Investigation of Advanced Persistent Threats Network-based Tactics, Techniques and Procedures

TL;DR

This paper analyzes the evolution, tactics, and evasion techniques of Advanced Persistent Threats over 22 years, focusing on their use of DNS and HTTP(S) protocols for undetected communication and persistence.

Contribution

It provides a comprehensive analysis of APT TTPs, especially their evasion strategies involving DNS and HTTP(S), based on 33 campaigns over two decades.

Findings

APT campaigns predominantly use HTTP(S) for evasion.

DNS is widely exploited for C&C and tunneling.

APT tactics evolve over time to bypass detection.

Abstract

The scarcity of data and the high complexity of Advanced Persistent Threats (APTs) attacks have created challenges in comprehending their behavior and hindered the exploration of effective detection techniques. To create an effective APT detection strategy, it is important to examine the Tactics, Techniques, and Procedures (TTPs) that have been reported by the industry. These TTPs can be difficult to classify as either malicious or legitimate. When developing an approach for the next generation of network intrusion detection systems (NIDS), it is necessary to take into account the specific context of the attack explained in this paper. In this study, we select 33 APT campaigns based on the fair distribution over the past 22 years to observe the evolution of APTs over time. We focus on their evasion techniques and how they stay undetected for months or years. We found that APTs cannot continue their operations without C&C servers, which are mostly addressed by Domain Name System (DNS). We identify several TTPs used for DNS, such as Dynamic DNS, typosquatting, and TLD squatting. The next step for APT operators is to start communicating with a victim. We found that the most popular protocol to deploy evasion techniques is using HTTP(S) with 81% of APT campaigns. HTTP(S) can evade firewall filtering and pose as legitimate web-based traffic. DNS protocol is also widely used by 45% of APTs for DNS resolution and tunneling. We identify and analyze the TTPs associated with using HTTP(S) based on real artifacts.