Managed Sentinel – Alert 501
| Alert ID | MS-A501 |
| Alert Name | APT 29 Thinktanks Lookup |
| Description | This alert triggers when an indicator of compromise related to APT 29 Thinktanks Advanced Persistence Threat is identified in the SecurityEvents log. https://www.fireeye.com/blog/threat-research/2018/11/not-so-cozy-an-uncomfortable-examination-of-a-suspected-apt29-phishing-campaign.html |
| Severity Level | High |
| Threat Indicator | Compromised Host |
| MITRE ATT&CK Tactics | Execution Priviledge Escalation Command and Control |
| Log sources | Windows |
| False Positive | Unknown |
| Recommendations | 1. Initiate Security Incident Response Plan process 2. Isolate affected internal machine from corporate network 3. Perform a full scan of the infected host using endpoint security tool. 4. Investigate in Sentinel if any lateral movements were done from the infected machine. 5. Exercise caution and educate users on the safe handling of emails. 6. Install latest updates for your antimalware software and ensure it runs properly. 7. Install latest updates to the Windows OS software on the infected machine 8. Ensure that your organization has the proper settings configured on the Email filtering tool |