbooks/threat-groups/apt-g1042-redecho.json
new file mode 100644
index 0000000..1d76792
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1042-redecho.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g1042",
+ "num": 203,
+ "name": "MITRE ATT&CK Group — RedEcho",
+ "fullName": "RedEcho (G1042) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[RedEcho](https://attack.mitre.org/groups/G1042) is a People’s Republic of China-related threat actor associated with long-running intrusions in Indian critical infrastructure entities. [RedEcho](https://attack.mitre.org/groups/G1042) overlaps with various other PRC-linked threat groups, such as [APT41](https://attack.mitre.org/groups/G0096), and is linked to [ShadowPad](https://attack.mitre.org/software/S0596) malware use through shared infrastructure. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with RedEcho.",
+ "mitre": "T1071.001, T1568, T1571, T1573.002, T1583.001",
+ "aliases": [
+ "RedEcho"
+ ],
+ "mitreGroupId": "G1042",
+ "mitreUrl": "https://attack.mitre.org/groups/G1042",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile RedEcho with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1042. Aliases: RedEcho. Primary mapped tactics: Command and Control, Resource Development. Mapped techniques: T1071.001 Web Protocols, T1568 Dynamic Resolution, T1571 Non-Standard Port, T1573.002 Asymmetric Cryptography, T1583.001 Domains. Source: https://attack.mitre.org/groups/G1042. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - RedEcho (G1042) ATT&CK technique pivots\n(rule.threat.technique.id:(T1071.001 OR T1568 OR T1571 OR T1573.002 OR T1583.001) OR threat.technique.id:(T1071.001 OR T1568 OR T1571 OR T1573.002 OR T1583.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - RedEcho (G1042) ATT&CK technique pivots\n(rule.threat.technique.id:(T1071.001 OR T1568 OR T1571 OR T1573.002 OR T1583.001) OR threat.technique.id:(T1071.001 OR T1568 OR T1571 OR T1573.002 OR T1583.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile RedEcho with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1071.001 OR T1568 OR T1571 OR T1573.002 OR T1583.001) OR threat.technique.id:(T1071.001 OR T1568 OR T1571 OR T1573.002 OR T1583.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1071.001\"\n[[rule.threat.technique]]\nid = \"T1568\"\n[[rule.threat.technique]]\nid = \"T1571\"\n[[rule.threat.technique]]\nid = \"T1573.002\"\n[[rule.threat.technique]]\nid = \"T1583.001\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1071.001\"\n[[rule.threat.technique]]\nid = \"T1568\"\n[[rule.threat.technique]]\nid = \"T1571\"\n[[rule.threat.technique]]\nid = \"T1573.002\"\n[[rule.threat.technique]]\nid = \"T1583.001\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1071.001\"\n[[rule.threat.technique]]\nid = \"T1568\"\n[[rule.threat.technique]]\nid = \"T1571\"\n[[rule.threat.technique]]\nid = \"T1573.002\"\n[[rule.threat.technique]]\nid = \"T1583.001\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1071.001\"\n[[rule.threat.technique]]\nid = \"T1568\"\n[[rule.threat.technique]]\nid = \"T1571\"\n[[rule.threat.technique]]\nid = \"T1573.002\"\n[[rule.threat.technique]]\nid = \"T1583.001\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1043-blackbyte.json b/app/playbooks/threat-groups/apt-g1043-blackbyte.json
new file mode 100644
index 0000000..00f34ef
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1043-blackbyte.json
@@ -0,0 +1,117 @@
+{
+ "id": "apt-g1043",
+ "num": 204,
+ "name": "MITRE ATT&CK Group — BlackByte",
+ "fullName": "BlackByte (G1043) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[BlackByte](https://attack.mitre.org/groups/G1043) is a ransomware threat actor operating since at least 2021. [BlackByte](https://attack.mitre.org/groups/G1043) is associated with several versions of ransomware also labeled [BlackByte Ransomware](https://attack.mitre.org/software/S1180). [BlackByte](https://attack.mitre.org/groups/G1043) ransomware operations initially used a common encryption key allowing for the development of a universal decryptor, but subsequent versions such as [BlackByte 2.0 Ransomware](https://attack.mitre.org/software/S1181) use more robust encryption mechanisms. [BlackByte](https://attack.mitre.org/groups/G1043) is notable for operations targeting critical infrastructure entities among other targets across North America. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with BlackByte.",
+ "mitre": "T1078, T1078.002, T1190, T1047, T1053.005, T1059.001, T1059.003, T1569.002, T1112, T1136.002, T1505.003, T1543.003, T1547.001, T1055, T1055.012, T1068, T1134.003, T1003, T1012, T1016, T1018, T1046, T1082, T1087.002",
+ "aliases": [
+ "BlackByte",
+ "Hecamede"
+ ],
+ "mitreGroupId": "G1043",
+ "mitreUrl": "https://attack.mitre.org/groups/G1043",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile BlackByte with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1043. Aliases: BlackByte, Hecamede. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact, Defense Impairment, Resource Development, Stealth. Mapped techniques: T1078 Valid Accounts, T1078.002 Domain Accounts, T1190 Exploit Public-Facing Application, T1047 Windows Management Instrumentation, T1053.005 Scheduled Task, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1569.002 Service Execution, T1112 Modify Registry, T1136.002 Domain Account, T1505.003 Web Shell, T1543.003 Windows Service, plus 36 additional mapped technique(s). Source: https://attack.mitre.org/groups/G1043. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - BlackByte (G1043) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1078.002 OR T1190 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1569.002 OR T1112 OR T1136.002 OR T1505.003 OR T1543.003 OR T1547.001 OR T1055 OR T1055.012 OR T1068 OR T1134.003 OR T1003 OR T1012 OR T1016) OR threat.technique.id:(T1078 OR T1078.002 OR T1190 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1569.002 OR T1112 OR T1136.002 OR T1505.003 OR T1543.003 OR T1547.001 OR T1055 OR T1055.012 OR T1068 OR T1134.003 OR T1003 OR T1012 OR T1016) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - BlackByte (G1043) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1078.002 OR T1190 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1569.002 OR T1112 OR T1136.002 OR T1505.003 OR T1543.003 OR T1547.001 OR T1055 OR T1055.012 OR T1068 OR T1134.003 OR T1003 OR T1012 OR T1016) OR threat.technique.id:(T1078 OR T1078.002 OR T1190 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1569.002 OR T1112 OR T1136.002 OR T1505.003 OR T1543.003 OR T1547.001 OR T1055 OR T1055.012 OR T1068 OR T1134.003 OR T1003 OR T1012 OR T1016) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile BlackByte with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1078.002 OR T1190 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1569.002 OR T1112 OR T1136.002 OR T1505.003 OR T1543.003 OR T1547.001 OR T1055 OR T1055.012 OR T1068 OR T1134.003 OR T1003 OR T1012 OR T1016) OR threat.technique.id:(T1078 OR T1078.002 OR T1190 OR T1047 OR T1053.005 OR T1059.001 OR T1059.003 OR T1569.002 OR T1112 OR T1136.002 OR T1505.003 OR T1543.003 OR T1547.001 OR T1055 OR T1055.012 OR T1068 OR T1134.003 OR T1003 OR T1012 OR T1016) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1044-apt42.json b/app/playbooks/threat-groups/apt-g1044-apt42.json
new file mode 100644
index 0000000..f1b1e70
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1044-apt42.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g1044",
+ "num": 205,
+ "name": "MITRE ATT&CK Group — APT42",
+ "fullName": "APT42 (G1044) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[APT42](https://attack.mitre.org/groups/G1044) is an Iranian-sponsored threat group that conducts cyber espionage and surveillance. The group primarily focuses on targets in the Middle East region, but has targeted a variety of industries and countries since at least 2015. [APT42](https://attack.mitre.org/groups/G1044) starts cyber operations through spearphishing emails and/or the PINEFLOWER Android malware, then monitors and collects information from the compromised systems and devices. Finally, [APT42](https://attack.mitre.org/groups/G1044) exfiltrates data using native features and open-source tools. [APT42](https://attack.mitre.org/groups/G1044) activities have been linked to [Magic Hound](https://attack.mitre.org/groups/G0059) by other commercial vendors. While there are behavior and software overlaps between [Magic Hound](https://attack.mitre.org/groups/G0059) and [APT42](https://attack.mitre.org/groups/G1044), they appear to be distinct entities and are tracked as separate entities by their originating vendor. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with APT42.",
+ "mitre": "T1566.002, T1047, T1053.005, T1059.001, T1059.005, T1112, T1547, T1056, T1056.001, T1111, T1539, T1555.003, T1016, T1082, T1087.001, T1518.001, T1113, T1530, T1071.001, T1102, T1132.001, T1573.002, T1682, T1583.001",
+ "aliases": [
+ "APT42"
+ ],
+ "mitreGroupId": "G1044",
+ "mitreUrl": "https://attack.mitre.org/groups/G1044",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile APT42 with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1044. Aliases: APT42. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Collection, Command and Control, Defense Impairment, Reconnaissance, Resource Development, Stealth. Mapped techniques: T1566.002 Spearphishing Link, T1047 Windows Management Instrumentation, T1053.005 Scheduled Task, T1059.001 PowerShell, T1059.005 Visual Basic, T1112 Modify Registry, T1547 Boot or Logon Autostart Execution, T1056 Input Capture, T1056.001 Keylogging, T1111 Multi-Factor Authentication Interception, T1539 Steal Web Session Cookie, T1555.003 Credentials from Web Browsers, plus 20 additional mapped technique(s). Source: https://attack.mitre.org/groups/G1044. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - APT42 (G1044) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.005 OR T1112 OR T1547 OR T1056 OR T1056.001 OR T1111 OR T1539 OR T1555.003 OR T1016 OR T1082 OR T1087.001 OR T1518.001 OR T1113 OR T1530 OR T1071.001 OR T1102) OR threat.technique.id:(T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.005 OR T1112 OR T1547 OR T1056 OR T1056.001 OR T1111 OR T1539 OR T1555.003 OR T1016 OR T1082 OR T1087.001 OR T1518.001 OR T1113 OR T1530 OR T1071.001 OR T1102) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - APT42 (G1044) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.005 OR T1112 OR T1547 OR T1056 OR T1056.001 OR T1111 OR T1539 OR T1555.003 OR T1016 OR T1082 OR T1087.001 OR T1518.001 OR T1113 OR T1530 OR T1071.001 OR T1102) OR threat.technique.id:(T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.005 OR T1112 OR T1547 OR T1056 OR T1056.001 OR T1111 OR T1539 OR T1555.003 OR T1016 OR T1082 OR T1087.001 OR T1518.001 OR T1113 OR T1530 OR T1071.001 OR T1102) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile APT42 with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.005 OR T1112 OR T1547 OR T1056 OR T1056.001 OR T1111 OR T1539 OR T1555.003 OR T1016 OR T1082 OR T1087.001 OR T1518.001 OR T1113 OR T1530 OR T1071.001 OR T1102) OR threat.technique.id:(T1566.002 OR T1047 OR T1053.005 OR T1059.001 OR T1059.005 OR T1112 OR T1547 OR T1056 OR T1056.001 OR T1111 OR T1539 OR T1555.003 OR T1016 OR T1082 OR T1087.001 OR T1518.001 OR T1113 OR T1530 OR T1071.001 OR T1102) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.005\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.005\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.005\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.005\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1045-salt-typhoon.json b/app/playbooks/threat-groups/apt-g1045-salt-typhoon.json
new file mode 100644
index 0000000..66187a6
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1045-salt-typhoon.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g1045",
+ "num": 206,
+ "name": "MITRE ATT&CK Group — Salt Typhoon",
+ "fullName": "Salt Typhoon (G1045) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Salt Typhoon](https://attack.mitre.org/groups/G1045) is a People's Republic of China (PRC) state-backed actor that has been active since at least 2019 and responsible for numerous compromises of network infrastructure at major U.S. telecommunication and internet service providers (ISP). This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Salt Typhoon.",
+ "mitre": "T1190, T1098.004, T1136, T1040, T1110.002, T1021.004, T1602.002, T1572, T1048.003, T1685.006, T1686, T1590.004, T1587.001, T1588.002",
+ "aliases": [
+ "Salt Typhoon"
+ ],
+ "mitreGroupId": "G1045",
+ "mitreUrl": "https://attack.mitre.org/groups/G1045",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Salt Typhoon with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1045. Aliases: Salt Typhoon. Primary mapped tactics: Initial Access, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Defense Impairment, Reconnaissance, Resource Development. Mapped techniques: T1190 Exploit Public-Facing Application, T1098.004 SSH Authorized Keys, T1136 Create Account, T1040 Network Sniffing, T1110.002 Password Cracking, T1021.004 SSH, T1602.002 Network Device Configuration Dump, T1572 Protocol Tunneling, T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol, T1685.006 Clear Linux or Mac System Logs, T1686 Disable or Modify System Firewall, T1590.004 Network Topology, plus 2 additional mapped technique(s). Source: https://attack.mitre.org/groups/G1045. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Salt Typhoon (G1045) ATT&CK technique pivots\n(rule.threat.technique.id:(T1190 OR T1098.004 OR T1136 OR T1040 OR T1110.002 OR T1021.004 OR T1602.002 OR T1572 OR T1048.003 OR T1685.006 OR T1686 OR T1590.004 OR T1587.001 OR T1588.002) OR threat.technique.id:(T1190 OR T1098.004 OR T1136 OR T1040 OR T1110.002 OR T1021.004 OR T1602.002 OR T1572 OR T1048.003 OR T1685.006 OR T1686 OR T1590.004 OR T1587.001 OR T1588.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Salt Typhoon (G1045) ATT&CK technique pivots\n(rule.threat.technique.id:(T1190 OR T1098.004 OR T1136 OR T1040 OR T1110.002 OR T1021.004 OR T1602.002 OR T1572 OR T1048.003 OR T1685.006 OR T1686 OR T1590.004 OR T1587.001 OR T1588.002) OR threat.technique.id:(T1190 OR T1098.004 OR T1136 OR T1040 OR T1110.002 OR T1021.004 OR T1602.002 OR T1572 OR T1048.003 OR T1685.006 OR T1686 OR T1590.004 OR T1587.001 OR T1588.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Salt Typhoon with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1190 OR T1098.004 OR T1136 OR T1040 OR T1110.002 OR T1021.004 OR T1602.002 OR T1572 OR T1048.003 OR T1685.006 OR T1686 OR T1590.004 OR T1587.001 OR T1588.002) OR threat.technique.id:(T1190 OR T1098.004 OR T1136 OR T1040 OR T1110.002 OR T1021.004 OR T1602.002 OR T1572 OR T1048.003 OR T1685.006 OR T1686 OR T1590.004 OR T1587.001 OR T1588.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1098.004\"\n[[rule.threat.technique]]\nid = \"T1136\"\n[[rule.threat.technique]]\nid = \"T1040\"\n[[rule.threat.technique]]\nid = \"T1110.002\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1098.004\"\n[[rule.threat.technique]]\nid = \"T1136\"\n[[rule.threat.technique]]\nid = \"T1040\"\n[[rule.threat.technique]]\nid = \"T1110.002\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1098.004\"\n[[rule.threat.technique]]\nid = \"T1136\"\n[[rule.threat.technique]]\nid = \"T1040\"\n[[rule.threat.technique]]\nid = \"T1110.002\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1098.004\"\n[[rule.threat.technique]]\nid = \"T1136\"\n[[rule.threat.technique]]\nid = \"T1040\"\n[[rule.threat.technique]]\nid = \"T1110.002\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1046-storm-1811.json b/app/playbooks/threat-groups/apt-g1046-storm-1811.json
new file mode 100644
index 0000000..3b5034a
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1046-storm-1811.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g1046",
+ "num": 207,
+ "name": "MITRE ATT&CK Group — Storm-1811",
+ "fullName": "Storm-1811 (G1046) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Storm-1811](https://attack.mitre.org/groups/G1046) is a financially-motivated entity linked to [Black Basta](https://attack.mitre.org/software/S1070) ransomware deployment. [Storm-1811](https://attack.mitre.org/groups/G1046) is notable for unique phishing and social engineering mechanisms for initial access, such as overloading victim email inboxes with non-malicious spam to prompt a fake \"help desk\" interaction leading to the deployment of adversary tools and capabilities. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Storm-1811.",
+ "mitre": "T1566.002, T1566.003, T1566.004, T1059.001, T1059.003, T1204.002, T1574.001, T1547.001, T1056, T1033, T1087.002, T1482, T1021.002, T1021.004, T1570, T1074.001, T1105, T1219.002, T1048.002, T1486, T1667, T1222.001, T1583.001, T1585.003",
+ "aliases": [
+ "Storm-1811"
+ ],
+ "mitreGroupId": "G1046",
+ "mitreUrl": "https://attack.mitre.org/groups/G1046",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Storm-1811 with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1046. Aliases: Storm-1811. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact, Defense Impairment, Resource Development, Stealth. Mapped techniques: T1566.002 Spearphishing Link, T1566.003 Spearphishing via Service, T1566.004 Spearphishing Voice, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1204.002 Malicious File, T1574.001 DLL, T1547.001 Registry Run Keys / Startup Folder, T1056 Input Capture, T1033 System Owner/User Discovery, T1087.002 Domain Account, T1482 Domain Trust Discovery, plus 19 additional mapped technique(s). Source: https://attack.mitre.org/groups/G1046. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Storm-1811 (G1046) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.002 OR T1566.003 OR T1566.004 OR T1059.001 OR T1059.003 OR T1204.002 OR T1574.001 OR T1547.001 OR T1056 OR T1033 OR T1087.002 OR T1482 OR T1021.002 OR T1021.004 OR T1570 OR T1074.001 OR T1105 OR T1219.002 OR T1048.002 OR T1486) OR threat.technique.id:(T1566.002 OR T1566.003 OR T1566.004 OR T1059.001 OR T1059.003 OR T1204.002 OR T1574.001 OR T1547.001 OR T1056 OR T1033 OR T1087.002 OR T1482 OR T1021.002 OR T1021.004 OR T1570 OR T1074.001 OR T1105 OR T1219.002 OR T1048.002 OR T1486) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Storm-1811 (G1046) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.002 OR T1566.003 OR T1566.004 OR T1059.001 OR T1059.003 OR T1204.002 OR T1574.001 OR T1547.001 OR T1056 OR T1033 OR T1087.002 OR T1482 OR T1021.002 OR T1021.004 OR T1570 OR T1074.001 OR T1105 OR T1219.002 OR T1048.002 OR T1486) OR threat.technique.id:(T1566.002 OR T1566.003 OR T1566.004 OR T1059.001 OR T1059.003 OR T1204.002 OR T1574.001 OR T1547.001 OR T1056 OR T1033 OR T1087.002 OR T1482 OR T1021.002 OR T1021.004 OR T1570 OR T1074.001 OR T1105 OR T1219.002 OR T1048.002 OR T1486) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Storm-1811 with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1566.002 OR T1566.003 OR T1566.004 OR T1059.001 OR T1059.003 OR T1204.002 OR T1574.001 OR T1547.001 OR T1056 OR T1033 OR T1087.002 OR T1482 OR T1021.002 OR T1021.004 OR T1570 OR T1074.001 OR T1105 OR T1219.002 OR T1048.002 OR T1486) OR threat.technique.id:(T1566.002 OR T1566.003 OR T1566.004 OR T1059.001 OR T1059.003 OR T1204.002 OR T1574.001 OR T1547.001 OR T1056 OR T1033 OR T1087.002 OR T1482 OR T1021.002 OR T1021.004 OR T1570 OR T1074.001 OR T1105 OR T1219.002 OR T1048.002 OR T1486) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1566.003\"\n[[rule.threat.technique]]\nid = \"T1566.004\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1566.003\"\n[[rule.threat.technique]]\nid = \"T1566.004\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1566.003\"\n[[rule.threat.technique]]\nid = \"T1566.004\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1566.003\"\n[[rule.threat.technique]]\nid = \"T1566.004\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1047-velvet-ant.json b/app/playbooks/threat-groups/apt-g1047-velvet-ant.json
new file mode 100644
index 0000000..3c01657
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1047-velvet-ant.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g1047",
+ "num": 208,
+ "name": "MITRE ATT&CK Group — Velvet Ant",
+ "fullName": "Velvet Ant (G1047) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Velvet Ant](https://attack.mitre.org/groups/G1047) is a threat actor operating since at least 2021. [Velvet Ant](https://attack.mitre.org/groups/G1047) is associated with complex persistence mechanisms, the targeting of network devices and appliances during operations, and the use of zero day exploits. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Velvet Ant.",
+ "mitre": "T1078.003, T1133, T1047, T1059.004, T1569.002, T1574.001, T1037.004, T1055, T1040, T1049, T1083, T1021.002, T1570, T1071, T1090.001, T1132, T1571, T1573.002, T1685, T1686, T1036.005, T1211",
+ "aliases": [
+ "Velvet Ant"
+ ],
+ "mitreGroupId": "G1047",
+ "mitreUrl": "https://attack.mitre.org/groups/G1047",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Velvet Ant with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1047. Aliases: Velvet Ant. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Command and Control, Defense Impairment, Stealth. Mapped techniques: T1078.003 Local Accounts, T1133 External Remote Services, T1047 Windows Management Instrumentation, T1059.004 Unix Shell, T1569.002 Service Execution, T1574.001 DLL, T1037.004 RC Scripts, T1055 Process Injection, T1040 Network Sniffing, T1049 System Network Connections Discovery, T1083 File and Directory Discovery, T1021.002 SMB/Windows Admin Shares, plus 10 additional mapped technique(s). Source: https://attack.mitre.org/groups/G1047. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Velvet Ant (G1047) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078.003 OR T1133 OR T1047 OR T1059.004 OR T1569.002 OR T1574.001 OR T1037.004 OR T1055 OR T1040 OR T1049 OR T1083 OR T1021.002 OR T1570 OR T1071 OR T1090.001 OR T1132 OR T1571 OR T1573.002 OR T1685 OR T1686) OR threat.technique.id:(T1078.003 OR T1133 OR T1047 OR T1059.004 OR T1569.002 OR T1574.001 OR T1037.004 OR T1055 OR T1040 OR T1049 OR T1083 OR T1021.002 OR T1570 OR T1071 OR T1090.001 OR T1132 OR T1571 OR T1573.002 OR T1685 OR T1686) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Velvet Ant (G1047) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078.003 OR T1133 OR T1047 OR T1059.004 OR T1569.002 OR T1574.001 OR T1037.004 OR T1055 OR T1040 OR T1049 OR T1083 OR T1021.002 OR T1570 OR T1071 OR T1090.001 OR T1132 OR T1571 OR T1573.002 OR T1685 OR T1686) OR threat.technique.id:(T1078.003 OR T1133 OR T1047 OR T1059.004 OR T1569.002 OR T1574.001 OR T1037.004 OR T1055 OR T1040 OR T1049 OR T1083 OR T1021.002 OR T1570 OR T1071 OR T1090.001 OR T1132 OR T1571 OR T1573.002 OR T1685 OR T1686) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Velvet Ant with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078.003 OR T1133 OR T1047 OR T1059.004 OR T1569.002 OR T1574.001 OR T1037.004 OR T1055 OR T1040 OR T1049 OR T1083 OR T1021.002 OR T1570 OR T1071 OR T1090.001 OR T1132 OR T1571 OR T1573.002 OR T1685 OR T1686) OR threat.technique.id:(T1078.003 OR T1133 OR T1047 OR T1059.004 OR T1569.002 OR T1574.001 OR T1037.004 OR T1055 OR T1040 OR T1049 OR T1083 OR T1021.002 OR T1570 OR T1071 OR T1090.001 OR T1132 OR T1571 OR T1573.002 OR T1685 OR T1686) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1059.004\"\n[[rule.threat.technique]]\nid = \"T1569.002\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1059.004\"\n[[rule.threat.technique]]\nid = \"T1569.002\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1059.004\"\n[[rule.threat.technique]]\nid = \"T1569.002\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.003\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1059.004\"\n[[rule.threat.technique]]\nid = \"T1569.002\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1048-unc3886.json b/app/playbooks/threat-groups/apt-g1048-unc3886.json
new file mode 100644
index 0000000..599fbc1
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1048-unc3886.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g1048",
+ "num": 209,
+ "name": "MITRE ATT&CK Group — UNC3886",
+ "fullName": "UNC3886 (G1048) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[UNC3886](https://attack.mitre.org/groups/G1048) is a China-nexus cyberespionage group that has been active since at least 2022, targeting defense, technology, and telecommunication organizations located in the United States and the Asia-Pacific-Japan (APJ) regions. [UNC3886](https://attack.mitre.org/groups/G1048) has displayed a deep understanding of edge devices and virtualization technologies through the exploitation of zero-day vulnerabilities and the use of novel malware families and utilities. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with UNC3886.",
+ "mitre": "T1078, T1078.001, T1190, T1059.001, T1059.003, T1059.004, T1059.006, T1059.012, T1203, T1675, T1037, T1037.004, T1205, T1205.001, T1505.006, T1554, T1068, T1548, T1003.001, T1040, T1212, T1555.005, T1057, T1083",
+ "aliases": [
+ "UNC3886"
+ ],
+ "mitreGroupId": "G1048",
+ "mitreUrl": "https://attack.mitre.org/groups/G1048",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile UNC3886 with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1048. Aliases: UNC3886. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Defense Impairment, Reconnaissance, Resource Development, Stealth. Mapped techniques: T1078 Valid Accounts, T1078.001 Default Accounts, T1190 Exploit Public-Facing Application, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1059.004 Unix Shell, T1059.006 Python, T1059.012 Hypervisor CLI, T1203 Exploitation for Client Execution, T1675 ESXi Administration Command, T1037 Boot or Logon Initialization Scripts, T1037.004 RC Scripts, plus 37 additional mapped technique(s). Source: https://attack.mitre.org/groups/G1048. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - UNC3886 (G1048) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1078.001 OR T1190 OR T1059.001 OR T1059.003 OR T1059.004 OR T1059.006 OR T1059.012 OR T1203 OR T1675 OR T1037 OR T1037.004 OR T1205 OR T1205.001 OR T1505.006 OR T1554 OR T1068 OR T1548 OR T1003.001 OR T1040) OR threat.technique.id:(T1078 OR T1078.001 OR T1190 OR T1059.001 OR T1059.003 OR T1059.004 OR T1059.006 OR T1059.012 OR T1203 OR T1675 OR T1037 OR T1037.004 OR T1205 OR T1205.001 OR T1505.006 OR T1554 OR T1068 OR T1548 OR T1003.001 OR T1040) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - UNC3886 (G1048) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1078.001 OR T1190 OR T1059.001 OR T1059.003 OR T1059.004 OR T1059.006 OR T1059.012 OR T1203 OR T1675 OR T1037 OR T1037.004 OR T1205 OR T1205.001 OR T1505.006 OR T1554 OR T1068 OR T1548 OR T1003.001 OR T1040) OR threat.technique.id:(T1078 OR T1078.001 OR T1190 OR T1059.001 OR T1059.003 OR T1059.004 OR T1059.006 OR T1059.012 OR T1203 OR T1675 OR T1037 OR T1037.004 OR T1205 OR T1205.001 OR T1505.006 OR T1554 OR T1068 OR T1548 OR T1003.001 OR T1040) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile UNC3886 with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1078.001 OR T1190 OR T1059.001 OR T1059.003 OR T1059.004 OR T1059.006 OR T1059.012 OR T1203 OR T1675 OR T1037 OR T1037.004 OR T1205 OR T1205.001 OR T1505.006 OR T1554 OR T1068 OR T1548 OR T1003.001 OR T1040) OR threat.technique.id:(T1078 OR T1078.001 OR T1190 OR T1059.001 OR T1059.003 OR T1059.004 OR T1059.006 OR T1059.012 OR T1203 OR T1675 OR T1037 OR T1037.004 OR T1205 OR T1205.001 OR T1505.006 OR T1554 OR T1068 OR T1548 OR T1003.001 OR T1040) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.001\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.001\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.001\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.001\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1049-applejeus.json b/app/playbooks/threat-groups/apt-g1049-applejeus.json
new file mode 100644
index 0000000..dc517bd
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1049-applejeus.json
@@ -0,0 +1,120 @@
+{
+ "id": "apt-g1049",
+ "num": 210,
+ "name": "MITRE ATT&CK Group — AppleJeus",
+ "fullName": "AppleJeus (G1049) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[AppleJeus](https://attack.mitre.org/groups/G1049) is a North Korean state-sponsored threat group attributed to the Reconnaissance General Bureau. Associated with the broader [Lazarus Group](https://attack.mitre.org/groups/G0032) umbrella of actors, [AppleJeus](https://attack.mitre.org/groups/G1049) has been active since at least 2018 and is closely aligned in resources with TEMP.hermit, another DPRK-affiliated group under the same umbrella. The group’s primary mission is to generate and launder revenue to provide financial support to the government. [AppleJeus](https://attack.mitre.org/groups/G1049) primarily targets the cryptocurrency industry and is most notably responsible for the [3CX Supply Chain Attack](https://attack.mitre.org/campaigns/C0057). The group traditionally deploys malicious cryptocurrency software in combination with [Phishing](https://attack.mitre.org/techniques/T1566). From these compromised environments, it selectively deploys additional backdoors to enable extended operations against high-value financial targets. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with AppleJeus.",
+ "mitre": "T1566, T1657",
+ "aliases": [
+ "AppleJeus",
+ "Gleaming Pisces",
+ "Citrine Sleet",
+ "UNC1720",
+ "UNC4736"
+ ],
+ "mitreGroupId": "G1049",
+ "mitreUrl": "https://attack.mitre.org/groups/G1049",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile AppleJeus with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1049. Aliases: AppleJeus, Gleaming Pisces, Citrine Sleet, UNC1720, UNC4736. Primary mapped tactics: Initial Access, Impact. Mapped techniques: T1566 Phishing, T1657 Financial Theft. Source: https://attack.mitre.org/groups/G1049. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - AppleJeus (G1049) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566 OR T1657) OR threat.technique.id:(T1566 OR T1657) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - AppleJeus (G1049) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566 OR T1657) OR threat.technique.id:(T1566 OR T1657) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile AppleJeus with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1566 OR T1657) OR threat.technique.id:(T1566 OR T1657) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566\"\n[[rule.threat.technique]]\nid = \"T1657\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566\"\n[[rule.threat.technique]]\nid = \"T1657\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566\"\n[[rule.threat.technique]]\nid = \"T1657\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566\"\n[[rule.threat.technique]]\nid = \"T1657\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1050-water-galura.json b/app/playbooks/threat-groups/apt-g1050-water-galura.json
new file mode 100644
index 0000000..c812c65
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1050-water-galura.json
@@ -0,0 +1,117 @@
+{
+ "id": "apt-g1050",
+ "num": 211,
+ "name": "MITRE ATT&CK Group — Water Galura",
+ "fullName": "Water Galura (G1050) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Water Galura](https://attack.mitre.org/groups/G1050) are the operators of the [Qilin](https://attack.mitre.org/software/S1242) Ransomware-as-a-Service (RaaS) who handle payload generation, ransom negotiations, and the publication of stolen data for [Qilin](https://attack.mitre.org/software/S1242) affilates recruited on Russian cybercrime forums. [Water Galura](https://attack.mitre.org/groups/G1050) have been active since at least 2022 and use a double extortion model where they demand payment for providing decryption keys and for refraining from publishing the stolen data to their leak site. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Water Galura.",
+ "mitre": "T1486, T1657, T1585.001",
+ "aliases": [
+ "Water Galura",
+ "GOLD FEATHER"
+ ],
+ "mitreGroupId": "G1050",
+ "mitreUrl": "https://attack.mitre.org/groups/G1050",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Water Galura with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1050. Aliases: Water Galura, GOLD FEATHER. Primary mapped tactics: Impact, Resource Development. Mapped techniques: T1486 Data Encrypted for Impact, T1657 Financial Theft, T1585.001 Social Media Accounts. Source: https://attack.mitre.org/groups/G1050. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Water Galura (G1050) ATT&CK technique pivots\n(rule.threat.technique.id:(T1486 OR T1657 OR T1585.001) OR threat.technique.id:(T1486 OR T1657 OR T1585.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Water Galura (G1050) ATT&CK technique pivots\n(rule.threat.technique.id:(T1486 OR T1657 OR T1585.001) OR threat.technique.id:(T1486 OR T1657 OR T1585.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Water Galura with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1486 OR T1657 OR T1585.001) OR threat.technique.id:(T1486 OR T1657 OR T1585.001) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1486\"\n[[rule.threat.technique]]\nid = \"T1657\"\n[[rule.threat.technique]]\nid = \"T1585.001\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1486\"\n[[rule.threat.technique]]\nid = \"T1657\"\n[[rule.threat.technique]]\nid = \"T1585.001\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1486\"\n[[rule.threat.technique]]\nid = \"T1657\"\n[[rule.threat.technique]]\nid = \"T1585.001\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1486\"\n[[rule.threat.technique]]\nid = \"T1657\"\n[[rule.threat.technique]]\nid = \"T1585.001\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1051-medusa-group.json b/app/playbooks/threat-groups/apt-g1051-medusa-group.json
new file mode 100644
index 0000000..939f4bb
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1051-medusa-group.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g1051",
+ "num": 212,
+ "name": "MITRE ATT&CK Group — Medusa Group",
+ "fullName": "Medusa Group (G1051) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Medusa Group](https://attack.mitre.org/groups/G1051) has been active since at least 2021 and was initially operated as a closed ransomware group before evolving into a Ransomware-as-a-Service (RaaS) operation. Some reporting indicates that certain attacks may still be conducted directly by the ransomware’s core developers. Public sources have also referred to the group as “Spearwing” or “Medusa Actors.” [Medusa Group](https://attack.mitre.org/groups/G1051) employs living-off-the-land techniques, frequently leveraging publicly available tools and common remote management software to conduct operations. The group engages in double extortion tactics, exfiltrating data prior to encryption and threatening to publish stolen information if ransom demands are not met. For initial access, [Medusa Group](https://attack.mitre.org/groups/G1051) has exploited publicly known vulnerabilities, conducted phishing campaigns, and used credentials or access purchased from Initial Access Brokers (IABs). The group is opportunistic and has targeted a wide range of sectors globally. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Medusa Group.",
+ "mitre": "T1078, T1190, T1047, T1059.001, T1059.003, T1072, T1106, T1559.001, T1569.002, T1112, T1136.002, T1505.003, T1543.003, T1548.002, T1003.001, T1003.003, T1016, T1018, T1033, T1046, T1057, T1069.002, T1082, T1083",
+ "aliases": [
+ "Medusa Group"
+ ],
+ "mitreGroupId": "G1051",
+ "mitreUrl": "https://attack.mitre.org/groups/G1051",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Medusa Group with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1051. Aliases: Medusa Group. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Command and Control, Exfiltration, Impact, Defense Impairment, Resource Development, Stealth. Mapped techniques: T1078 Valid Accounts, T1190 Exploit Public-Facing Application, T1047 Windows Management Instrumentation, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1072 Software Deployment Tools, T1106 Native API, T1559.001 Component Object Model, T1569.002 Service Execution, T1112 Modify Registry, T1136.002 Domain Account, T1505.003 Web Shell, plus 45 additional mapped technique(s). Source: https://attack.mitre.org/groups/G1051. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Medusa Group (G1051) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1190 OR T1047 OR T1059.001 OR T1059.003 OR T1072 OR T1106 OR T1559.001 OR T1569.002 OR T1112 OR T1136.002 OR T1505.003 OR T1543.003 OR T1548.002 OR T1003.001 OR T1003.003 OR T1016 OR T1018 OR T1033 OR T1046) OR threat.technique.id:(T1078 OR T1190 OR T1047 OR T1059.001 OR T1059.003 OR T1072 OR T1106 OR T1559.001 OR T1569.002 OR T1112 OR T1136.002 OR T1505.003 OR T1543.003 OR T1548.002 OR T1003.001 OR T1003.003 OR T1016 OR T1018 OR T1033 OR T1046) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Medusa Group (G1051) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1190 OR T1047 OR T1059.001 OR T1059.003 OR T1072 OR T1106 OR T1559.001 OR T1569.002 OR T1112 OR T1136.002 OR T1505.003 OR T1543.003 OR T1548.002 OR T1003.001 OR T1003.003 OR T1016 OR T1018 OR T1033 OR T1046) OR threat.technique.id:(T1078 OR T1190 OR T1047 OR T1059.001 OR T1059.003 OR T1072 OR T1106 OR T1559.001 OR T1569.002 OR T1112 OR T1136.002 OR T1505.003 OR T1543.003 OR T1548.002 OR T1003.001 OR T1003.003 OR T1016 OR T1018 OR T1033 OR T1046) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Medusa Group with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1190 OR T1047 OR T1059.001 OR T1059.003 OR T1072 OR T1106 OR T1559.001 OR T1569.002 OR T1112 OR T1136.002 OR T1505.003 OR T1543.003 OR T1548.002 OR T1003.001 OR T1003.003 OR T1016 OR T1018 OR T1033 OR T1046) OR threat.technique.id:(T1078 OR T1190 OR T1047 OR T1059.001 OR T1059.003 OR T1072 OR T1106 OR T1559.001 OR T1569.002 OR T1112 OR T1136.002 OR T1505.003 OR T1543.003 OR T1548.002 OR T1003.001 OR T1003.003 OR T1016 OR T1018 OR T1033 OR T1046) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1052-contagious-interview.json b/app/playbooks/threat-groups/apt-g1052-contagious-interview.json
new file mode 100644
index 0000000..25d248a
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1052-contagious-interview.json
@@ -0,0 +1,122 @@
+{
+ "id": "apt-g1052",
+ "num": 213,
+ "name": "MITRE ATT&CK Group — Contagious Interview",
+ "fullName": "Contagious Interview (G1052) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Contagious Interview](https://attack.mitre.org/groups/G1052) is a North Korea–aligned threat group active since 2023. The group conducts both cyberespionage and financially motivated operations, including the theft of cryptocurrency and user credentials. [Contagious Interview](https://attack.mitre.org/groups/G1052) targets Windows, Linux, and macOS systems, with a particular focus on individuals engaged in software development and cryptocurrency-related activities. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Contagious Interview.",
+ "mitre": "T1566.003, T1059.003, T1059.004, T1059.005, T1059.006, T1059.007, T1204.001, T1204.002, T1204.004, T1204.005, T1543.001, T1546.004, T1547.001, T1547.013, T1555.001, T1082, T1083, T1497, T1071.003, T1090, T1219.002, T1571, T1573.001, T1041",
+ "aliases": [
+ "Contagious Interview",
+ "DeceptiveDevelopment",
+ "Gwisin Gang",
+ "Tenacious Pungsan",
+ "DEV#POPPER",
+ "PurpleBravo",
+ "TAG-121"
+ ],
+ "mitreGroupId": "G1052",
+ "mitreUrl": "https://attack.mitre.org/groups/G1052",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Contagious Interview with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1052. Aliases: Contagious Interview, DeceptiveDevelopment, Gwisin Gang, Tenacious Pungsan, DEV#POPPER, PurpleBravo, TAG-121. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Command and Control, Exfiltration, Impact, Defense Impairment, Reconnaissance, Resource Development, Stealth. Mapped techniques: T1566.003 Spearphishing via Service, T1059.003 Windows Command Shell, T1059.004 Unix Shell, T1059.005 Visual Basic, T1059.006 Python, T1059.007 JavaScript, T1204.001 Malicious Link, T1204.002 Malicious File, T1204.004 Malicious Copy and Paste, T1204.005 Malicious Library, T1543.001 Launch Agent, T1546.004 Unix Shell Configuration Modification, plus 42 additional mapped technique(s). Source: https://attack.mitre.org/groups/G1052. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Contagious Interview (G1052) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.003 OR T1059.003 OR T1059.004 OR T1059.005 OR T1059.006 OR T1059.007 OR T1204.001 OR T1204.002 OR T1204.004 OR T1204.005 OR T1543.001 OR T1546.004 OR T1547.001 OR T1547.013 OR T1555.001 OR T1082 OR T1083 OR T1497 OR T1071.003 OR T1090) OR threat.technique.id:(T1566.003 OR T1059.003 OR T1059.004 OR T1059.005 OR T1059.006 OR T1059.007 OR T1204.001 OR T1204.002 OR T1204.004 OR T1204.005 OR T1543.001 OR T1546.004 OR T1547.001 OR T1547.013 OR T1555.001 OR T1082 OR T1083 OR T1497 OR T1071.003 OR T1090) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Contagious Interview (G1052) ATT&CK technique pivots\n(rule.threat.technique.id:(T1566.003 OR T1059.003 OR T1059.004 OR T1059.005 OR T1059.006 OR T1059.007 OR T1204.001 OR T1204.002 OR T1204.004 OR T1204.005 OR T1543.001 OR T1546.004 OR T1547.001 OR T1547.013 OR T1555.001 OR T1082 OR T1083 OR T1497 OR T1071.003 OR T1090) OR threat.technique.id:(T1566.003 OR T1059.003 OR T1059.004 OR T1059.005 OR T1059.006 OR T1059.007 OR T1204.001 OR T1204.002 OR T1204.004 OR T1204.005 OR T1543.001 OR T1546.004 OR T1547.001 OR T1547.013 OR T1555.001 OR T1082 OR T1083 OR T1497 OR T1071.003 OR T1090) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Contagious Interview with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1566.003 OR T1059.003 OR T1059.004 OR T1059.005 OR T1059.006 OR T1059.007 OR T1204.001 OR T1204.002 OR T1204.004 OR T1204.005 OR T1543.001 OR T1546.004 OR T1547.001 OR T1547.013 OR T1555.001 OR T1082 OR T1083 OR T1497 OR T1071.003 OR T1090) OR threat.technique.id:(T1566.003 OR T1059.003 OR T1059.004 OR T1059.005 OR T1059.006 OR T1059.007 OR T1204.001 OR T1204.002 OR T1204.004 OR T1204.005 OR T1543.001 OR T1546.004 OR T1547.001 OR T1547.013 OR T1555.001 OR T1082 OR T1083 OR T1497 OR T1071.003 OR T1090) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.003\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.004\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1059.006\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.003\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.004\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1059.006\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.003\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.004\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1059.006\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1566.003\"\n[[rule.threat.technique]]\nid = \"T1059.003\"\n[[rule.threat.technique]]\nid = \"T1059.004\"\n[[rule.threat.technique]]\nid = \"T1059.005\"\n[[rule.threat.technique]]\nid = \"T1059.006\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1053-storm-0501.json b/app/playbooks/threat-groups/apt-g1053-storm-0501.json
new file mode 100644
index 0000000..8a7796f
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1053-storm-0501.json
@@ -0,0 +1,116 @@
+{
+ "id": "apt-g1053",
+ "num": 214,
+ "name": "MITRE ATT&CK Group — Storm-0501",
+ "fullName": "Storm-0501 (G1053) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[Storm-0501](https://attack.mitre.org/groups/G1053) is a financially motivated cyber criminal group that uses commodity and open-source tools to conduct ransomware operations. [Storm-0501](https://attack.mitre.org/groups/G1053) has been active since 2021 and has previously been affiliated with Sabbath Ransomware and other Ransomware-as-a-Service (RaaS) variants such as Hive, [BlackCat](https://attack.mitre.org/software/S1068), Hunters International, [LockBit 3.0](https://attack.mitre.org/software/S1202), and [Embargo](https://attack.mitre.org/software/S1247) ransomware. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with Storm-0501.",
+ "mitre": "T1078.004, T1190, T1053.005, T1059.001, T1059.009, T1098.001, T1098.003, T1556.009, T1484.001, T1484.002, T1003, T1003.006, T1110, T1552.004, T1555.005, T1555.006, T1057, T1082, T1087.002, T1087.004, T1482, T1518.001, T1526, T1580",
+ "aliases": [
+ "Storm-0501"
+ ],
+ "mitreGroupId": "G1053",
+ "mitreUrl": "https://attack.mitre.org/groups/G1053",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile Storm-0501 with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1053. Aliases: Storm-0501. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact, Defense Impairment, Resource Development, Stealth. Mapped techniques: T1078.004 Cloud Accounts, T1190 Exploit Public-Facing Application, T1053.005 Scheduled Task, T1059.001 PowerShell, T1059.009 Cloud API, T1098.001 Additional Cloud Credentials, T1098.003 Additional Cloud Roles, T1556.009 Conditional Access Policies, T1484.001 Group Policy Modification, T1484.002 Trust Modification, T1003 OS Credential Dumping, T1003.006 DCSync, plus 30 additional mapped technique(s). Source: https://attack.mitre.org/groups/G1053. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - Storm-0501 (G1053) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078.004 OR T1190 OR T1053.005 OR T1059.001 OR T1059.009 OR T1098.001 OR T1098.003 OR T1556.009 OR T1484.001 OR T1484.002 OR T1003 OR T1003.006 OR T1110 OR T1552.004 OR T1555.005 OR T1555.006 OR T1057 OR T1082 OR T1087.002 OR T1087.004) OR threat.technique.id:(T1078.004 OR T1190 OR T1053.005 OR T1059.001 OR T1059.009 OR T1098.001 OR T1098.003 OR T1556.009 OR T1484.001 OR T1484.002 OR T1003 OR T1003.006 OR T1110 OR T1552.004 OR T1555.005 OR T1555.006 OR T1057 OR T1082 OR T1087.002 OR T1087.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - Storm-0501 (G1053) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078.004 OR T1190 OR T1053.005 OR T1059.001 OR T1059.009 OR T1098.001 OR T1098.003 OR T1556.009 OR T1484.001 OR T1484.002 OR T1003 OR T1003.006 OR T1110 OR T1552.004 OR T1555.005 OR T1555.006 OR T1057 OR T1082 OR T1087.002 OR T1087.004) OR threat.technique.id:(T1078.004 OR T1190 OR T1053.005 OR T1059.001 OR T1059.009 OR T1098.001 OR T1098.003 OR T1556.009 OR T1484.001 OR T1484.002 OR T1003 OR T1003.006 OR T1110 OR T1552.004 OR T1555.005 OR T1555.006 OR T1057 OR T1082 OR T1087.002 OR T1087.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile Storm-0501 with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078.004 OR T1190 OR T1053.005 OR T1059.001 OR T1059.009 OR T1098.001 OR T1098.003 OR T1556.009 OR T1484.001 OR T1484.002 OR T1003 OR T1003.006 OR T1110 OR T1552.004 OR T1555.005 OR T1555.006 OR T1057 OR T1082 OR T1087.002 OR T1087.004) OR threat.technique.id:(T1078.004 OR T1190 OR T1053.005 OR T1059.001 OR T1059.009 OR T1098.001 OR T1098.003 OR T1556.009 OR T1484.001 OR T1484.002 OR T1003 OR T1003.006 OR T1110 OR T1552.004 OR T1555.005 OR T1555.006 OR T1057 OR T1082 OR T1087.002 OR T1087.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.004\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.009\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.004\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.009\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.004\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.009\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078.004\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1053.005\"\n[[rule.threat.technique]]\nid = \"T1059.001\"\n[[rule.threat.technique]]\nid = \"T1059.009\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1054-mirrorface.json b/app/playbooks/threat-groups/apt-g1054-mirrorface.json
new file mode 100644
index 0000000..0d59db8
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1054-mirrorface.json
@@ -0,0 +1,117 @@
+{
+ "id": "apt-g1054",
+ "num": 215,
+ "name": "MITRE ATT&CK Group — MirrorFace",
+ "fullName": "MirrorFace (G1054) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[MirrorFace](https://attack.mitre.org/groups/G1054) is a People's Republic of China (PRC)-aligned cyberespionage actor believed to be a subgroup under the [menuPass](https://attack.mitre.org/groups/G0045) umbrella based on targeting, tools, and infrastructure overlaps. [MirrorFace](https://attack.mitre.org/groups/G1054) has been active since at least 2019, at first exclusively targeting Japanese organizations across the media, defense, diplomatic, financial, manufacturing, and academic sectors. Subsequent [MirrorFace](https://attack.mitre.org/groups/G1054) operations included targets in Central Europe and featured use of [LODEINFO](https://attack.mitre.org/software/S9020), [HiddenFace](https://attack.mitre.org/software/S9023), and [UPPERCUT](https://attack.mitre.org/software/S0275) malware. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with MirrorFace.",
+ "mitre": "T1190, T1566.001, T1566.002, T1047, T1059.003, T1059.005, T1204.002, T1574.001, T1556.002, T1003.001, T1003.002, T1003.003, T1007, T1016, T1018, T1033, T1057, T1082, T1083, T1087.002, T1482, T1614.001, T1021.001, T1021.002",
+ "aliases": [
+ "MirrorFace",
+ "Earth Kasha"
+ ],
+ "mitreGroupId": "G1054",
+ "mitreUrl": "https://attack.mitre.org/groups/G1054",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile MirrorFace with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1054. Aliases: MirrorFace, Earth Kasha. Primary mapped tactics: Initial Access, Execution, Persistence, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Defense Impairment, Reconnaissance, Resource Development, Stealth. Mapped techniques: T1190 Exploit Public-Facing Application, T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link, T1047 Windows Management Instrumentation, T1059.003 Windows Command Shell, T1059.005 Visual Basic, T1204.002 Malicious File, T1574.001 DLL, T1556.002 Password Filter DLL, T1003.001 LSASS Memory, T1003.002 Security Account Manager, T1003.003 NTDS, plus 31 additional mapped technique(s). Source: https://attack.mitre.org/groups/G1054. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - MirrorFace (G1054) ATT&CK technique pivots\n(rule.threat.technique.id:(T1190 OR T1566.001 OR T1566.002 OR T1047 OR T1059.003 OR T1059.005 OR T1204.002 OR T1574.001 OR T1556.002 OR T1003.001 OR T1003.002 OR T1003.003 OR T1007 OR T1016 OR T1018 OR T1033 OR T1057 OR T1082 OR T1083 OR T1087.002) OR threat.technique.id:(T1190 OR T1566.001 OR T1566.002 OR T1047 OR T1059.003 OR T1059.005 OR T1204.002 OR T1574.001 OR T1556.002 OR T1003.001 OR T1003.002 OR T1003.003 OR T1007 OR T1016 OR T1018 OR T1033 OR T1057 OR T1082 OR T1083 OR T1087.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - MirrorFace (G1054) ATT&CK technique pivots\n(rule.threat.technique.id:(T1190 OR T1566.001 OR T1566.002 OR T1047 OR T1059.003 OR T1059.005 OR T1204.002 OR T1574.001 OR T1556.002 OR T1003.001 OR T1003.002 OR T1003.003 OR T1007 OR T1016 OR T1018 OR T1033 OR T1057 OR T1082 OR T1083 OR T1087.002) OR threat.technique.id:(T1190 OR T1566.001 OR T1566.002 OR T1047 OR T1059.003 OR T1059.005 OR T1204.002 OR T1574.001 OR T1556.002 OR T1003.001 OR T1003.002 OR T1003.003 OR T1007 OR T1016 OR T1018 OR T1033 OR T1057 OR T1082 OR T1083 OR T1087.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile MirrorFace with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1190 OR T1566.001 OR T1566.002 OR T1047 OR T1059.003 OR T1059.005 OR T1204.002 OR T1574.001 OR T1556.002 OR T1003.001 OR T1003.002 OR T1003.003 OR T1007 OR T1016 OR T1018 OR T1033 OR T1057 OR T1082 OR T1083 OR T1087.002) OR threat.technique.id:(T1190 OR T1566.001 OR T1566.002 OR T1047 OR T1059.003 OR T1059.005 OR T1204.002 OR T1574.001 OR T1556.002 OR T1003.001 OR T1003.002 OR T1003.003 OR T1007 OR T1016 OR T1018 OR T1033 OR T1057 OR T1082 OR T1083 OR T1087.002) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1190\"\n[[rule.threat.technique]]\nid = \"T1566.001\"\n[[rule.threat.technique]]\nid = \"T1566.002\"\n[[rule.threat.technique]]\nid = \"T1047\"\n[[rule.threat.technique]]\nid = \"T1059.003\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/playbooks/threat-groups/apt-g1055-void-manticore.json b/app/playbooks/threat-groups/apt-g1055-void-manticore.json
new file mode 100644
index 0000000..e231e02
--- /dev/null
+++ b/app/playbooks/threat-groups/apt-g1055-void-manticore.json
@@ -0,0 +1,123 @@
+{
+ "id": "apt-g1055",
+ "num": 216,
+ "name": "MITRE ATT&CK Group — VOID MANTICORE",
+ "fullName": "VOID MANTICORE (G1055) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": "[VOID MANTICORE](https://attack.mitre.org/groups/G1055) is a threat group assessed to operate on behalf of Iran’s Ministry of Intelligence and Security (MOIS). Active since at least mid-2022, VOID MANTICORE has targeted government entities, critical infrastructure, and private sector organizations across Albania, Israel, and the United States. [VOID MANTICORE](https://attack.mitre.org/groups/G1055) conducts destructive cyber operations, combining wiper attacks with hack-and-leak campaigns. The group has operated under multiple public-facing personas, including [HomeLand Justice](https://attack.mitre.org/campaigns/C0038) in operations against Albania, Karma and Karma Below in campaigns targeting Israeli organizations, and Handala Hack, its current primary persona, which has claimed activity against Israeli and U.S. entities, including a March 2026 attack against Stryker Corporation. [VOID MANTICORE](https://attack.mitre.org/groups/G1055) has been observed collaborating with Scarred Manticore, which has been linked to initial access operations preceding VOID MANTICORE’s activity. This default playbook uses MITRE ATT&CK mapped techniques and practical Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate activity consistent with VOID MANTICORE.",
+ "mitre": "T1078, T1078.002, T1078.004, T1133, T1190, T1199, T1566, T1047, T1059.001, T1059.006, T1072, T1204.002, T1651, T1098, T1547.001, T1484.001, T1003.001, T1110, T1110.001, T1110.004, T1552.002, T1082, T1087.002, T1021.001",
+ "aliases": [
+ "VOID MANTICORE",
+ "COBALT MYSTIQUE",
+ "Handala Hack",
+ "Homeland Justice",
+ "Karma",
+ "Karmabelow80",
+ "BANISHED KITTEN",
+ "Red Sandstorm"
+ ],
+ "mitreGroupId": "G1055",
+ "mitreUrl": "https://attack.mitre.org/groups/G1055",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": "2026-05-18",
+ "detSteps": [
+ {
+ "n": 1,
+ "title": "Profile VOID MANTICORE with MITRE ATT&CK context",
+ "detail": "MITRE Group ID: G1055. Aliases: VOID MANTICORE, COBALT MYSTIQUE, Handala Hack, Homeland Justice, Karma, Karmabelow80, BANISHED KITTEN, Red Sandstorm. Primary mapped tactics: Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact, Defense Impairment, Reconnaissance, Resource Development, Stealth. Mapped techniques: T1078 Valid Accounts, T1078.002 Domain Accounts, T1078.004 Cloud Accounts, T1133 External Remote Services, T1190 Exploit Public-Facing Application, T1199 Trusted Relationship, T1566 Phishing, T1047 Windows Management Instrumentation, T1059.001 PowerShell, T1059.006 Python, T1072 Software Deployment Tools, T1204.002 Malicious File, plus 51 additional mapped technique(s). Source: https://attack.mitre.org/groups/G1055. Use this step to scope the hunt, select relevant telemetry, and prioritize techniques that overlap the current alert or campaign.",
+ "queries": {
+ "security_onion": "# Security Onion KQL - VOID MANTICORE (G1055) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1078.002 OR T1078.004 OR T1133 OR T1190 OR T1199 OR T1566 OR T1047 OR T1059.001 OR T1059.006 OR T1072 OR T1204.002 OR T1651 OR T1098 OR T1547.001 OR T1484.001 OR T1003.001 OR T1110 OR T1110.001 OR T1110.004) OR threat.technique.id:(T1078 OR T1078.002 OR T1078.004 OR T1133 OR T1190 OR T1199 OR T1566 OR T1047 OR T1059.001 OR T1059.006 OR T1072 OR T1204.002 OR T1651 OR T1098 OR T1547.001 OR T1484.001 OR T1003.001 OR T1110 OR T1110.001 OR T1110.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT pid, name, path, cmdline, parent, start_time\nFROM processes\nWHERE cmdline LIKE '%-enc%'\n OR cmdline LIKE '%FromBase64String%'\n OR cmdline LIKE '%DownloadString%'\n OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');",
+ "velociraptor": "LET procs = SELECT Name, Exe, CommandLine, Pid,\n authenticode(filename=Exe).Trusted AS Trusted\nFROM pslist() WHERE Exe\nSELECT Name, Exe, CommandLine, Pid, Trusted\nFROM procs\nWHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'",
+ "elastic": "# Elastic KQL - VOID MANTICORE (G1055) ATT&CK technique pivots\n(rule.threat.technique.id:(T1078 OR T1078.002 OR T1078.004 OR T1133 OR T1190 OR T1199 OR T1566 OR T1047 OR T1059.001 OR T1059.006 OR T1072 OR T1204.002 OR T1651 OR T1098 OR T1547.001 OR T1484.001 OR T1003.001 OR T1110 OR T1110.001 OR T1110.004) OR threat.technique.id:(T1078 OR T1078.002 OR T1078.004 OR T1133 OR T1190 OR T1199 OR T1566 OR T1047 OR T1059.001 OR T1059.006 OR T1072 OR T1204.002 OR T1651 OR T1098 OR T1547.001 OR T1484.001 OR T1003.001 OR T1110 OR T1110.001 OR T1110.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)",
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ "elastic_detection_rules": "[rule]\nname = \"Profile VOID MANTICORE with MITRE ATT&CK context\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\n(rule.threat.technique.id:(T1078 OR T1078.002 OR T1078.004 OR T1133 OR T1190 OR T1199 OR T1566 OR T1047 OR T1059.001 OR T1059.006 OR T1072 OR T1204.002 OR T1651 OR T1098 OR T1547.001 OR T1484.001 OR T1003.001 OR T1110 OR T1110.001 OR T1110.004) OR threat.technique.id:(T1078 OR T1078.002 OR T1078.004 OR T1133 OR T1190 OR T1199 OR T1566 OR T1047 OR T1059.001 OR T1059.006 OR T1072 OR T1204.002 OR T1651 OR T1098 OR T1547.001 OR T1484.001 OR T1003.001 OR T1110 OR T1110.001 OR T1110.004) OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1078.004\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\""
+ }
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and admin jump boxes should have separate baselines.",
+ "queries": {
+ "security_onion": "# Initial access/execution/persistence hunt\n(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))\nOR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))\nOR (event.code:(4698 OR 4702 OR 7045))\nOR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT name, action, path FROM scheduled_tasks\nUNION\nSELECT name, path, status FROM services\nWHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';",
+ "velociraptor": "SELECT FullPath, Mtime, Size\nFROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])\nWHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)",
+ "elastic": "event.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt initial access, execution, and persistence behaviors\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"process\" and process.name:(\"powershell.exe\" or \"cmd.exe\" or \"mshta.exe\" or \"regsvr32.exe\" or \"rundll32.exe\")\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1078.004\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\""
+ }
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs.",
+ "queries": {
+ "security_onion": "# Credential access + discovery + lateral movement\n(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)\nOR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))\nOR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT * FROM process_open_sockets\nWHERE remote_port IN (88,135,139,389,445,3389,5985,5986);\n\nSELECT pid, name, cmdline FROM processes\nWHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';",
+ "velociraptor": "SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)",
+ "elastic": "event.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt credential access, discovery, and lateral movement\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1078.004\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\""
+ }
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing.",
+ "queries": {
+ "security_onion": "# C2 and exfiltration hunt\n(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))\nOR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))\nOR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))\nOR (event.dataset:suricata.eve AND event.kind:alert)",
+ "sysmon": "\n \n \n \n -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32 \n \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe \n \n \n \n \n C:\\Windows\\System32\\lsass.exe \n \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe \n \n \n \n \n 53;80;443;445;3389;5985;5986;8080;8443 \n \n \n \n \n \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages \n \n \n \n .top;.xyz;.club;.online;.site;.cc \n \n \n ",
+ "osquery": "SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port\nFROM processes p\nJOIN process_open_sockets s ON p.pid = s.pid\nWHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);",
+ "velociraptor": "SELECT Pid, Process, RemoteAddress, RemotePort, Status\nFROM netstat()\nWHERE RemotePort IN (53,80,443,8080,8443,1080,8888)",
+ "elastic": "event.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ "elastic_detection_rules": "[rule]\nname = \"Hunt command-and-control, ingress transfer, and exfiltration\"\ntype = \"query\"\nlanguage = \"kuery\"\nindex = [\"logs-*\", \"winlogbeat-*\", \"filebeat-*\"]\nrisk_score = 99\nseverity = \"critical\"\n\nquery = '''\nevent.category:\"network\" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)\n'''\n\n[[rule.threat]]\nframework = \"MITRE ATT&CK\"\n[[rule.threat.technique]]\nid = \"T1078\"\n[[rule.threat.technique]]\nid = \"T1078.002\"\n[[rule.threat.technique]]\nid = \"T1078.004\"\n[[rule.threat.technique]]\nid = \"T1133\"\n[[rule.threat.technique]]\nid = \"T1190\""
+ }
+ }
+ ],
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {}
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {}
+ }
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {}
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {}
+ }
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {}
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {}
+ }
+ ]
+}
diff --git a/app/style.css b/app/style.css
new file mode 100644
index 0000000..3929663
--- /dev/null
+++ b/app/style.css
@@ -0,0 +1,742 @@
+
+*,*::before,*::after{box-sizing:border-box;margin:0;padding:0}
+:root{
+ /* Light theme (default fallback) */
+ --bg:#fff;--bg2:#f7f7f5;--bg3:#f1efe8;
+ --text:#1a1a1a;--text2:#5f5e5a;--text3:#888780;
+ --border:rgba(0,0,0,0.11);--border2:rgba(0,0,0,0.22);
+ --blue-bg:#e6f1fb;--blue-t:#185fa5;
+ --amber-bg:#faeeda;--amber-t:#854f0b;
+ --red-bg:#fcebeb;--red-t:#a32d2d;
+ --green-bg:#eaf3de;--green-t:#3b6d11;
+ --teal-bg:#e1f5ee;--teal-t:#0f6e56;
+ --purple-bg:#eeedfe;--purple-t:#533ab7;
+ --gray-bg:#f1efe8;--gray-t:#5f5e5a;
+ --r:8px;--rl:12px;
+ --mono:'Courier New',monospace;
+ --sans:-apple-system,'Helvetica Neue',Arial,sans-serif;
+ /* Adaptive accent (primary CTA) */
+ --accent:#1a1a1a;--accent-fg:#fff;
+ /* Adaptive shadows */
+ --shadow-card:0 2px 8px rgba(0,0,0,.06);
+ --shadow-tab:0 1px 3px rgba(0,0,0,.09);
+ --shadow-panel:0 3px 14px rgba(0,0,0,.07);
+ --shadow-nav:0 8px 30px rgba(0,0,0,.22);
+ /* Adaptive focus ring */
+ --focus-ring:0 0 0 2px rgba(24,95,165,.14);
+ /* Severity dot colors */
+ --dot-crit:#c0392b;--dot-high:#c0720b;--dot-med:#185fa5;--dot-low:#2e7d32;--dot-custom:#5c35b5;
+ /* Navigator gradient fills */
+ --nav-grad-1:rgba(24,95,165,.12);--nav-grad-2:rgba(24,95,165,.03);
+ --nav-grad-h1:rgba(24,95,165,.2);--nav-grad-h2:rgba(24,95,165,.05);
+ --nav-grad-a1:rgba(24,95,165,.24);--nav-grad-a2:rgba(24,95,165,.08);
+ --blue-t-dim:rgba(24,95,165,.35);
+}
+[data-theme="dark"]{
+ --bg:#1c1c1e;--bg2:#242426;--bg3:#2a2a2c;
+ --text:#e8e8e8;--text2:#a0a0a0;--text3:#606060;
+ --border:rgba(255,255,255,0.08);--border2:rgba(255,255,255,0.16);
+ --blue-bg:rgba(24,95,165,0.2);--blue-t:#5aadff;
+ --amber-bg:rgba(180,94,0,0.25);--amber-t:#ffaa55;
+ --red-bg:rgba(163,45,45,0.25);--red-t:#f07878;
+ --green-bg:rgba(59,109,17,0.25);--green-t:#7dd660;
+ --teal-bg:rgba(15,110,86,0.25);--teal-t:#3ecfb0;
+ --purple-bg:rgba(83,58,183,0.25);--purple-t:#a88af5;
+ --gray-bg:rgba(95,94,90,0.18);--gray-t:#909090;
+ /* Adaptive accent — brand blue in dark mode */
+ --accent:#0078d4;--accent-fg:#fff;
+ /* Stronger shadows for dark surfaces */
+ --shadow-card:0 2px 12px rgba(0,0,0,.45);
+ --shadow-tab:0 1px 3px rgba(0,0,0,.5);
+ --shadow-panel:0 3px 14px rgba(0,0,0,.5);
+ --shadow-nav:0 8px 30px rgba(0,0,0,.65);
+ /* Brighter focus ring */
+ --focus-ring:0 0 0 2px rgba(90,173,255,.22);
+ /* Brighter severity dots for dark backgrounds */
+ --dot-crit:#ff6b6b;--dot-high:#ff9f43;--dot-med:#5aadff;--dot-low:#7dd660;--dot-custom:#a88af5;
+ /* Navigator gradients — use lighter blue tint */
+ --nav-grad-1:rgba(90,173,255,.14);--nav-grad-2:rgba(90,173,255,.04);
+ --nav-grad-h1:rgba(90,173,255,.22);--nav-grad-h2:rgba(90,173,255,.07);
+ --nav-grad-a1:rgba(90,173,255,.28);--nav-grad-a2:rgba(90,173,255,.1);
+ --blue-t-dim:rgba(90,173,255,.35);
+}
+body{font-family:var(--sans);background:var(--bg2);color:var(--text);line-height:1.6;font-size:14px}
+.layout{display:grid;grid-template-columns:268px 1fr;min-height:100vh}
+.mobile-nav-toggle{display:none}
+.mobile-nav-backdrop{display:none}
+.sidebar{background:var(--bg);border-right:1px solid var(--border);position:sticky;top:0;height:100vh;overflow-y:auto;display:flex;flex-direction:column}
+.sb-head{padding:1rem 1.1rem .9rem;border-bottom:1px solid var(--border);flex-shrink:0}
+.sb-title{font-size:13px;font-weight:700;color:var(--text)}
+.sb-sub{font-size:11px;color:var(--text3);margin-top:2px}
+.sb-search{padding:.6rem 1.1rem;border-bottom:1px solid var(--border);flex-shrink:0}
+.sb-search input{width:100%;font-size:12px;padding:5px 8px;border:1px solid var(--border2);border-radius:var(--r);background:var(--bg2);color:var(--text);outline:none}
+.sb-search input:focus{border-color:var(--blue-t)}
+.sb-nav{flex:1;overflow-y:auto;padding-bottom:1rem}
+/* ── Sidebar sections──────────────────────────────────────────────────── */
+.sb-section{border-top:1px solid var(--border);margin-top:2px;padding-top:2px}
+.sb-section:first-child{border-top:none;margin-top:0;padding-top:0}
+.sb-group-header{display:flex;justify-content:space-between;align-items:center;padding:6px 1.1rem 5px 10px;cursor:pointer;user-select:none;border-left:3px solid var(--cat-clr,var(--border2));margin-top:2px;transition:background .1s}
+.sb-group-header:hover{background:var(--bg2)}
+.sb-group-header:hover .sb-group-label{color:var(--cat-clr,var(--blue-t))}
+.sb-group-header:hover .sb-group-count{background:var(--cat-clr,var(--blue-bg));color:var(--bg)}
+.sb-group-label{font-size:10px;font-weight:800;letter-spacing:.1em;text-transform:uppercase;color:var(--cat-clr,var(--text2));padding:.7rem 1.1rem .25rem;cursor:pointer;display:flex;justify-content:space-between;align-items:center;user-select:none;transition:color .1s}
+.sb-group-meta{display:flex;align-items:center;gap:5px}
+.sb-group-count{font-size:10px;font-weight:700;background:var(--bg2);color:var(--text3);padding:1px 7px;border-radius:10px;min-width:20px;text-align:center}
+.sb-group-arr{font-size:10px;color:var(--text3)}
+.nav-group{overflow:hidden}
+.nav-item{display:flex;align-items:center;gap:7px;padding:5px 1.1rem;cursor:pointer;font-size:12px;color:var(--text2);border-left:2px solid transparent;transition:all .1s}
+.nav-item:hover{background:var(--bg2);color:var(--text)}
+.nav-item.active{background:var(--bg2);color:var(--text);font-weight:600;border-left-color:var(--accent)}
+.nav-item.hidden{display:none}
+.nav-item-navigator{position:relative;font-weight:700;color:var(--blue-t);background:linear-gradient(90deg, var(--nav-grad-1), var(--nav-grad-2));border-left-color:var(--blue-t)}
+.nav-item-navigator:hover{background:linear-gradient(90deg, var(--nav-grad-h1), var(--nav-grad-h2));color:var(--blue-t)}
+.nav-item-navigator.active{background:linear-gradient(90deg, var(--nav-grad-a1), var(--nav-grad-a2));color:var(--blue-t);border-left-color:var(--blue-t)}
+.nav-item-navigator::after{content:"MAP";margin-left:auto;font-size:9px;font-weight:800;letter-spacing:.07em;color:#fff;background:var(--blue-t);border-radius:10px;padding:1px 7px;line-height:1.5}
+/* ── Overview section (no category colour) ─────────────────────────────── */
+#g-overview .nav-item{padding-left:1.5rem}
+.dot{width:6px;height:6px;border-radius:50%;flex-shrink:0}
+.d-crit{background:var(--dot-crit)}.d-high{background:var(--dot-high)}.d-med{background:var(--dot-med)}.d-low{background:var(--dot-low)}.d-custom{background:var(--dot-custom)}
+.main{padding:1.75rem 2rem;max-width:1560px;width:100%}
+.badge{display:inline-block;font-size:11px;padding:2px 8px;border-radius:4px;font-weight:600;white-space:nowrap}
+.b-gray{background:var(--gray-bg);color:var(--gray-t)}
+.b-blue{background:var(--blue-bg);color:var(--blue-t)}
+.b-amber{background:var(--amber-bg);color:var(--amber-t)}
+.b-red{background:var(--red-bg);color:var(--red-t)}
+.b-green{background:var(--green-bg);color:var(--green-t)}
+.b-teal{background:var(--teal-bg);color:var(--teal-t)}
+.b-purple{background:var(--purple-bg);color:var(--purple-t)}
+.mitre{display:inline-block;font-size:10px;font-family:var(--mono);background:var(--blue-bg);color:var(--blue-t);border-radius:3px;padding:1px 5px;margin:1px}
+.mitre-link{text-decoration:none;border:1px solid transparent}
+.mitre-link:hover{border-color:var(--blue-t-dim);text-decoration:underline}
+.panel{display:none}.panel.visible{display:block}
+/* Home */
+.ph{margin-bottom:1.75rem;padding-bottom:1.1rem;border-bottom:1px solid var(--border)}
+.ph-ey{font-size:11px;font-weight:700;letter-spacing:.09em;text-transform:uppercase;color:var(--blue-t);margin-bottom:5px}
+.ph-ti{font-size:22px;font-weight:700}
+.ph-su{font-size:13px;color:var(--text2);margin-top:3px}
+.ph-me{display:flex;gap:5px;flex-wrap:wrap;margin-top:10px}
+.filter-bar{display:flex;gap:6px;flex-wrap:wrap;margin-bottom:1.1rem;align-items:center}
+.cards-search-wrap{margin-bottom:.8rem}
+.cards-search{width:100%;max-width:640px;font-size:13px;padding:8px 10px;border:1px solid var(--border2);border-radius:var(--r);background:var(--bg);color:var(--text);outline:none}
+.cards-search:focus{border-color:var(--blue-t);box-shadow:var(--focus-ring)}
+.filter-btn{font-size:11px;padding:4px 10px;border-radius:20px;border:1px solid var(--border);cursor:pointer;background:var(--bg);color:var(--text2);transition:all .1s}
+.filter-btn:hover{background:var(--bg2);color:var(--text);border-color:var(--border2)}
+.filter-btn.on{background:var(--accent);color:var(--accent-fg);border-color:var(--accent)}
+.cards{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:14px;max-width:1500px}
+.cards.cards-list-mode{display:block;max-width:1500px}
+.cards-table-wrap{border:1px solid var(--border);border-radius:var(--rl);overflow:auto;background:var(--bg)}
+.cards-table{width:100%;border-collapse:collapse;font-size:12px;min-width:900px}
+.cards-table th{background:var(--blue-bg);color:var(--blue-t);font-size:11px;font-weight:700;letter-spacing:.05em;text-transform:uppercase;padding:8px 10px;text-align:left;border-bottom:1px solid var(--border);white-space:nowrap}
+.cards-table td{padding:8px 10px;border-bottom:1px solid var(--border);vertical-align:middle}
+.cards-table tr:last-child td{border-bottom:none}
+.cards-table-row{cursor:pointer;transition:background .12s}
+.cards-table-row:hover,.cards-table-row:focus{background:var(--bg2);outline:none}
+.cards-table-num{font-size:10px;font-weight:700;color:var(--text3);white-space:nowrap}
+.cards-table-name{font-size:12px;font-weight:600;line-height:1.35;min-width:240px}
+.cards-table-updated{font-size:11px;color:var(--text2);white-space:nowrap}
+.cards-table-empty{font-size:11px;color:var(--text3)}
+.card-completeness-table{margin-top:0;min-width:100px}
+.card{background:var(--bg);border:1px solid var(--border);border-radius:var(--rl);padding:14px 15px;min-height:118px;cursor:pointer;transition:border-color .12s,box-shadow .12s}
+.card:hover{border-color:var(--blue-t);box-shadow:var(--shadow-card)}
+.card.hidden{display:none}
+.card-num{font-size:10px;font-weight:700;letter-spacing:.06em;color:var(--text3);margin-bottom:3px}
+.card-name{font-size:13px;font-weight:600;line-height:1.3;margin-bottom:8px}
+.card-badges{display:flex;gap:3px;flex-wrap:wrap}
+/* Playbook detail */
+.pb-ey{font-size:11px;font-weight:700;letter-spacing:.09em;text-transform:uppercase;color:var(--blue-t);margin-bottom:5px}
+.pb-ti{font-size:21px;font-weight:700;line-height:1.2}
+.pb-me{display:flex;gap:5px;flex-wrap:wrap;margin:10px 0 1.25rem}
+.detail-actions{display:flex;gap:8px;flex-wrap:wrap;margin:-.2rem 0 1rem}
+.sec-label{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--text2);margin-bottom:9px}
+.sec{margin-bottom:1.6rem}
+.phases{display:flex;gap:0;margin-bottom:1.4rem;border:1px solid var(--border);border-radius:var(--rl);overflow:hidden}
+.ph-box{flex:1;padding:7px 8px;text-align:center;font-size:11px;font-weight:600;color:var(--text2);background:var(--bg);border-right:1px solid var(--border)}
+.ph-box:last-child{border-right:none}
+.ph-box span{font-size:9px;display:block;margin-bottom:1px;opacity:.65}
+.ph-1{background:var(--gray-bg);color:var(--gray-t)}.ph-2{background:var(--blue-bg);color:var(--blue-t)}.ph-3{background:var(--amber-bg);color:var(--amber-t)}.ph-4{background:var(--red-bg);color:var(--red-t)}.ph-5{background:var(--green-bg);color:var(--green-t)}.ph-6{background:var(--teal-bg);color:var(--teal-t)}
+.steps{display:flex;flex-direction:column;gap:7px}
+.step{display:grid;grid-template-columns:26px 1fr;gap:9px;align-items:start;background:var(--bg);border:1px solid var(--border);border-radius:var(--r);padding:10px 12px;transition:border-color .12s}
+.step:hover{border-color:var(--border2)}
+.step-n{width:20px;height:20px;border-radius:50%;background:var(--blue-bg);border:1px solid var(--blue-t);display:flex;align-items:center;justify-content:center;font-size:10px;font-weight:700;color:var(--blue-t);flex-shrink:0;margin-top:2px}
+.step-t{font-size:12px;font-weight:600;color:var(--text)}
+.step-d{font-size:12px;color:var(--text2);margin-top:2px;line-height:1.5}
+.no-steps{font-size:12px;color:var(--text3);padding:8px 12px;font-style:italic}
+/* ── Scenario box ──────────────────────────────────────────────────────── */
+.scenario-box{font-size:13px;color:var(--text2);background:var(--amber-bg);border-radius:var(--r);padding:10px 13px;margin-bottom:1.25rem;border-left:3px solid var(--amber-t);line-height:1.55}
+/* ── Tool tabs bar ──────────────────────────────────────────────────────── */
+.tool-tabs-bar{display:flex;gap:2px;margin-bottom:1.1rem;background:var(--bg2);border:1px solid var(--border);border-radius:var(--r);padding:3px}
+.tool-tab{flex:1;font-size:11px;font-weight:600;padding:5px 8px;border-radius:calc(var(--r) - 2px);border:none;cursor:pointer;background:transparent;color:var(--text3);transition:all .12s;white-space:nowrap}
+.tool-tab:hover{background:var(--bg);color:var(--blue-t)}
+.tool-tab.active{background:var(--bg);color:var(--blue-t);box-shadow:var(--shadow-tab)}
+/* ── Query block per-tool colours ──────────────────────────────────────── */
+.step-q-label--splunk{background:var(--amber-bg);color:var(--amber-t)}
+.step-q-label--kql{background:var(--blue-bg);color:var(--blue-t)}
+.step-q-label--qradar{background:var(--teal-bg);color:var(--teal-t)}
+.step-q-label--sigma{background:var(--purple-bg);color:var(--purple-t)}
+.step-q-label--sysmon{background:var(--bg2);color:var(--text2);border:1px solid var(--border)}
+.step-q-label--velociraptor{background:var(--green-bg);color:var(--green-t)}
+.step-q-label--carbon_black{background:var(--red-bg);color:var(--red-t)}
+.step-q-label--elastic{background:var(--amber-bg);color:var(--amber-t)}
+.step-q-label--elastic_detection_rules{background:var(--teal-bg);color:var(--teal-t)}
+.step-q-label--chronicle{background:var(--teal-bg);color:var(--teal-t)}
+.step-q-label--crowdstrike{background:var(--red-bg);color:var(--red-t)}
+.step-q-label--defender{background:var(--blue-bg);color:var(--blue-t)}
+.step-q-label--opensearch{background:var(--green-bg);color:var(--green-t)}
+.step-q-label--logrhythm{background:var(--purple-bg);color:var(--purple-t)}
+.step-q--empty{opacity:.65}
+.no-query-msg{font-size:12px;color:var(--text3);padding:8px 10px;font-style:italic}
+/* ── Syntax highlighted code blocks ───────────────────────────────────── */
+.step-q pre{margin:0}
+.step-q pre code.hljs{font-family:var(--mono);font-size:11px;line-height:1.6;word-break:break-all;white-space:pre-wrap;background:var(--bg2)!important;padding:8px 10px!important;border-radius:0 0 4px 4px}
+.tbl-wrap{border:1px solid var(--border);border-radius:var(--rl);overflow:hidden;margin-bottom:1.1rem}
+table.g{width:100%;border-collapse:collapse;font-size:12px}
+table.g th{background:var(--blue-bg);color:var(--blue-t);font-size:11px;font-weight:700;letter-spacing:.05em;text-transform:uppercase;padding:8px 11px;text-align:left;border-bottom:1px solid var(--border)}
+table.g td{padding:8px 11px;border-bottom:1px solid var(--border);vertical-align:top;line-height:1.4}
+table.g tr:last-child td{border-bottom:none}
+.divider{border:none;border-top:1px solid var(--border);margin:1.5rem 0}
+/* Form */
+.form-grid{display:grid;grid-template-columns:1fr 1fr;gap:12px}
+.form-full{grid-column:1/-1}
+.form-group{display:flex;flex-direction:column;gap:5px}
+.form-label{font-size:12px;font-weight:600;color:var(--text2)}
+.form-label span{color:var(--red-t)}
+.form-input,.form-select,.form-textarea{font-size:13px;padding:7px 10px;border:1px solid var(--border2);border-radius:var(--r);background:var(--bg);color:var(--text);font-family:var(--sans);outline:none;width:100%}
+.form-input:focus,.form-select:focus,.form-textarea:focus{border-color:var(--blue-t);box-shadow:var(--focus-ring)}
+.form-textarea{resize:vertical;min-height:72px;line-height:1.5}
+.step-builder{border:1px solid var(--border);border-radius:var(--r);overflow:hidden}
+.step-builder-head{background:var(--blue-bg);padding:7px 11px;font-size:11px;font-weight:700;letter-spacing:.06em;text-transform:uppercase;color:var(--blue-t);border-bottom:1px solid var(--border);display:flex;justify-content:space-between;align-items:center}
+.step-builder-body{display:flex;flex-direction:column;gap:0}
+.step-row{display:flex;align-items:center;gap:8px;padding:7px 11px;border-bottom:1px solid var(--border)}
+.step-row:last-child{border-bottom:none}
+.step-row-n{font-size:11px;font-weight:700;color:var(--blue-t);min-width:18px}
+.step-row-body{flex:1;display:flex;flex-direction:column;gap:6px}
+.step-row-title{font-size:12px;padding:5px 8px;border:1px solid var(--border);border-radius:5px;background:var(--bg);color:var(--text);outline:none;width:100%}
+.step-row-title:focus{border-color:var(--blue-t)}
+.step-row-detail{font-size:12px;padding:5px 8px;border:1px solid var(--border);border-radius:5px;background:var(--bg);color:var(--text);font-family:var(--sans);outline:none;resize:vertical;width:100%}
+.step-row-detail:focus{border-color:var(--blue-t)}
+.step-query-details{border:1px solid var(--border);border-radius:5px;overflow:hidden}
+.step-query-summary{font-size:11px;font-weight:600;color:var(--blue-t);padding:5px 9px;cursor:pointer;user-select:none;background:var(--blue-bg);border-bottom:1px solid var(--border);list-style:none;transition:background .1s,color .1s}
+.step-query-summary:hover{background:var(--blue-bg);filter:brightness(0.95)}
+details[open]>.step-query-summary{border-bottom:1px solid var(--border)}
+.step-query-summary::-webkit-details-marker{display:none}
+.step-query-hint{font-weight:400;opacity:.7}
+.step-query-grid{display:grid;grid-template-columns:1fr 1fr;gap:8px;padding:8px}
+.step-query-field{display:flex;flex-direction:column;gap:3px}
+.step-query-label{font-size:10px;font-weight:700;letter-spacing:.05em;text-transform:uppercase;padding:2px 5px;border-radius:3px;width:fit-content}
+.step-query-label--splunk{background:var(--amber-bg);color:var(--amber-t)}
+.step-query-label--kql{background:var(--blue-bg);color:var(--blue-t)}
+.step-query-label--qradar{background:var(--teal-bg);color:var(--teal-t)}
+.step-query-label--sigma{background:var(--purple-bg);color:var(--purple-t)}
+.step-query-label--sysmon{background:var(--bg2);color:var(--text2);border:1px solid var(--border)}
+.step-query-label--velociraptor{background:var(--green-bg);color:var(--green-t)}
+.step-query-label--carbon_black{background:var(--red-bg);color:var(--red-t)}
+.step-query-label--elastic{background:var(--amber-bg);color:var(--amber-t)}
+.step-query-label--elastic_detection_rules{background:var(--teal-bg);color:var(--teal-t)}
+.step-query-label--chronicle{background:var(--teal-bg);color:var(--teal-t)}
+.step-query-label--crowdstrike{background:var(--red-bg);color:var(--red-t)}
+.step-query-label--defender{background:var(--blue-bg);color:var(--blue-t)}
+.step-query-label--opensearch{background:var(--green-bg);color:var(--green-t)}
+.step-query-label--logrhythm{background:var(--purple-bg);color:var(--purple-t)}
+.step-query-input{font-size:11px;font-family:var(--mono);padding:5px 8px;border:1px solid var(--border);border-radius:4px;background:var(--bg2);color:var(--text);resize:vertical;outline:none;width:100%}
+.step-query-input:focus{border-color:var(--blue-t);background:var(--bg)}
+.step-del{font-size:16px;color:var(--text3);cursor:pointer;padding:2px 4px;border-radius:3px;line-height:1}
+.step-del:hover{background:var(--red-bg);color:var(--red-t)}
+.add-step-btn{display:flex;align-items:center;gap:5px;font-size:12px;color:var(--blue-t);cursor:pointer;padding:7px 11px;border-top:1px solid var(--border);background:var(--bg2)}
+.add-step-btn:hover{background:var(--blue-bg)}
+.btn{font-size:13px;padding:8px 18px;border-radius:var(--r);border:1px solid;cursor:pointer;font-weight:600;transition:all .1s}
+.btn-primary{background:var(--accent);color:var(--accent-fg);border-color:var(--accent)}.btn-primary:hover{opacity:.88}
+.btn-secondary{background:var(--bg);color:var(--text2);border-color:var(--border2);transition:all .1s}.btn-secondary:hover{background:var(--bg2);color:var(--blue-t);border-color:var(--blue-t)}
+.btn-danger{background:var(--red-bg);color:var(--red-t);border-color:var(--red-t);font-size:12px;padding:5px 12px}
+.btn-danger:hover{background:var(--red-t);color:#fff}
+.form-actions{display:flex;gap:8px;margin-top:1.25rem;padding-top:1.25rem;border-top:1px solid var(--border)}
+.success-banner{background:var(--green-bg);color:var(--green-t);border:1px solid var(--green-t);border-radius:var(--r);padding:10px 14px;font-size:13px;font-weight:600;margin-bottom:1rem;display:none}
+.mitre-input-row{display:flex;gap:6px;align-items:center;margin-bottom:6px}
+.mitre-tag-input{font-size:12px;padding:4px 8px;border:1px solid var(--border);border-radius:4px;background:var(--bg);color:var(--text);width:110px;font-family:var(--mono)}
+.mitre-tag-input:focus{border-color:var(--blue-t);outline:none}
+.mitre-input-help{font-size:11px;color:var(--text3);margin-top:4px}
+.mitre-input-help a{color:var(--blue-t)}
+.mitre-chip{display:inline-flex;align-items:center;gap:4px;background:var(--bg2);border:1px solid var(--border);border-radius:5px;padding:1px 4px}
+.mitre-chip-name{font-size:11px;color:var(--text2);max-width:280px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+.mitre-chip-remove{border:none;background:transparent;color:var(--text3);font-size:14px;line-height:1;cursor:pointer;padding:0 2px}
+.mitre-chip-remove:hover{color:var(--red-t)}
+.custom-badge{background:var(--purple-bg);color:var(--purple-t)}
+.navigator-panel{background:linear-gradient(180deg, var(--bg), var(--bg3));border:1px solid var(--border2);border-radius:var(--rl);padding:14px;box-shadow:var(--shadow-panel)}
+.navigator-source-tabs{display:flex;gap:6px;flex-wrap:wrap;margin-bottom:10px}
+.navigator-source-tab{font-size:12px;font-weight:700;padding:6px 11px;border:1px solid var(--border2);border-radius:999px;background:var(--bg);color:var(--text2);cursor:pointer;transition:all .12s}
+.navigator-source-tab:hover{border-color:var(--blue-t);color:var(--blue-t);background:var(--blue-bg)}
+.navigator-source-tab.active{border-color:var(--blue-t);background:var(--blue-t);color:#fff}
+.navigator-controls{display:grid;grid-template-columns:2fr 1fr auto auto;gap:8px;align-items:end;margin-bottom:10px}
+.navigator-field{display:flex;flex-direction:column;gap:4px}
+.navigator-field label{font-size:11px;font-weight:800;letter-spacing:.05em;text-transform:uppercase;color:var(--blue-t)}
+.navigator-select{font-size:13px;font-weight:600;padding:7px 9px;border:1px solid var(--border2);border-radius:6px;background:var(--bg);color:var(--text);outline:none}
+.navigator-select:focus{border-color:var(--blue-t);box-shadow:var(--focus-ring)}
+.navigator-controls .btn-secondary{border-color:var(--blue-t);background:var(--bg);color:var(--blue-t);font-weight:700}
+.navigator-controls .btn-secondary:hover{background:var(--blue-bg)}
+.navigator-summary{font-size:12px;font-weight:600;color:var(--text2);margin-bottom:10px;background:var(--blue-bg);border:1px solid var(--blue-t-dim);border-radius:6px;padding:6px 9px}
+.navigator-embed{width:100%;height:72vh;min-height:620px;border:1px solid var(--border);border-radius:var(--r);background:var(--bg)}
+@media(min-width:1100px){.cards{grid-template-columns:repeat(3,minmax(0,1fr))}}
+@media(min-width:1320px){.cards{grid-template-columns:repeat(4,minmax(0,1fr))}}
+@media(min-width:1540px){.cards{grid-template-columns:repeat(5,minmax(0,1fr))}}
+@media(min-width:1760px){.cards{grid-template-columns:repeat(6,minmax(0,1fr))}}
+@media(max-width:980px){
+ .layout{grid-template-columns:1fr}
+ .main{padding:4.3rem 1rem 1.25rem}
+ .cards{grid-template-columns:1fr}
+ .mobile-nav-toggle{display:flex;position:fixed;left:12px;top:12px;width:40px;height:40px;border:1px solid var(--border2);border-radius:8px;background:var(--bg);color:var(--text);align-items:center;justify-content:center;font-size:20px;line-height:1;cursor:pointer;z-index:1200}
+ .mobile-nav-backdrop{position:fixed;inset:0;background:rgba(0,0,0,.35);z-index:1090}
+ .sidebar{position:fixed;left:0;top:0;bottom:0;width:268px;max-width:86vw;height:100vh;transform:translateX(-100%);transition:transform .2s ease;z-index:1100;box-shadow:var(--shadow-nav)}
+ body.nav-open{overflow:hidden}
+ body.nav-open .mobile-nav-backdrop{display:block}
+ body.nav-open .sidebar{transform:translateX(0)}
+}
+@media(max-width:680px){.form-grid{grid-template-columns:1fr}.cards-search{max-width:none}}
+@media(max-width:900px){.navigator-controls{grid-template-columns:1fr}.navigator-embed{height:64vh;min-height:460px}}
+
+.step-d{font-size:12px;color:var(--text2);margin-top:4px;line-height:1.55}
+.step-q{margin-top:8px;background:var(--bg2);border:1px solid var(--border);border-radius:var(--r);overflow:hidden}
+.step-q-label{display:block;font-size:10px;font-weight:700;letter-spacing:.07em;text-transform:uppercase;color:var(--blue-t);padding:4px 10px;background:var(--blue-bg);border-bottom:1px solid var(--border)}
+.step-q code{display:block;font-family:var(--mono);font-size:11px;padding:8px 10px;line-height:1.6;word-break:break-all;white-space:pre-wrap}
+
+/* ===== CREATE PLAYBOOK BUTTON (sidebar) ===== */
+.sb-create-wrap {
+ padding: 10px 12px 8px;
+ border-bottom: 1px solid var(--border);
+ flex-shrink: 0;
+ display: flex;
+ flex-direction: column;
+ gap: 6px;
+}
+.sb-create-btn {
+ display: flex;
+ align-items: center;
+ gap: 11px;
+ width: 100%;
+ padding: 10px 13px;
+ border-radius: var(--rl);
+ border: 1.5px solid var(--accent);
+ background: var(--accent);
+ color: var(--accent-fg);
+ cursor: pointer;
+ transition: opacity 0.15s, box-shadow 0.15s;
+ text-align: left;
+}
+.sb-create-btn:hover { opacity: .87; box-shadow: var(--shadow-card); }
+.sb-create-btn.active {
+ opacity: 1;
+ box-shadow: var(--shadow-panel);
+ outline: 2px solid var(--accent);
+ outline-offset: 2px;
+}
+.sb-create-icon {
+ font-size: 22px;
+ font-weight: 300;
+ line-height: 1;
+ flex-shrink: 0;
+ opacity: 0.9;
+}
+.sb-create-label { display: flex; flex-direction: column; gap: 1px; }
+.sb-create-main { font-size: 13px; font-weight: 700; letter-spacing: .01em; }
+.sb-create-sub { font-size: 10px; opacity: 0.72; letter-spacing: .01em; }
+
+/* ===== THEME TOGGLE BUTTON ===== */
+.sb-head { display: flex; justify-content: space-between; align-items: flex-start; gap: 8px; }
+.sb-head-text { flex: 1; min-width: 0; }
+.theme-toggle-btn {
+ flex-shrink: 0;
+ background: transparent;
+ border: 1px solid var(--border2);
+ color: var(--text2);
+ border-radius: 6px;
+ padding: 4px 8px;
+ font-size: 15px;
+ line-height: 1;
+ cursor: pointer;
+ transition: all 0.15s;
+ margin-top: 2px;
+}
+.theme-toggle-btn:hover { background: var(--bg2); color: var(--text); border-color: var(--text3); }
+
+/* ===== SEVERITY FILTER BAR (hidden — kept for JS compat) ===== */
+.sev-filter-bar { display: none; }
+
+/* ===== SOURCE FILTER BAR (hidden — kept for JS compat) ===== */
+.source-filter-bar { display: none; }
+
+/* ===== INLINE FILTER ROW (severity + source dropdowns) ===== */
+.inline-filter-row {
+ display: flex; align-items: center; gap: 10px;
+ padding: 5px 1.1rem 8px; flex-wrap: wrap;
+}
+.inline-filter-group {
+ display: flex; align-items: center; gap: 6px;
+}
+.inline-view-toggle {
+ margin-left: auto;
+ display: flex;
+ align-items: center;
+ gap: 6px;
+}
+.view-toggle-btn {
+ width: 34px;
+ height: 30px;
+ border-radius: 8px;
+ border: 1.5px solid var(--border2);
+ background: var(--bg);
+ color: var(--text2);
+ display: inline-flex;
+ align-items: center;
+ justify-content: center;
+ cursor: pointer;
+ transition: all .12s;
+}
+.view-toggle-btn:hover {
+ border-color: var(--blue-t);
+ background: var(--blue-bg);
+}
+.view-toggle-btn.on {
+ border-color: var(--blue-t);
+ background: var(--blue-bg);
+ box-shadow: inset 0 0 0 1px var(--blue-t-dim);
+}
+.view-icon {
+ width: 16px;
+ height: 14px;
+ display: block;
+ position: relative;
+}
+.view-icon-card {
+ border: 1.5px solid currentColor;
+ border-radius: 3px;
+}
+.view-icon-card::before {
+ content: "";
+ position: absolute;
+ left: 2px;
+ right: 2px;
+ top: 3px;
+ height: 1.5px;
+ background: currentColor;
+}
+.view-icon-grid4 {
+ background:
+ linear-gradient(currentColor, currentColor) 0 0 / 6px 6px no-repeat,
+ linear-gradient(currentColor, currentColor) 10px 0 / 6px 6px no-repeat,
+ linear-gradient(currentColor, currentColor) 0 8px / 6px 6px no-repeat,
+ linear-gradient(currentColor, currentColor) 10px 8px / 6px 6px no-repeat;
+}
+.inline-filter-label {
+ font-size: 11px; font-weight: 700; color: var(--text3);
+ text-transform: uppercase; letter-spacing: .06em; white-space: nowrap;
+}
+.inline-filter-select {
+ font-size: 12px; padding: 4px 8px; border-radius: var(--r);
+ border: 1.5px solid var(--border2); background: var(--bg2); color: var(--text);
+ cursor: pointer; outline: none; transition: border-color .15s;
+ appearance: auto;
+}
+.inline-filter-select:focus { border-color: var(--blue-t); }
+.inline-filter-select:hover { border-color: var(--text2); }
+
+/* ===== CARD COMPLETENESS PIPS ===== */
+.card-completeness {
+ display: flex;
+ gap: 3px;
+ flex-wrap: wrap;
+ margin-top: 6px;
+}
+.tool-pip {
+ width: 10px;
+ height: 10px;
+ border-radius: 50%;
+ display: inline-block;
+ background: var(--blue-t);
+}
+.tool-pip.pip-on { opacity: 1; }
+.tool-pip.pip-off { opacity: 0.2; background: var(--text3) !important; }
+.tool-pip-splunk { background: var(--amber-t); }
+.tool-pip-kql { background: var(--blue-t); }
+.tool-pip-security_onion { background: var(--amber-t); }
+.tool-pip-qradar { background: var(--teal-t); }
+.tool-pip-sigma { background: var(--purple-t); }
+.tool-pip-sysmon { background: var(--blue-t); }
+.tool-pip-velociraptor { background: var(--green-t); }
+.tool-pip-osquery { background: var(--purple-t); }
+.tool-pip-carbon_black { background: var(--red-t); }
+.tool-pip-elastic { background: var(--teal-t); }
+.tool-pip-elastic_detection_rules { background: var(--purple-t); }
+.tool-pip-chronicle { background: var(--green-t); }
+.tool-pip-crowdstrike { background: var(--red-t); }
+.tool-pip-defender { background: var(--blue-t); }
+.tool-pip-opensearch { background: var(--amber-t); }
+.tool-pip-logrhythm { background: var(--purple-t); }
+
+/* ===== CARD UPDATED DATE ===== */
+.card-updated { font-size: 0.7rem; color: var(--text3); margin-top: 4px; }
+
+/* ===== CHECKLIST MODE ===== */
+.checklist-bar {
+ display: flex;
+ align-items: center;
+ gap: 10px;
+ padding: 8px 16px;
+ background: var(--bg2);
+ border-bottom: 1px solid var(--border);
+ flex-wrap: wrap;
+}
+.checklist-toggle-btn {
+ padding: 5px 14px;
+ border-radius: 6px;
+ border: 1.5px solid var(--blue-t);
+ background: transparent;
+ color: var(--blue-t);
+ font-size: 0.82rem;
+ cursor: pointer;
+ transition: all 0.15s;
+}
+.checklist-toggle-btn:hover,
+.checklist-toggle-btn.active { background: var(--blue-t); color: #fff; }
+.checklist-progress-wrap {
+ flex: 1; min-width: 120px; max-width: 260px;
+ height: 8px; background: var(--border2); border-radius: 4px; overflow: hidden;
+}
+.checklist-progress { height: 100%; background: var(--green-t); border-radius: 4px; transition: width 0.3s ease; }
+.checklist-done { font-size: 0.78rem; color: var(--text3); }
+.checklist-reset-btn {
+ padding: 4px 10px; border-radius: 6px;
+ border: 1px solid var(--border2); background: transparent; color: var(--text3);
+ font-size: 0.78rem; cursor: pointer;
+}
+.checklist-reset-btn:hover { border-color: var(--red-t); color: var(--red-t); }
+.step-checklist { display: grid; grid-template-columns: 28px 1fr; gap: 0 8px; align-items: start; }
+.step-check { width: 18px; height: 18px; margin-top: 2px; accent-color: var(--green-t); cursor: pointer; }
+.step-checklist.step-checked > .step-body { opacity: 0.45; text-decoration: line-through; }
+
+/* ===== RELATED PLAYBOOKS ===== */
+.related-section { margin-top: 24px; padding: 12px 16px; border-top: 1px solid var(--border); }
+.related-label { font-size: 0.75rem; text-transform: uppercase; letter-spacing: 0.06em; color: var(--text3); margin-bottom: 8px; }
+.related-list { display: flex; flex-wrap: wrap; gap: 8px; }
+.related-chip {
+ padding: 4px 12px; border-radius: 14px;
+ border: 1.5px solid var(--border2); background: transparent;
+ color: var(--text2); font-size: 0.8rem; cursor: pointer; transition: all 0.15s;
+}
+.related-chip:hover { border-color: var(--blue-t); color: var(--blue-t); }
+
+/* ===== DETAIL ACTION BUTTONS ===== */
+.btn-print {
+ background: transparent; border: 1.5px solid var(--border2);
+ color: var(--text2); padding: 5px 13px; border-radius: 6px;
+ font-size: 0.8rem; cursor: pointer; transition: all 0.15s;
+}
+.btn-print:hover { border-color: var(--text); color: var(--text); }
+.btn-soar {
+ background: transparent; border: 1.5px solid var(--blue-t);
+ color: var(--blue-t); padding: 5px 13px; border-radius: 6px;
+ font-size: 0.8rem; cursor: pointer; transition: all 0.15s;
+}
+.btn-soar:hover { background: var(--blue-t); color: #fff; }
+
+/* ===== PRINT / PDF EXPORT ===== */
+@media print {
+ @page { margin: 12mm; }
+
+ html, body {
+ background: #fff !important;
+ color: #000 !important;
+ width: 100% !important;
+ }
+
+ .layout {
+ display: block !important;
+ grid-template-columns: none !important;
+ min-height: auto !important;
+ }
+
+ .sidebar,
+ .mobile-nav-toggle,
+ .mobile-nav-backdrop,
+ .cards-search-wrap,
+ .view-toggle,
+ .filter-bar,
+ .sev-filter-bar,
+ .source-filter-bar,
+ .inline-filter-row,
+ .detail-actions,
+ .tool-tabs-bar,
+ .checklist-bar,
+ #panel-home,
+ #panel-create,
+ #panel-navigator,
+ #panel-base,
+ #wizard-overlay {
+ display: none !important;
+ }
+
+ .main {
+ width: 100% !important;
+ max-width: none !important;
+ margin: 0 !important;
+ padding: 0 !important;
+ }
+
+ .panel,
+ .panel.visible,
+ #panel-detail,
+ #detail-content {
+ display: block !important;
+ width: 100% !important;
+ max-width: none !important;
+ margin: 0 !important;
+ padding: 0 !important;
+ overflow: visible !important;
+ }
+
+ .sec,
+ .step,
+ .step-q,
+ .tbl-wrap,
+ .phases,
+ .scenario-box {
+ break-inside: avoid;
+ page-break-inside: avoid;
+ box-shadow: none !important;
+ }
+
+ .step-q pre code.hljs {
+ white-space: pre-wrap !important;
+ word-break: break-word !important;
+ }
+
+ a {
+ color: inherit !important;
+ text-decoration: none !important;
+ }
+}
+
+/* ===== WIZARD BUTTON IN SIDEBAR ===== */
+.sb-wizard-btn {
+ display: flex; align-items: center; gap: 8px;
+ padding: 7px 12px; border-radius: var(--r);
+ border: 1.5px solid var(--purple-t); background: transparent;
+ color: var(--purple-t); cursor: pointer; font-size: 12px; font-weight: 600;
+ transition: all .15s; width: 100%; text-align: left;
+}
+.sb-wizard-btn:hover { background: var(--purple-bg); }
+.sb-wizard-icon { font-size: 14px; }
+.sb-wizard-label { font-size: 12px; }
+
+/* ===== WIZARD OVERLAY ===== */
+.wizard-overlay {
+ position: fixed; inset: 0; z-index: 9000;
+ display: flex; align-items: center; justify-content: center;
+ background: rgba(0,0,0,.6); backdrop-filter: blur(3px);
+ padding: 1rem;
+}
+.wizard-panel {
+ background: var(--bg); border: 1px solid var(--border); border-radius: var(--rl);
+ width: 100%; max-width: 780px; max-height: 90vh;
+ display: flex; flex-direction: column;
+ box-shadow: var(--shadow-nav); overflow: hidden;
+}
+.wizard-header {
+ display: flex; align-items: center; justify-content: space-between;
+ padding: 1rem 1.25rem; border-bottom: 1px solid var(--border); flex-shrink: 0;
+}
+.wizard-title { font-size: 16px; font-weight: 700; color: var(--text); }
+.wizard-step-label { font-size: 12px; color: var(--text2); margin-top: 2px; }
+.wizard-close {
+ background: none; border: none; font-size: 24px; cursor: pointer;
+ color: var(--text2); line-height: 1; padding: 0 4px; transition: color .15s;
+}
+.wizard-close:hover { color: var(--red-t); }
+
+/* Progress bar */
+.wizard-progress {
+ display: flex; align-items: flex-start;
+ padding: .75rem 1.25rem .65rem; gap: 0;
+ border-bottom: 1px solid var(--border); flex-shrink: 0; overflow-x: auto;
+}
+.wiz-step-dot {
+ display: flex; flex-direction: column; align-items: center;
+ flex: 1; min-width: 56px; position: relative; cursor: default;
+}
+.wiz-step-dot + .wiz-step-dot::before {
+ content: ''; position: absolute; top: 13px; right: 50%;
+ width: 100%; height: 2px; background: var(--border2); z-index: 0;
+}
+.wiz-step-dot.done + .wiz-step-dot.done::before,
+.wiz-step-dot.done + .wiz-step-dot.active::before { background: var(--accent); }
+.wiz-dot-num {
+ width: 26px; height: 26px; border-radius: 50%;
+ display: flex; align-items: center; justify-content: center;
+ font-size: 11px; font-weight: 700; position: relative; z-index: 1;
+ background: var(--bg2); border: 2px solid var(--border2);
+ color: var(--text2); transition: all .2s;
+}
+.wiz-step-dot.active .wiz-dot-num { background: var(--accent); border-color: var(--accent); color: var(--accent-fg); }
+.wiz-step-dot.done .wiz-dot-num { background: var(--green-t); border-color: var(--green-t); color: #fff; }
+.wiz-dot-label {
+ font-size: 9px; color: var(--text3); margin-top: 4px; text-align: center;
+ white-space: nowrap; overflow: hidden; text-overflow: ellipsis; max-width: 68px;
+}
+.wiz-step-dot.active .wiz-dot-label { color: var(--accent); font-weight: 600; }
+.wiz-step-dot.done .wiz-dot-label { color: var(--green-t); }
+
+/* Body & footer */
+.wizard-body { flex: 1; overflow-y: auto; padding: 1.4rem 1.25rem; }
+.wiz-step-intro {
+ font-size: 13px; color: var(--text2); margin-bottom: 1.25rem;
+ padding: .7rem 1rem; background: var(--bg2); border-radius: var(--r);
+ border-left: 3px solid var(--accent);
+}
+.wizard-footer {
+ display: flex; align-items: center; justify-content: space-between;
+ padding: .85rem 1.25rem; border-top: 1px solid var(--border);
+ flex-shrink: 0; background: var(--bg2);
+}
+.wizard-footer-right { display: flex; gap: .5rem; }
+
+/* Wizard review summary */
+.wiz-review { display: flex; flex-direction: column; border: 1px solid var(--border); border-radius: var(--r); overflow: hidden; }
+.wiz-review-row {
+ display: flex; align-items: flex-start; gap: 1rem;
+ padding: .55rem .9rem; border-bottom: 1px solid var(--border); font-size: 13px;
+}
+.wiz-review-row:last-child { border-bottom: none; }
+.wiz-review-row:nth-child(odd) { background: var(--bg2); }
+.wiz-review-label { flex-shrink: 0; width: 145px; font-weight: 600; color: var(--text2); font-size: 12px; }
+.wiz-review-save { margin-top: 1.5rem; padding-top: 1rem; border-top: 1px solid var(--border); display: flex; gap: .75rem; align-items: center; }
+
+@media (max-width: 600px) {
+ .wizard-panel { max-height: 95vh; border-radius: var(--r); }
+ .wiz-dot-label { display: none; }
+ .wiz-review-label { width: 100px; }
+}
+
+/* ── SOP Panel ─────────────────────────────────────────────────────────── */
+#panel-sops { padding: 0; display: flex; flex-direction: column; overflow: hidden; height: 100%; }
+.sop-layout { display: flex; height: 100%; overflow: hidden; }
+.sop-sidebar { width: 340px; min-width: 220px; flex-shrink: 0; border-right: 1px solid var(--border); display: flex; flex-direction: column; overflow: hidden; }
+.sop-viewer { flex: 1; overflow: hidden; display: flex; flex-direction: column; }
+.sop-upload-bar { padding: 16px; border-bottom: 1px solid var(--border); flex-shrink: 0; }
+.sop-upload-bar h3 { font-size: 13px; font-weight: 700; margin: 0 0 10px; color: var(--text1); }
+.sop-upload-form { display: flex; flex-direction: column; gap: 6px; }
+.sop-upload-form input[type="text"],
+.sop-upload-form select { padding: 6px 8px; border-radius: 4px; border: 1px solid var(--border); background: var(--bg1); color: var(--text1); font-size: 12px; }
+.sop-upload-form input[type="file"] { font-size: 11px; color: var(--text2); }
+.sop-upload-submit { padding: 7px 14px; background: var(--accent); color: #fff; border: none; border-radius: 4px; cursor: pointer; font-weight: 600; font-size: 12px; transition: opacity .15s; }
+.sop-upload-submit:hover { opacity: .85; }
+.sop-upload-submit:disabled { opacity: .5; cursor: not-allowed; }
+#sop-list-inner { flex: 1; overflow-y: auto; }
+.sop-empty { padding: 40px 16px; text-align: center; color: var(--text3); font-size: 13px; line-height: 1.6; }
+.sop-card { position: relative; padding: 12px 36px 12px 14px; border-bottom: 1px solid var(--border); cursor: pointer; transition: background .12s; }
+.sop-card:hover { background: var(--bg2); }
+.sop-card.active { background: var(--bg2); border-left: 3px solid var(--accent); padding-left: 11px; }
+.sop-card-name { font-weight: 600; font-size: 13px; margin-bottom: 4px; color: var(--text1); white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
+.sop-card-meta { font-size: 11px; color: var(--text3); display: flex; gap: 8px; flex-wrap: wrap; }
+.sop-badge { background: var(--teal-bg); color: var(--teal-t); padding: 1px 6px; border-radius: 3px; font-size: 10px; font-weight: 600; }
+.sop-delete-btn { position: absolute; top: 10px; right: 10px; background: none; border: none; color: var(--text3); cursor: pointer; font-size: 13px; padding: 2px 5px; border-radius: 3px; line-height: 1; }
+.sop-delete-btn:hover { background: var(--red-bg); color: var(--red-t); }
+.nav-item-sops::before { content: "📋 "; font-style: normal; }
+.nav-item-docs::before { content: "🔍 "; font-style: normal; }
+.doc-badge { background: var(--purple-bg); color: var(--purple-t); }
diff --git a/cgi-bin/delete_playbook.sh b/cgi-bin/delete_playbook.sh
deleted file mode 100644
index 6a0fe5f..0000000
--- a/cgi-bin/delete_playbook.sh
+++ /dev/null
@@ -1,45 +0,0 @@
-#!/bin/sh
-# CGI: delete_playbook.sh
-# Expects DELETE request with ?id= query string.
-# Removes the matching /playbooks/.json file.
-
-PLAYBOOKS_DIR="/playbooks"
-
-echo "Content-Type: application/json"
-echo "Access-Control-Allow-Origin: *"
-echo ""
-
-if [ "$REQUEST_METHOD" != "DELETE" ] && [ "$REQUEST_METHOD" != "POST" ]; then
- echo '{"error":"Method not allowed"}'
- exit 0
-fi
-
-# Parse id from query string or POST body
-if [ "$REQUEST_METHOD" = "POST" ]; then
- BODY=$(dd bs=1 count="${CONTENT_LENGTH:-0}" 2>/dev/null)
- ID=$(echo "$BODY" | grep -o '"id":"[^"]*"' | head -1 | sed 's/"id":"//;s/"//')
-else
- ID=$(echo "$QUERY_STRING" | grep -o 'id=[^&]*' | sed 's/id=//')
-fi
-
-# Sanitise - only allow safe characters (timestamp-hex pattern)
-ID=$(echo "$ID" | tr -cd '0-9a-f-')
-
-if [ -z "$ID" ]; then
- echo '{"error":"Missing id parameter"}'
- exit 0
-fi
-
-TARGET="${PLAYBOOKS_DIR}/${ID}.json"
-
-if [ ! -f "$TARGET" ]; then
- echo '{"error":"Playbook not found"}'
- exit 0
-fi
-
-rm "$TARGET"
-if [ $? -eq 0 ]; then
- echo "{\"ok\":true,\"deleted\":\"${ID}\"}"
-else
- echo '{"error":"Failed to delete playbook"}'
-fi
diff --git a/cgi-bin/tst b/cgi-bin/tst
deleted file mode 100644
index 8b13789..0000000
--- a/cgi-bin/tst
+++ /dev/null
@@ -1 +0,0 @@
-
diff --git a/docker-compose.yml b/docker-compose.yml
index e31721b..6119c8a 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -7,11 +7,19 @@ services:
- "8080:8080"
restart: unless-stopped
volumes:
- - playbook-data:/playbooks
+ # Host bind mount — contains playbooks.db (SQLite) + sops/ (PDF files)
+ - ./app-data:/data
+ environment:
+ # ── Active SIEM/tool tabs (exactly 5 shown) ───────────────────────────
+ # Available values: splunk, kql, security_onion, qradar, sigma, sysmon,
+ # velociraptor, osquery, carbon_black, elastic, elastic_detection_rules,
+ # chronicle, crowdstrike, defender, opensearch, logrhythm
+ - SIEM_TOOL_1=sysmon
+ - SIEM_TOOL_2=osquery
+ - SIEM_TOOL_3=velociraptor
+ - SIEM_TOOL_4=elastic
+ - SIEM_TOOL_5=elastic_detection_rules
labels:
- "com.soc.description=SOC IR Playbook Library"
- - "com.soc.version=3.0"
+ - "com.soc.version=4.0"
-volumes:
- playbook-data:
- driver: local
diff --git a/entrypoint.sh b/entrypoint.sh
new file mode 100644
index 0000000..c14d392
--- /dev/null
+++ b/entrypoint.sh
@@ -0,0 +1,4 @@
+#!/bin/sh
+set -e
+python3 /var/www/localhost/cgi-bin/init_db.py
+exec httpd -D FOREGROUND
diff --git a/example.png b/example.png
new file mode 100644
index 0000000..1da6eda
Binary files /dev/null and b/example.png differ
diff --git a/index.html b/index.html
deleted file mode 100644
index 42e794a..0000000
--- a/index.html
+++ /dev/null
@@ -1,649 +0,0 @@
-
-
-
-SOC IR Playbook Library
-
-
-
-
-
-
-
-
-
-
-
-
-
SOC Incident Response
-
Playbook Library
-
Splunk SIEM · Network & traffic logs · MITRE ATT&CK mapped
-
- 0 playbooks
- Splunk
- Network logs
- MITRE mapped
-
-
-
- Filter:
- All
- Malware
- Cloud
- Identity
- Insider
- Application
- Supply Chain
- Data
- Network
- Custom
-
-
-
-
-
-
-
Base procedure — all alerts
-
Alert intake, triage & documentation
-
Universal Splunk
-
-
1 Intake
-
2 Triage
-
3 Decision
-
4 Document
-
-
Phase 1 — Alert intake
-
1
Open and read the alert in full
Record: alert name, rule/correlation ID, time fired, severity, triggering src/dest IP, port, protocol, and user context. Do not dismiss before triage is complete.
-
2
Pull underlying raw events in Splunk
Navigate to the notable event. Always read raw log lines — never rely on the summary field alone.index=network earliest=-30m | search [correlation_filter] | table _time, src_ip, dest_ip, dest_port, action, bytes, protocol
-
3
Classify the asset and traffic direction
Internal / external / known-bad. Asset role: user device, server, gateway, network device. Direction: inbound / outbound / lateral.
-
-
Phase 2 — Triage checklist
-
Check Action Source
- False positive? Compare against baselines; check tuning notes on this rule Splunk Threat intel Look up all IPs, domains, hashes against IOC feeds TI / OSINT Scope Single host or multiple? Search the indicator across all sources Splunk Volume / frequency One-off event or sustained pattern? Pull counts over 24h and 7d Splunk Historical context Has this src/dest been seen before? Were prior alerts actioned? Splunk Business context Expected given time of day, user role, or system function? CMDB / comms
-
Phase 3 — Decision & escalation
-
Verdict Action Priority
- False positive Close with notes; flag rule for tuning Informational Benign positive Close with justification; consider suppression Low Suspicious Escalate to T2 with findings summary; open ticket; continue monitoring Medium Confirmed true positive Immediate escalation; consider containment; notify TL; preserve evidence High / P1
-
Phase 4 — Documentation
-
A
Log all investigative actions with timestamps
Every Splunk query, every source consulted, every person contacted, every decision made. The ticket must stand alone as the complete record.
-
B
Capture and attach evidence
Export relevant Splunk log snippets. Record all IPs, domains, accounts, ports, timestamps, and data volumes involved.
-
C
Record verdict and close formally
Mark verdict type. If escalating, include a concise findings summary for the next tier. Tag the rule for FP/TP tracking.
-
-
-
-
-
-
-
-
-
Analyst tool
-
Create a playbook
-
Custom
-
Playbook saved successfully and added to the library.
-
-
-
-
-
Investigation steps
-
-
Detection & analysis + Step
-
-
+ Add detection step
-
-
-
Containment + Step
-
-
+ Add containment step
-
-
-
Eradication + Step
-
-
+ Add eradication step
-
-
-
Recovery & lessons learned + Step
-
-
+ Add recovery step
-
-
-
- Save playbook
- Clear form
-
-
-
-
-
+
+
+
+ -enc;-encodedcommand;IEX;FromBase64String;DownloadString;regsvr32;mshta;wmic;winrs;rundll32
+ \\powershell.exe;\\cmd.exe;\\wscript.exe;\\cscript.exe;\\mshta.exe;\\regsvr32.exe;\\rundll32.exe;\\wmic.exe;\\winrs.exe
+
+
+
+
+ C:\\Windows\\System32\\lsass.exe
+ \\procdump.exe;\\rundll32.exe;\\powershell.exe;\\mimikatz.exe
+
+
+
+
+ 53;80;443;445;3389;5985;5986;8080;8443
+
+
+
+
+ \\Run;\\RunOnce;\\Services\\;\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication;\\Lsa\\Security Packages
+
+
+
+ .top;.xyz;.club;.online;.site;.cc
+
+
+ """
+
+
+def build_detection_steps(group: dict, techniques: list[dict]) -> list[dict]:
+ group_name = group["name"]
+ group_id = group["mitre_id"]
+ top_techniques = technique_summary(techniques)
+ query_ids = technique_ids_for_query(techniques)
+ aliases = ", ".join(group.get("aliases", [])[:12]) or "No public aliases listed"
+ tactics = tactic_summary(techniques)
+ mitre_url = group.get("url") or f"https://attack.mitre.org/groups/{group_id}/"
+
+ security_onion_base = (
+ f"# Security Onion KQL - {group_name} ({group_id}) ATT&CK technique pivots\n"
+ f"(rule.threat.technique.id:({query_ids}) OR threat.technique.id:({query_ids}) "
+ f"OR event.module:sysmon OR event.dataset:suricata.eve OR event.dataset:zeek.*)"
+ )
+ osquery_process = """SELECT pid, name, path, cmdline, parent, start_time
+FROM processes
+WHERE cmdline LIKE '%-enc%'
+ OR cmdline LIKE '%FromBase64String%'
+ OR cmdline LIKE '%DownloadString%'
+ OR name IN ('powershell.exe','cmd.exe','rundll32.exe','regsvr32.exe','mshta.exe','wmic.exe','winrs.exe');"""
+ velociraptor_process = """LET procs = SELECT Name, Exe, CommandLine, Pid,
+ authenticode(filename=Exe).Trusted AS Trusted
+FROM pslist() WHERE Exe
+SELECT Name, Exe, CommandLine, Pid, Trusted
+FROM procs
+WHERE NOT Trusted OR CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|regsvr32|mshta|wmic|winrs)'"""
+
+ return [
+ {
+ "n": 1,
+ "title": f"Profile {group_name} with MITRE ATT&CK context",
+ "detail": (
+ f"MITRE Group ID: {group_id}. Aliases: {aliases}. Primary mapped tactics: {tactics}. "
+ f"Mapped techniques: {top_techniques}. Source: {mitre_url}. Use this step to scope the hunt, "
+ "select relevant telemetry, and prioritize techniques that overlap the current alert or campaign."
+ ),
+ "queries": {
+ "security_onion": security_onion_base,
+ "sysmon": common_sysmon_xml(group_name, techniques),
+ "osquery": osquery_process,
+ "velociraptor": velociraptor_process,
+ "elastic": security_onion_base.replace("Security Onion KQL", "Elastic KQL"),
+ "carbon_black": "process_name:(powershell.exe OR cmd.exe OR rundll32.exe OR regsvr32.exe OR mshta.exe OR wmic.exe OR winrs.exe) OR netconn_count:[1 TO *]",
+ },
+ },
+ {
+ "n": 2,
+ "title": "Hunt initial access, execution, and persistence behaviors",
+ "detail": (
+ "Search for public-facing exploitation, suspicious script execution, LOLBins, web shells, scheduled tasks, "
+ "service creation, and autorun registry changes. Tune by asset role: web servers, domain controllers, and "
+ "admin jump boxes should have separate baselines."
+ ),
+ "queries": {
+ "security_onion": """# Initial access/execution/persistence hunt
+(event.category:process AND process.name:(powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe OR rundll32.exe))
+OR (event.category:file AND file.extension:(aspx OR jsp OR php OR ps1 OR vbs OR js))
+OR (event.code:(4698 OR 4702 OR 7045))
+OR (registry.path:*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run* OR registry.path:*\\SYSTEM\\CurrentControlSet\\Services\\*)""",
+ "sysmon": common_sysmon_xml(group_name, techniques),
+ "osquery": """SELECT name, action, path FROM scheduled_tasks
+UNION
+SELECT name, path, status FROM services
+WHERE path LIKE '%AppData%' OR path LIKE '%Temp%' OR path LIKE '%ProgramData%';""",
+ "velociraptor": """SELECT FullPath, Mtime, Size
+FROM glob(globs=['C:/inetpub/wwwroot/**/*.aspx','C:/ProgramData/**/*.ps1','C:/Users/*/AppData/**/*.exe'])
+WHERE Mtime > timestamp(epoch=now().Unix - 7*24*60*60)""",
+ "elastic": """event.category:"process" and process.name:("powershell.exe" or "cmd.exe" or "mshta.exe" or "regsvr32.exe" or "rundll32.exe")""",
+ "carbon_black": "(process_name:powershell.exe OR process_name:cmd.exe OR process_name:mshta.exe OR process_name:regsvr32.exe OR process_name:rundll32.exe) AND (cmdline:-enc OR cmdline:DownloadString OR cmdline:FromBase64String OR cmdline:http)",
+ },
+ },
+ {
+ "n": 3,
+ "title": "Hunt credential access, discovery, and lateral movement",
+ "detail": (
+ "Prioritize LSASS access, SAM/SECURITY hive reads, domain and network discovery, RDP/SMB/WinRM movement, "
+ "and authentication anomalies. Correlate endpoint process telemetry with Zeek conn/smb/kerberos logs."
+ ),
+ "queries": {
+ "security_onion": """# Credential access + discovery + lateral movement
+(event.module:sysmon AND event.code:10 AND process.Ext.api.target_process.executable:*\\lsass.exe)
+OR (event.category:process AND process.command_line:(*nltest* OR *net group* OR *net view* OR *whoami /all* OR *ipconfig /all*))
+OR (event.category:network AND destination.port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986))""",
+ "sysmon": common_sysmon_xml(group_name, techniques),
+ "osquery": """SELECT * FROM process_open_sockets
+WHERE remote_port IN (88,135,139,389,445,3389,5985,5986);
+
+SELECT pid, name, cmdline FROM processes
+WHERE cmdline LIKE '%nltest%' OR cmdline LIKE '%net group%' OR cmdline LIKE '%whoami /all%' OR cmdline LIKE '%ipconfig /all%';""",
+ "velociraptor": """SELECT Pid, Process, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status
+FROM netstat()
+WHERE RemotePort IN (88,135,139,389,445,3389,5985,5986)""",
+ "elastic": """event.category:"network" and destination.port:(88 or 135 or 139 or 389 or 445 or 3389 or 5985 or 5986)""",
+ "carbon_black": "netconn_port:(88 OR 135 OR 139 OR 389 OR 445 OR 3389 OR 5985 OR 5986) OR cmdline:(nltest OR \"net group\" OR \"whoami /all\")",
+ },
+ },
+ {
+ "n": 4,
+ "title": "Hunt command-and-control, ingress transfer, and exfiltration",
+ "detail": (
+ "Look for rare outbound destinations, DNS TXT/NULL or high-entropy queries, suspicious HTTP POST activity, "
+ "proxy-like behavior, and large outbound transfers. Baseline by subnet and server role before suppressing."
+ ),
+ "queries": {
+ "security_onion": """# C2 and exfiltration hunt
+(event.category:network AND destination.port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888))
+OR (event.dataset:zeek.dns AND (dns.question.type:(TXT OR NULL) OR dns.question.name:*[A-Za-z0-9]{20,}*))
+OR (event.dataset:zeek.http AND http.request.method:POST AND (network.bytes:>1000000 OR bytes:>1000000))
+OR (event.dataset:suricata.eve AND event.kind:alert)""",
+ "sysmon": common_sysmon_xml(group_name, techniques),
+ "osquery": """SELECT p.pid, p.name, p.path, s.remote_address, s.remote_port
+FROM processes p
+JOIN process_open_sockets s ON p.pid = s.pid
+WHERE s.remote_port IN (53,80,443,8080,8443,1080,8888);""",
+ "velociraptor": """SELECT Pid, Process, RemoteAddress, RemotePort, Status
+FROM netstat()
+WHERE RemotePort IN (53,80,443,8080,8443,1080,8888)""",
+ "elastic": """event.category:"network" and destination.port:(53 or 80 or 443 or 8080 or 8443 or 1080 or 8888)""",
+ "carbon_black": "netconn_port:(53 OR 80 OR 443 OR 8080 OR 8443 OR 1080 OR 8888) AND NOT process_name:(chrome.exe OR msedge.exe OR firefox.exe OR outlook.exe OR teams.exe)",
+ },
+ },
+ ]
+
+
+def build_playbook(group: dict, techniques: list[dict], num: int) -> dict:
+ group_id = group["mitre_id"]
+ group_name = group.get("name") or group_id
+ aliases = group.get("aliases", [])
+ mitre_ids = [tech["id"] for tech in techniques[:24]]
+ description = clean_text(group.get("description"))
+ if not description:
+ description = f"{group_name} is a MITRE ATT&CK Enterprise intrusion-set/group ({group_id})."
+
+ return {
+ "id": f"apt-{group_id.lower()}",
+ "num": num,
+ "name": f"MITRE ATT&CK Group — {group_name}",
+ "fullName": f"{group_name} ({group_id}) Threat Group Hunt",
+ "type": "Threat Group / APT Hunt",
+ "severity": "Critical",
+ "priority": "High",
+ "detection": "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, Carbon Black",
+ "scenario": (
+ f"{description} This default playbook uses MITRE ATT&CK mapped techniques and practical "
+ "Security Onion, Sysmon, OSQuery, Velociraptor, Elastic, and Carbon Black hunts to investigate "
+ f"activity consistent with {group_name}."
+ ),
+ "mitre": ", ".join(mitre_ids),
+ "aliases": aliases,
+ "mitreGroupId": group_id,
+ "mitreUrl": group.get("url") or f"https://attack.mitre.org/groups/{group_id}/",
+ "tools": "Security Onion; Sysmon; OSQuery; Velociraptor; Elastic; Carbon Black",
+ "sev": "critical",
+ "cat": "Threat Groups",
+ "source": "library",
+ "updated": date.today().isoformat(),
+ "detSteps": build_detection_steps(group, techniques),
+ "contSteps": [
+ {
+ "title": "Contain affected hosts and identities",
+ "detail": "Isolate confirmed compromised endpoints, disable impacted accounts, revoke active sessions/tokens, and block observed C2 destinations while preserving evidence.",
+ "queries": {},
+ },
+ {
+ "title": "Apply tactical network controls",
+ "detail": "Block confirmed malicious infrastructure, restrict administrative protocols to jump boxes, and increase Security Onion alert visibility for the relevant MITRE techniques.",
+ "queries": {},
+ },
+ ],
+ "eradSteps": [
+ {
+ "title": "Remove persistence and actor tooling",
+ "detail": "Remove malicious services, scheduled tasks, startup items, web shells, unauthorized accounts, and binaries identified during the hunt. Validate with Sysmon/OSQuery/Velociraptor before reconnecting hosts.",
+ "queries": {},
+ },
+ {
+ "title": "Patch exploited weaknesses",
+ "detail": "Patch exploited public-facing applications, harden identity controls, rotate exposed credentials, and remediate vulnerable software or appliance firmware relevant to the observed technique set.",
+ "queries": {},
+ },
+ ],
+ "recSteps": [
+ {
+ "title": "Restore and monitor",
+ "detail": "Restore systems from trusted backups where needed, re-enable network access in stages, and monitor Security Onion dashboards for recurrence of mapped techniques for at least two business cycles.",
+ "queries": {},
+ },
+ {
+ "title": "Improve ATT&CK coverage",
+ "detail": "Update detection engineering backlog with uncovered ATT&CK techniques, tune noisy queries with environment-specific allowlists, and document lessons learned in the incident record.",
+ "queries": {},
+ },
+ ],
+ }
+
+
+def main() -> int:
+ manifest = json.loads(MANIFEST_PATH.read_text(encoding="utf-8"))
+ existing_ids = {item["id"] for item in manifest.get("playbooks", [])}
+ existing_files = {item["file"] for item in manifest.get("playbooks", [])}
+ max_num = max((int(item.get("num", 0)) for item in manifest.get("playbooks", [])), default=0)
+
+ bundle = fetch_enterprise_attack()
+ groups, _techniques_by_stix, uses_by_group = build_indexes(bundle)
+ GROUP_DIR.mkdir(parents=True, exist_ok=True)
+
+ added = 0
+ for group in groups:
+ group_id = group["mitre_id"]
+ playbook_id = f"apt-{group_id.lower()}"
+ rel_file = f"threat-groups/{playbook_id}-{slugify(group.get('name', group_id))}.json"
+ if playbook_id in existing_ids or rel_file in existing_files:
+ continue
+
+ techniques = sorted(
+ uses_by_group.get(group["id"], []),
+ key=lambda tech: (
+ min((tactic_sort_key(t) for t in tech.get("tactics", [])), default=(99, "")),
+ tech["id"],
+ ),
+ )
+ max_num += 1
+ playbook = build_playbook(group, techniques, max_num)
+ (PLAYBOOK_ROOT / rel_file).write_text(
+ json.dumps(playbook, ensure_ascii=False, indent=2) + "\n",
+ encoding="utf-8",
+ )
+ manifest["playbooks"].append(
+ {
+ "id": playbook_id,
+ "num": max_num,
+ "name": playbook["name"],
+ "cat": "Threat Groups",
+ "sev": "critical",
+ "type": "Threat Group / APT Hunt",
+ "mitre": playbook["mitre"],
+ "source": "library",
+ "file": rel_file,
+ "related": [],
+ }
+ )
+ added += 1
+
+ manifest["generated"] = date.today().isoformat()
+ MANIFEST_PATH.write_text(json.dumps(manifest, ensure_ascii=False, indent=2) + "\n", encoding="utf-8")
+
+ print(
+ textwrap.dedent(
+ f"""\
+ MITRE Enterprise groups processed: {len(groups)}
+ New default group playbooks added: {added}
+ Manifest total playbooks: {len(manifest['playbooks'])}
+ """
+ ).strip()
+ )
+ return 0
+
+
+if __name__ == "__main__":
+ raise SystemExit(main())