> For the complete documentation index, see [llms.txt](https://0xmedhat.gitbook.io/whoami/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xmedhat.gitbook.io/whoami/cthpv2-prep/threat-hunting-terminology.md).

# Threat Hunting Terminology

#### Threat Hunting Terms

**Advanced Persistent Threat (APT)**

An **Advanced Persistent Threat (APT)** refers to a stealthy, sophisticated, and prolonged cyberattack conducted by a skilled adversary. APTs are often state-sponsored or highly organized cybercriminal groups targeting high-value entities such as governments, corporations, or critical infrastructure.

**Key Characteristics of APTs:**

1. **Targeted Attacks:**
   * APTs are highly targeted, focusing on specific organizations or industries, such as government agencies, financial institutions, or critical infrastructure.
2. **Persistence:**
   * The attackers aim to maintain long-term access to the compromised systems, often using sophisticated backdoors and stealth techniques.
3. **Sophistication:**
   * APTs use advanced tools and techniques, including zero-day exploits, custom malware, and social engineering tactics.
4. **Multi-Stage Approach:**
   * APTs often involve several stages: reconnaissance, initial compromise, establishment of foothold, escalation of privileges, lateral movement, and exfiltration.
5. **Stealth:**
   * These attackers focus on avoiding detection by using encrypted communication, legitimate software for malicious purposes, and other obfuscation methods.

***

**Common Techniques Used in APTs:**

1. **Social Engineering:**
   * Phishing emails or spear-phishing campaigns targeting specific employees.
2. **Exploitation of Vulnerabilities:**
   * Leveraging zero-day exploits or unpatched software.
3. **Credential Theft:**
   * Using techniques like **Kerberoasting**, **Pass-the-Hash**, or keylogging.
4. **Lateral Movement:**
   * Using compromised credentials to move within the network to access valuable assets.
5. **Data Exfiltration:**
   * Sending stolen data out of the network without detection, often using encrypted channels.

**Examples of APT Groups**

1. **APT28 (Fancy Bear)**:
   * Believed to be Russian state-sponsored.
   * Known for targeting government and military organizations.
2. **APT29 (Cozy Bear)**:
   * Associated with Russian intelligence.
   * Infamous for the SolarWinds supply chain attack.
3. **APT41**:
   * A Chinese-based group blending cyber-espionage with financial crime.
   * Targets include healthcare, telecommunications, and gaming industries.
4. **Lazarus Group**:
   * Linked to North Korea.
   * Known for attacks on financial institutions, including the Bangladesh Bank heist.
5. **Equation Group**:
   * Tied to the NSA.
   * Pioneered advanced techniques and malware like Stuxnet.

**MITRE ATT\&CK Framework**

* APTs heavily rely on techniques cataloged in the **MITRE ATT\&CK Framework**.
* Examples:
  * **Persistence**: T1547 (Boot or Logon Autostart Execution).
  * **Privilege Escalation**: T1068 (Exploitation for Privilege Escalation).
  * **Defense Evasion**: T1218 (Signed Binary Proxy Execution).

***

**Tools Commonly Used by APTs**

1. **Cobalt Strike**: A penetration testing tool often repurposed by attackers.
2. **Mimikatz**: For credential harvesting.
3. **BloodHound**: For mapping Active Directory environments.
4. **Metasploit**: Exploitation framework.
5. **Custom Malware**: Tailored for specific attacks.

***