APT多阶段攻击样本分析

---
name: apt-analysis
description: >
  Investigate advanced persistent threat (APT) campaigns by mapping multi-stage
  infection chains, analyzing dropper/loader/payload relationships, investigating
  C2 infrastructure, and correlating with known threat groups. Use when dealing
  with sophisticated, targeted attacks that involve multiple stages, custom tooling,
  lateral movement, and long-term persistence. Supports both offline artifact
  analysis and online threat intelligence enrichment via APIs.
---

# APT Analysis

Investigate advanced persistent threat campaigns by systematically mapping
the complete attack chain from initial access through data exfiltration,
correlating with known APT groups and their TTPs.

## Prerequisites

- **Linux**: `whois`, `dig`, `nslookup`, `curl`, `jq`, `python3`
- **Windows**: PowerShell 5.1+, `nslookup`, `curl`
- **Python packages**: `requests`, `json`, `csv`, `datetime` (standard library); `dnspython` (optional)
- **Tools (recommended)**: Volatility 3, Wireshark, YARA, IDA Pro/Ghidra, Timeline Explorer
- **Online APIs (optional)**: PassiveTotal/RiskIQ, SecurityTrails, VirusTotal, Shodan, Censys
- **API keys**: Set `VT_API_KEY`, `PT_API_KEY`, `ST_API_KEY`, `SHODAN_API_KEY` env vars as available

## Step-by-Step Instructions

### Step 1: Identify Initial Access Vector

Determine how the adversary gained initial access to the target environment.

**Common APT initial access methods:**
- Spearphishing with malicious attachments (T1566.001)
- Spearphishing with links to exploit kits (T1566.002)
- Exploitation of public-facing applications (T1190)
- Supply chain compromise (T1195)
- Valid accounts from credential theft (T1078)
- Trusted relationship abuse (T1199)

**Analyze email artifacts:**
```bash
# Extract URLs from email headers and body
strings phishing_email.eml | grep -iE "https?://" | sort -u
# Extract sender information
grep -i "^From:\|^Reply-To:\|^Return-Path:\|^X-Originating-IP:" phishing_email.eml
# Check for embedded objects
munpack phishing_email.eml
```

**Check web server logs for exploitation:**
```bash
# Look for common exploitation patterns
grep -iE "(\.\.\/|%2e%2e|union\s+select|<script|eval\(|exec\()" access.log
# Check for known CVE exploit paths
grep -iE "(CVE-|log4j|ProxyShell|ProxyLogon|Exchange)" access.log
```

**Review authentication logs:**
```bash
# Failed/successful logins from unusual sources
grep -i "failed\|success" auth.log | sort | uniq -c | sort -rn | head -20
```

### Step 2: Map the Multi-Stage Infection Chain

Trace the complete sequence from initial access to final payload execution.

**Identify stages:**
```
Stage 0: Delivery (email, exploit, watering hole)
Stage 1: Dropper (document macro, exploit shellcode, script)
Stage 2: Loader (downloads or unpacks next stage)
Stage 3: Payload (RAT, backdoor, implant)
Stage 4: Post-exploitation (lateral movement tools)
Stage 5: Persistence (multiple mechanisms)
```

**For each stage, extract and document:**
- File hash (MD5, SHA1, SHA256)
- File type and format
- Compilation/creation timestamp
- Embedded configuration data
- Network indicators (URLs, domains, IPs)
- Relationship to other stages (how it loads the next)

**Use the timeline script to map stages:**
```bash
python3 scripts/attack_timeline.py \
  --sources file_artifacts.csv sysmon_events.json pcap_timestamps.csv \
  --output timeline.json \
  --format markdown
```

### Step 3: Analyze Dropper/Loader/Payload Relationships

Examine how each component relates to and loads the next.

**Dropper analysis:**
```bash
# Extract embedded payloads from dropper
binwalk -e dropper.exe
foremost -i dropper.exe -o carved/
# Check for resource section payloads (PE files)
python3 -c "
import pefile
pe = pefile.PE('dropper.exe')
for entry in pe.DIRECTORY_ENTRY_RESOURCE.entries:
    for subentry in entry.directory.entries:
        data = pe.get_data(subentry.directory.entries[0].data.struct.OffsetToData,
                           subentry.directory.entries[0].data.struct.Size)
        print(f'Resource: offset={hex(subentry.directory.entries[0].data.struct.OffsetToData)}, size={len(data)}')
"
```

**Loader analysis:**
- Identify decryption/decompression routines
- Extract encryption keys from the binary
- Determine how the next stage is fetched (embedded, downloaded, registry)
- Check for anti-analysis checks before proceeding

**Payload analysis:**
- Identify the RAT/backdoor family
- Extract C2 configuration (addresses, ports, encryption keys)
- Map supported commands
- Check for plugin/module loading capability

See `references/multi-stage-analysis.md` for detailed extraction techniques.

### Step 4: Investigate C2 Infrastructure

Map the adversary's command and control infrastructure.

**Use the infrastructure mapper:**
```bash
python3 scripts/infrastructure_mapper.py \
  --domains c2-domain1.com c2-domain2.net \
  --ips 1.2.3.4 5.6.7.8 \
  --output infrastructure_map.json \
  --format markdown
```

**Passive DNS analysis:**
```bash
# Query passive DNS (if API available)
curl -s -H "Authorization: Bearer $PT_API_KEY" \
  "https://api.passivetotal.org/v2/dns/passive?query=suspicious-domain.com" | jq .

# Local DNS resolution
dig suspicious-domain.com A AAAA MX NS TXT
dig +short -x 1.2.3.4  # Reverse DNS
```

**Certificate transparency lookup:**
```bash
# Search CT logs for related certificates
curl -s "https://crt.sh/?q=%25.suspicious-domain.com&output=json" | jq '.[] | {name_value, issuer_name, not_before}'
```

**WHOIS analysis:**
```bash
whois suspicious-domain.com
whois 1.2.3.4
# Look for: registrant info, creation dates, name servers, registrar patterns
```

**Infrastructure correlation patterns:**
- Shared WHOIS registrant details
- Common name servers
- Co-hosted domains on the same IP
- SSL certificate reuse (serial numbers, subjects)
- Similar domain registration patterns (DGA-like, typosquatting)
- Hosting provider patterns (bulletproof hosting)

See `references/infrastructure-analysis.md` for detailed methodology.

### Step 5: Identify Lateral Movement Tools

Document tools and techniques used for lateral movement within the network.

**Common APT lateral movement tools:**
| Tool | Description | Detection |
|---|---|---|
| PsExec | Remote command execution | Named pipes, Event ID 7045 |
| WMI | Remote WMI execution | Event ID 4648, WMI logs |
| WinRM | PowerShell remoting | Event ID 4648, port 5985/5986 |
| RDP | Remote Desktop Protocol | Event ID 4624 type 10 |
| SMB | File shares for staging | Event ID 5140, 5145 |
| Mimikatz | Credential harvesting | Event ID 4688, LSASS access |
| Cobalt Strike | Commercial pentest/attack tool | Named pipes, malleable C2 |
| Impacket | Python tools for SMB/DCOM/WMI | Unusual service creation |

**Check for lateral movement evidence:**
```bash
# Windows Event Logs - remote logon events
# Event ID 4624 Type 3 (network logon)
# Event ID 4648 (explicit credential logon)
# Event ID 5140 (network share access)

# Sysmon - network connections to internal hosts on management ports
# Port 135 (RPC), 445 (SMB), 5985/5986 (WinRM), 3389 (RDP)
```

### Step 6: Analyze Data Staging and Exfiltration

Identify data collection, staging, and exfiltration activities.

**Data staging indicators:**
- Large archives (RAR, 7z, ZIP) in unusual directories
- Files with timestamps clustered in short periods
- Data collected in temp or recycler directories
- Compressed files named with date patterns

**Exfiltration channels:**
| Channel | Indicators |
|---|---|
| HTTPS | Large outbound transfers to C2 domains |
| DNS | DNS TXT queries with encoded data |
| Cloud storage | Connections to mega.nz, dropbox, Google Drive |
| Email | SMTP connections from non-mail servers |
| FTP | Outbound FTP to external servers |
| Custom protocol | Unusual outbound connections on non-standard ports |

**Analyze PCAP for exfiltration:**
```bash
# Large outbound transfers
tshark -r capture.pcap -T fields -e ip.src -e ip.dst -e frame.len \
  -Y "ip.dst != 10.0.0.0/8 && frame.len > 1000" | sort -t$'\t' -k3 -rn | head -20

# DNS exfiltration (long subdomain queries)
tshark -r capture.pcap -T fields -e dns.qry.name -Y "dns.qry.name" |
  awk '{ if (length($0) > 50) print $0 }' | sort -u
```

### Step 7: Correlate with Known APT Groups

Match observed TTPs and tooling against known threat actor profiles.

**Key correlation points:**
- Tooling and malware families used
- Infrastructure patterns (hosting, registrars, TLDs)
- Target sector and geography
- Observed TTPs mapped to MITRE ATT&CK
- Code similarities and shared libraries
- Operational hours and timezone indicators
- Language artifacts in malware (PDB paths, strings, resources)

**Check compilation timestamps for timezone:**
```bash
python3 -c "
import pefile, datetime
pe = pefile.PE('malware.exe')
ts = pe.FILE_HEADER.TimeDateStamp
print(f'Compile time (UTC): {datetime.datetime.utcfromtimestamp(ts)}')
print(f'Timestamps suggest working hours in: check if 09:00-18:00 in target TZ')
"
```

**Check for language artifacts:**
```bash
strings -el malware.exe | head -50  # Unicode strings
strings malware.exe | grep -iE "(pdb|debug|build|user|desktop)" | head -20
```

See `references/apt-groups.md` for profiles of major APT groups.

### Step 8: Map Full Attack Timeline

Construct a comprehensive chronological timeline of the attack.

**Use the timeline construction script:**
```bash
python3 scripts/attack_timeline.py \
  --sources \
    sysmon_events.csv \
    firewall_logs.csv \
    file_timestamps.csv \
    email_artifacts.csv \
  --output full_timeline.json \
  --format all \
  --tz UTC
```

**Timeline should include:**
- Initial compromise date and method
- Each stage of malware deployment
- Lateral movement events
- Persistence mechanism installation
- Data collection and staging
- Exfiltration events
- Any cleanup or anti-forensics activity

**Map to MITRE ATT&CK phases:**
```
Reconnaissance -> Resource Development -> Initial Access ->
Execution -> Persistence -> Privilege Escalation ->
Defense Evasion -> Credential Access -> Discovery ->
Lateral Movement -> Collection -> C2 -> Exfiltration -> Impact
```

### Step 9: Assess Strategic Objectives

Determine the adversary's goals based on collected evidence.

**Common APT objectives:**
| Objective | Indicators |
|---|---|
| Espionage | Targeted document theft, email collection |
| IP theft | Access to R&D systems, source code repos |
| Financial gain | Banking system access, cryptocurrency wallets |
| Disruption | Wiper deployment, ransomware |
| Prepositioning | Infrastructure mapping, persistent access without data theft |
| Influence | Access to communications, social media accounts |

**Document findings:**
- What data was accessed or exfiltrated
- Which systems were compromised
- Duration of the intrusion (dwell time)
- Estimated impact and scope
- Attribution confidence level (low/medium/high)

## Output Format

```json
{
  "campaign_name": "Operation Example",
  "attribution": {
    "group": "APT29",
    "confidence": "medium",
    "basis": ["tooling overlap", "infrastructure patterns", "target profile"]
  },
  "timeline": {
    "first_compromise": "2025-01-15T08:30:00Z",
    "last_activity": "2025-03-20T14:00:00Z",
    "dwell_time_days": 64
  },
  "initial_access": "Spearphishing attachment (CVE-2024-XXXX)",
  "infection_chain": [
    {"stage": 0, "type": "delivery", "method": "Email with DOCX attachment"},
    {"stage": 1, "type": "dropper", "hash": "sha256:...", "method": "VBA macro"},
    {"stage": 2, "type": "loader", "hash": "sha256:...", "method": "DLL sideloading"},
    {"stage": 3, "type": "payload", "hash": "sha256:...", "family": "CustomRAT"}
  ],
  "c2_infrastructure": {
    "domains": [],
    "ips": [],
    "protocols": ["HTTPS", "DNS"]
  },
  "lateral_movement": ["WMI", "PsExec", "RDP"],
  "data_exfiltrated": "Internal documents, email archives",
  "mitre_attack_ttps": ["T1566.001", "T1059.001", "T1078", "T1021.001"],
  "iocs": {}
}
```

## Tips

- Attribution is difficult; focus on TTPs rather than jumping to conclusions
- APT actors frequently retool; don't rely solely on known malware signatures
- Check for shared code between stages (crypto routines, string handling)
- Compile timestamps can be faked; use as one data point among many
- Map dwell time accurately - it affects incident response priorities
- Consider false flag operations designed to mislead attribution
- Preserve chain of custody for all evidence in case of legal proceedings
- Coordinate with threat intelligence teams for broader campaign context