Advanced Persistent Threats (APTs): What They Are and How SIEM Detects Them

Introduction

We live in an era of rapid advances in information and communication technology (ICT), and our dependence on it continues to grow in almost every aspect of life. Unfortunately, technological progress also creates new opportunities for cyberattacks. ICT systems process vast amounts of data, and data has become a valuable resource that can be monetized relatively easily. In addition, the development of large language models (LLMs) has made it easier for threat actors to operate at scale. Preparing automated scripts, exploits, or phishing campaigns no longer requires the same level of skill or effort as it once did. For cybersecurity teams responsible for protecting ICT systems, this means ever-greater challenges in their day-to-day work. It is becoming increasingly difficult to detect a cyberattack before it reaches its final phase.

Typical cybercrime campaigns are “smash-and-grab” operations. When launching a cyberattack, the attacker does not focus on a specific target – the attacker relies on the attack scale to turn it into a profit. Furthermore, the attacker’s goal is usually to monetize the campaign quickly. Whether it involves selling stolen data, demanding a ransom, or some other outcome, the profit materializes almost instantly.

The real threat, however, is of a different nature. It is an Advanced Persistent Threat (APT). According to the National Institute of Standards and Technology (NIST) publication 800-39[1], an APT is defined as an adversary with sophisticated levels of expertise and significant resources, allowing it through the use of multiple different attack vectors (e.g., cyber, physical, and deception), to generate opportunities to achieve its objectives. Typical APT objectives are to establish and extend its presence within the information technology infrastructure of organizations for purposes of continually exfiltrating information and/or to undermine or impede critical aspects of a mission, program, or organization, or place itself in a position to do so in the future. Moreover, the APT pursues its objectives repeatedly over an extended period of time, adapting to a defender’s efforts to resist it, and with determination to maintain the level of interaction needed to execute its objectives.

Security teams are facing a skilled and experienced adversary – often with state-level support – whose priority is not rapid monetization but rather seeing the attack through to its final stage and avoiding detection at all costs. APT operations are precise, conducted over a long period of time, and highly targeted. Their primary objectives are most often cyberespionage, the theft of intellectual property (IP) and state secrets, exerting geopolitical influence, and strategically disrupting the functioning of critical national infrastructure.

For security teams and tools such as SIEM systems, the greatest challenge in detecting APT threats lies in the long gaps between a threat actor’s activities during an attack. Individual actions may be separated by weeks or even months of inactivity by the APT group.

The anatomy of an APT

The fact that an attacker’s actions in a compromised environment are spread out over time is no coincidence. It is a deliberate tactic designed to blend in with normal network traffic and the typical user and administrator activity of the compromised organization. All of this is done to make it more difficult to detect a hostile presence in the IT environment. Long intervals between activities also make the detection process more difficult.

APT attacks are carefully planned. This makes them extremely dangerous, but at the same time exposes their greatest weakness – since the attacker plans their actions, they usually do so according to a certain pattern. By analyzing many incidents, we can uncover this pattern and, as a result, predict the attacker’s next steps.

Several approaches are usually used to describe APT attacks. The most widely used are Cyber Kill Chain and MITRE ATT&CK (Adversary Tactics, Techniques, and Common Knowledge).

The Cyber Kill Chain[2] breaks down an intrusion into a defined sequence of seven phases from Reconnaissance to Actions on Objectives. It was created by Lockheed Martin in 2011. The Cyber Kill Chain is the extended military concept of a kill chain adapted to cybersecurity. It is still being used but it is focused on traditional perimeter defense.

The MITRE ATT&CK framework[3] – released in 2015 – it is a living, growing framework of the common tactics, techniques, and procedures (TTP) used by advanced persistent threats (APTs) and other cybercriminals. The framework receives at least two major updates from its creators every year. MITRE ATT&CK makes its matrices accessible to the private sector, governments, the cybersecurity product and service community, and the general public. This framework includes data on threat groups, their TTPs, and even provides references and examples – detailed reports on APT campaigns observed and recorded, along with Indicators of Compromise (IOCs) derived from them.

According to the MITRE ATT&CK framework an APT attack can be viewed as composed of several phases:

Phase 1: Reconnaissance and Resource Development

At this stage, the attacker selects a target – an organization or an individual. The attacker also prepares to carry out the attack. These activities take place entirely outside the target’s IT infrastructure, making them virtually impossible to detect by conventional security systems. Only by utilizing Cyber Threat Intelligence (CTI) services can we obtain information about the attacker’s potential preparations.

Threat actors in Phase 1 profile the organization by actively and passively collecting data about the organization and its employees. They seek information about the ICT infrastructure, public IP addresses, cloud services in use, and business relationships. ICT infrastructure accessible via the Internet may become a target for scanning to identify running services or existing vulnerabilities. Attackers also study the security solutions, defenses, and known attack signatures that the victim might use.

At the same time, employees (particularly IT administrators and management) are profiled through the analysis of social media (including LinkedIn, Twitter, and Facebook).

As part of the preparations for an attack, domains and IP addresses are purchased, and dedicated malware or scripts are often developed. Based on the collected data, a spear-phishing email campaign might be created, or exploits might be developed to take advantage of vulnerabilities detected in the ICT infrastructure.

Phase 2: Initial Access

Once an attacker determines that they have gathered enough information about their target and prepared the necessary resources to carry out an attack, they make their first move as part of the campaign – attempting to gain access to any component of the target’s ICT environment. During this phase of the attack, the attacker implements techniques that use various entry vectors to gain their initial foothold within a network.

In most scenarios, attackers phish their target company’s employees into opening a malicious attachment or clicking a crafted URL in the hope of delivering a payload by exploiting a vulnerability in a common browser or application such as Adobe Acrobat or Microsoft Office. Alternatively, they may exploit vulnerabilities in internet-facing infrastructure, such as VPN concentrators or mail servers.

Phase 3: Persistence and Defense Evasion

For an APT group, gaining access to the infrastructure is just the beginning. They are well aware that IT systems and users’ computers are frequently updated, undergo maintenance windows, and are restarted. Therefore, their priority is to immediately secure the access they’ve gained to the ICT infrastructure. To do this, they will modify autostart settings and startup scripts associated with host boot or user login, and create scheduled tasks in the Task Scheduler.

It is equally important for them to avoid detection, and thus to leave as few traces as possible. To achieve this, they may add exceptions to antivirus software and locally installed firewalls, or even delete entries from the event log.

As part of efforts to avoid detection, the use of the “Living off the Land” (LotL)[4] tactic is becoming increasingly common. This approach focuses on exploiting built-in or existing, legitimate administrative tools of the operating system, such as PowerShell, Windows Management Instrumentation (WMI), or PsExec. To monitoring systems, such activity appears to be standard IT administrator work and does not trigger an alert.

Phase 4: Discovery, Lateral Movement and Privilege Escalation

The first compromised host is rarely the attacker’s ultimate target. The attacker must therefore locate hosts or data of interest within the victim organization’s internal network and identify domain controllers, database servers, or relay stations used to manage OT infrastructure. In most cases, every host identified by the attacker during the discovery phase is also compromised.

On each compromised host, the attacker focuses on stealing as many credentials as possible. Using memory-dumping tools (e.g., variants of Mimikatz) or techniques such as Kerberoasting, attackers obtain passwords or password hashes of other users. Then, using the stolen identities, they move seamlessly and silently from machine to machine within the network, avoiding detection and escalating their privileges all the way to the Domain Administrator level.

Phase 5: Command & Control (C2)

Most APT attacks are carried out using a “hands-on” approach, meaning the attacker acts interactively by issuing commands or deciding to trigger automated (scripted) actions. For this reason, the attacker establishes a connection to their own infrastructure. The attacker uses this channel to send commands to be executed on the hosts, but also to exfiltrate data. To avoid detection by IDS/IPS systems and firewalls, APT groups employ sophisticated traffic obfuscation techniques, including, among others, encrypting all communication or tunneling communication through standard ports (e.g., HTTPS/443, DNS). They also use well-known and popular legitimate services as C2 intermediaries (e.g., communication via public Telegram channels, Google Drive, and even hiding commands in GitHub comments). As a result, the network traffic generated by the threat actor blends in with typical network traffic.

Phase 6: Collection, Exfiltration and Impact

After weeks or months of undetected presence within the ICT infrastructure, mapping the network, and securing the highest privileges, the attacker moves on to the final phase of the attack. This usually involves data exfiltration. To avoid triggering alerts about a sudden transfer of gigabytes of data, the data is first collected in an inconspicuous location, slowly compressed, encrypted, and sent out in small, inconspicuous packets – a process that can also take weeks. In the case of purely destructive campaigns, attackers may ultimately launch Wiper-type malware, irreversibly destroying data and covering their tracks.

APT activity in Germany and Poland

Due to its strong economic position and numerous research projects, Germany is targeted by a variety of state-sponsored actors (Russia, North Korea, China) motivated by industrial cyberespionage and the theft of intellectual property. Below are short profiles of the most active in Germany state-sponsored APT groups:

APT29 – the APT group attributed to Russia’s Foreign Intelligence Service (SVR) [5], which, since at least 2008, has focused on gathering intelligence to support decision-making regarding Russia’s foreign and security policy. APT29 primarily targets Western governments and their affiliated organizations, such as ministries and government agencies, political think tanks, the aviation, financial, and healthcare sectors, nongovernmental organizations, the media, telecommunications, and transportation. Their targets also included the governments of member states of the Commonwealth of Independent States, as well as governments in Asia, Africa, and the Middle East. In late February and early March 2024, the group carried out highly targeted attacks against political parties in Germany[6] (including the CDU). Tailored dinner invitations were used as the initial vector to distribute a dedicated backdoor called WINELOADER.

Turla – the cyberespionage group attributed to Russia’s Federal Security Service (FSB)[7]. Since at least 2004, it has carried out cyberattacks against targets in more than 50 countries. The group’s primary targets are government entities, armed forces, and embassies. However, over the years, the group has expanded its activities to include victims from a wide range of sectors, including education, high technology, finance, healthcare, pharmaceuticals, and retail. Reports from mid-2026[8] confirm the use of sophisticated malware (e.g., STOCKSTAY and Kazuar) against German and Ukrainian academic networks, research institutes, and diplomatic platforms. The targets included innovations in the pharmaceutical and defense sectors, among others.

Lazarus Group  – the group linked to North Korea’s military intelligence agency[9] – the Reconnaissance General Bureau (RGB). It has been active since at least 2009 and is responsible for a series of espionage, sabotage, and financial attacks. Its activities serve both intelligence purposes and the generation of revenue for the regime – including funding the nuclear weapons program and circumventing international sanctions. Lazarus targets a wide range of sectors: government and military institutions, the financial sector (banks, SWIFT), companies in the entertainment industry (e.g., the 2014 attack on Sony Pictures), the technology sector, the media, and international shipping; and, in recent years, with particular intensity – blockchain companies, cryptocurrency exchanges, and providers of services related to digital assets. In August 2026, it was confirmed[10] that the group had used advanced 0-day exploits targeting the Windows environment against the supply chain in the aerospace and defense sectors in Germany and around the world.

Mustang Panda – the APT group linked to China[11] that has been active since 2012, focusing on well-crafted spear-phishing campaigns that used the targets’ native languages to impersonate organizations providing government services. As part of these campaigns, the group exploited current international events, such as the COVID-19 pandemic and the Russia-Ukraine conflict. The group’s targets include foreign governments, nongovernmental organizations, and other entities considered enemies of the Chinese communist regime. Threat intelligence reports from the first half of 2026 indicate that Mustang Panda carried out a large-scale campaign, using new variants of PlugX and vectors driven by removable media (USB) to infiltrate engineering and manufacturing networks (particularly in the automotive sector) in Germany and Europe.

The activities of APT groups in Poland are predominantly politically and militarily motivated, and the main threat actors are groups linked to Russian (GRU, FSB, SVR) and Belarusian intelligence services. Below we present short characteristic of the most active state-related APT groups:

APT28 – the APT group, which has been attributed to the Russian Main Intelligence Directorate of the General Staff (GRU), 85th Main Center for Special Services (GTsSS), military unit 26165^[12],[13]. This group has been active since at least 2004. APT28 seeks to gather information and has shown an interest in governments and security organizations in Eastern Europe. The group’s activities are aimed at enabling the Russian government to anticipate the intentions of decision-makers and assess their ability to influence public opinion. The group has targeted organizations operating in the automotive, aviation, chemical, construction, defense, education, energy, engineering, finance, healthcare, manufacturing, IT, and oil and gas sectors. In addition, it has attacked embassies, media outlets, nongovernmental organizations, think tanks, and intelligence agencies. In May 2024, EU institutions (including Polish government agencies) fell victim to a sophisticated cyberespionage campaign, which was officially condemned by the Council of the EU. In 2025, the group was observed using new, AI-powered variants of malware (including the LAMEHUG family), optimized to bypass the security measures of public administration networks.

Sandworm – the APT group that has been attributed to military unit 74455 of the Main Center for Special Technologies (GTsST) of the Russian Main Intelligence Directorate of the General Staff (GRU)^[14],[15]. The group has been active since approximately 2009. While operating as a military unit, the group frequently uses pro-Russian hacktivist personas as a front for its operations. Sandworm Team primarily targets entities related to the energy sector, industrial control systems, SCADA, government, and the media. Sandworm Team was linked to an attack on the Ukrainian energy sector in late 2015, as well as to the NotPetya malware in 2017. In addition, this group is credited with the 2018 attack on the Winter Olympics in Pyeongchang following the ban on Russian athletes for doping, as well as election-related activities in several countries, including the U.S. in 2016, France in 2017, and Georgia in 2019. In recent months, the group has begun using advanced evasion techniques, including automated generation of malicious code. At the turn of 2025 and 2026, the group attacked the Polish energy sector[16]. Unlike traditional attacks on power transmission operators, this time the targets were combined heat and power (CHP) plants and modern management systems for renewable energy sources (RES) – wind and solar farms. The attack targeted both information technology (IT) and operational technology (OT) systems.

UNC1151 (Ghostwriter) – the APT group linked to the Belarusian government that also has ties to Russian intelligence agencies ^{[17],[18],[19]}. The targets of the attacks are primarily individuals associated with politics and the military, as well as those who may have indirect ties to Russia and Belarus – such as certified Russian translators, lawyers, NGO staff, Orthodox priests, and journalists. These operations were primarily directed at audiences in Lithuania, Latvia, and Poland, featuring narratives critical of the North Atlantic Treaty Organization’s (NATO) presence in Eastern Europe, sometimes using other topics – such as anti-American and COVID-19-related narratives – as part of this broader anti-NATO agenda. These campaigns were named “Ghostwriter.” The group’s primary motivation is to steal information for intelligence purposes and to conduct disinformation campaigns. The group remains active in Poland[20].

Gamaredon – an APT group linked to the Russian Federal Security Service (FSB)[21], specifically its 16th Center – which houses the agency’s main electronic and signals intelligence capabilities – and its 18th Center, which serves as the Information Security Center^[22]. The group focuses on information theft and espionage campaigns targeting military objectives, as well as political and government institutions in Ukraine and countries supporting Ukraine in its conflict with Russia.

The challenge of connecting the dots with SIEM

Every organization building an effective security infrastructure monitoring system needs a central point where logs from every host are collected. Only then will it be possible to correlate events recorded on different hosts across the organization’s network. Only then will security team members be able to identify indicators of an ongoing security incident – a cyberattack. At the heart of every cybersecurity ecosystem, there is a SIEM. However, when it comes to detecting advanced persistent threats (APTs), a SIEM platform faces huge challenges: distinguishing normal administrator activity from the actions of a threat actor, and dealing with the limitations associated with the wide time window exploited during APT attacks.

Because LotL techniques are commonly used in APT campaigns, individual actions by an attacker can be virtually indistinguishable from the daily activities of authorized IT personnel – such as help desk staff or administrators. The challenge for SIEM systems is even greater because APT groups operate “slowly” with the intent of avoiding detection at all costs. An APT group may gain an initial foothold on Monday, conduct silent internal reconnaissance on Friday, and wait an entire month or even longer before attempting an LSASS memory dump on a compromised host or before beginning the discovery and lateral movement phases of the attack.

Standard correlation rules in SIEM systems are typically designed to analyze logs within short time windows – usually 5 to 15 minutes – to limit processing load and database memory consumption. As a result, when an attacker spreads their activities over several weeks, a standard correlation engine will fail. The initial events in the attack chain expire from the active memory buffer before subsequent malicious activities occur, breaking the cause-and-effect sequence necessary to generate an alert.

To overcome these limitations, modern SIEM platforms rely on correlation combined with state tracking. Instead of ignoring events after a defined time window has expired, the system records suspicious attributes – such as specific IP addresses, hostnames, or user accounts – in dynamic reference sets or watchlists with extended expiration periods, often ranging from 90 to 180 days. If an attacker logs in from an unusual ASN on Monday, that entity is flagged. When, a month later, the same account runs an obfuscated PowerShell script, the correlation engine checks the reference set, effectively linking isolated events across the extended duration of an APT campaign.

Because “Living off the Land” techniques blend into the daily activities of administrators, triggering an alert every time administrative tools – or tools considered to have dual-use capabilities (for administrative or malicious purposes) – are launched can result in numerous false positives. A feature that helps security teams address this challenge is risk-based alerting (RBA) combined with user and entity behavior analytics (UEBA). A modern SIEM system establishes a baseline for normal activity for each account and host in the organization’s IT environment. An administrator performing network diagnostics during business hours fits into this model. The same commands executed at 3:00 a.m. or an attempt to run them from a different account immediately raises the risk score for that entity. An actionable alert is generated only when this cumulative score exceeds a defined critical threshold.

While mechanisms like state tracking and risk-based alerting allow a SIEM to connect the dots over time, they rely entirely on having the right dots to connect in the first place. Even the most stealthy APT group inevitably leaves a trail of digital breadcrumbs across hosts and the network. The challenge for defenders is to capture those specific traces without drowning the SIEM in irrelevant data.

Following the trail of breadcrumbs

ICT infrastructure generates a vast number of events that are logged in log files. An administrator can configure individual IT systems to log nearly every operation. As a result, this vast number of events will be sent to the SIEM system. Since it is essentially an engine that aggregates and correlates data, it will process these events; however, the organization will face issues related to performance and increased costs (SIEM system licenses are often granted based on the volume of logs processed). Furthermore, the results may not be very accurate. This is because the effectiveness of a SIEM system depends entirely on the quality of the data it processes and on how well the correlation rules have been implemented within it.

To detect advanced persistent threats (APTs), a SIEM system must receive high-quality logs – that is, logs containing events related to user activity on hosts (including scripts being run), user identities, and network traffic. APT groups such as Sandworm and APT29 operate primarily using legitimate administrative tools (LotL) and compromised accounts with high privileges.

The SIEM system and its correlation rules should be configured to detect any anomalies in normal network traffic, software execution, and user activity. Of course, alerts generated by antivirus software, for example, must not be ignored; however, when detecting APT attacks, it is these anomalies and deviations from the environment’s normal operation – even minimal ones – that form the foundation of effective detection.

At the host level, process creation logs are crucial – every command issued, script executed, or program launched results in the creation of a new process. Therefore, the SIEM should receive Event IDs 4688 or data from Sysmon 1 along with the full command-line arguments. Process memory access monitoring (Sysmon 10) will also enable the detection of attempts to dump LSASS credentials using tools such as Mimikatz.

We cannot forget about PowerShell. It should be included in the monitoring because it is natively available in every Windows environment. Logs should include the following events:

• Script Block Logging (Event ID 4104) – the entire script block at the time of execution. The event records the decoded content of the script (after decoding, e.g., from Base64).
• Module Logging (Event ID 4103) – streams, modules, and API function calls loaded by PowerShell. These events are useful for tracking advanced code injection and the use of tools such as PowerSploit or Empire.

Additionally, administrators should turn on Transcription Logging – it records a complete text transcript of the PowerShell session (including user input and the results of executed commands) to files on the disk in a specified location. It is good practice to create a dedicated network share for this purpose to make it more difficult for an attacker to cover their tracks (an attacker who gains local administrator privileges can delete data stored locally). This could be very useful during post-incident analysis.

In an APT attack, one of the key objectives cybercriminals pursue is to establish persistence. That is why events logged during the installation of a new service (event ID 7045 or 4697) or the creation of a scheduled task (event ID 4698) should be sent to the SIEM. Consider also logging modifications to existing scheduled tasks (event ID 4702) and changes to registry keys (Sysmon 12/13).

The SIEM should also receive every event related to the clearing of the event log (event ID 1102) – this is potential evidence of an attacker covering their tracks, since log rotation or clearing is usually automated and performed in accordance with organizational procedures.

Threat actors want to elevate their privileges and move laterally across the network, which requires them to seize more accounts and credentials. As a result, the service responsible for the authentication process – Kerberos – is often the target of “Golden Ticket” or “Kerberoasting” attacks. To detect these activities, events related to the Kerberos service (event IDs 4768, 4769) should be forwarded to the SIEM. Monitoring access to Active Directory objects (event ID 4662) is also recommended.

To detect lateral movement, events related to access to network shares (event IDs 5140, 5145) should also be recorded, but only those which are related to hidden administrative shares, such as IPC$ and C$.

Logs from network devices also provide data that can be used to detect an ongoing APT attack. Attackers conceal their network traffic within the organization’s normal activity; in fact, they often go out of their way to ensure that their communications occur at similar times and use similar IP addresses or domains. To detect a potential APT attack, a SIEM must correlate anomalies in the network layer with the behavior of processes on the host.

Analyzing network traffic flows (NetFlow, IPFIX, sFlow), which contain metadata – such as who communicated with whom, on which port, for how long, and how much data was transferred – will help detect anomalies at the network level.

Attackers often use trusted cloud platforms such as Mega, Dropbox, or Google Drive. In such cases, logs from proxy servers or Secure Web Gateways (SWGs) should be sent to the SIEM, especially those containing headers and destination domains.

DNS traffic is very often used for exfiltration or C2 communication. Attackers use DNS tunneling to slowly and stealthily exfiltrate data from networks where HTTP/HTTPS traffic is strictly filtered. Therefore, logs from internal resolvers should also be sent to the SIEM.

It is not the single solution – it is a whole Ecosystem

No single cybersecurity platform can provide full visibility, reliable detection, contextual analysis, or effective response – especially when it comes to an APT attack.

A SIEM system in place within an organization will, of course, support the security team’s efforts, but it will not provide a sufficient level of event detection nor ensure an immediate response to a potential incident. We are simply dealing with too high a volume of potential incidents, many of which may turn out to be false positives. An additional challenge here is the extended duration of APT attacks.

That is why organizations are building cybersecurity ecosystems consisting of many elements that work together synergistically. These include SIEM systems, EDR/XDR solutions, SOAR, UEBA, and Cyber Threat Intelligence (CTI). Each of these elements exchanges data with the others and supports one another throughout the entire incident detection and response cycle.

The EDR solution provides a high level of visibility at the host level, complementing the SIEM system by normalizing data from hosts and automatically mapping process trees. EDR also identifies key system processes, protects their integrity, and provides a mechanism for immediate, automated response to malicious events. If an anomaly or potential incident is detected, the EDR agent can immediately isolate the infected host at the network interface level, effectively preventing the attacker from moving further through the network before an analyst even has a chance to review the alert in the SIEM system.

XDR systems extend the functionality of EDR systems to other infrastructure components – they go beyond the host environment and extend their functionality to network devices, cloud services, and so on.

Network detection and response (NDR) focuses on monitoring network traffic in real-time to identify and respond to potential threats. Once a threat is detected, NDR can initiate an immediate response, such as isolating affected parts of the network to prevent further propagation.

SOAR platforms are another component of the cybersecurity ecosystem. They are used to automate incident classification and response processes. When a SIEM system generates an alert with a high score, the SOAR platform is triggered to execute a predefined response scenario via APIs. This synergy significantly reduces the mean time to respond (MTTR) to an incident and alleviates the workload on the security team.

Detecting anomalies in the IT environment and user behavior is critical for identifying APT-type threats. Without the right tools, security teams would not be able to overcome this challenge. That is why User and Entity Behavior Analytics (UEBA) systems were developed. UEBA uses advanced machine learning algorithms to establish a “normal” behavior pattern for each user, service account, and device across the entire organization. In addition, it utilizes logs, Active Directory events, and network traffic. Subsequently, all activities in the IT environment are compared against this pattern. Any deviations or anomalies are immediately flagged to the security team on the SIEM platform, and the response can be automated through integration with SOAR systems.

Without knowledge of current cyber threats, the task of any security team comes down to responding to detected alerts and potential incidents. However, if we support these efforts with information about cyber threats, teams will be able to adopt a proactive approach. Cyber Threat Intelligence (CTI) services provide exactly this type of data – up-to-date indicators of compromise (IOCs) and the tactics, techniques, and procedures (TTPs) used by attackers, as well as information from the dark web regarding upcoming campaigns or stolen data (data breaches). This information can be fed directly into SIEM and EDR/XDR systems. Such integration enables automatic analysis of current events in the SIEM system for new IOCs and TTPs, as well as retrospective searches – when a new threat report emerges, it is possible to search historical data for newly IOCs and TTPs. As a result of this analysis, security teams can identify security breaches that were not detected at the time they occurred.

CTI is the foundation for a proactive approach to ensuring an organization’s security. Threat intelligence provided by CTI can be used for threat hunting to identify unknown vulnerabilities, undetected attacks, and new attack techniques. This enables security teams to proactively implement defensive measures to block them.

Are there any limitations?

An organization may maintain a well-functioning cybersecurity ecosystem consisting of SIEM, EDR/XDR, SOAR, UEBA, and CTI solutions, yet still be vulnerable to a cyberattack. One of the main reasons for this is that each component operates within specific technical, architectural, and operational limitations. These limitations can create blind spots, reduce the quality of data correlation, and cause security teams to make decisions based on incomplete context.

This situation is not always caused by the absence of a security product or its improper configuration. Often, organizations have the right tools but are unable to collect, decrypt, correlate, or effectively utilize the data to which they have access.

The first limitation is network traffic encryption. More than 90% of C2 communications and data leaks occur via the HTTPS protocol. Furthermore, APT groups frequently use legitimate cloud services (AWS, Azure, OneDrive, Mega), and traffic to and from these services is also encrypted. The response to this situation requires network traffic decryption, followed by content analysis and re-encryption. The results of this analysis must be fed into SIEM and NDR systems. If an organization does not implement this mechanism, even properly deployed and configured SIEM, NDR, and SOAR systems may fail to detect malware downloads, C2 communications, or data exfiltration.

Another challenge is the enormous amount of data generated by IT environments. SIEM systems are often licensed by the number of events per second, the daily volume of processed data, the amount of indexed data, storage capacity, or retention period. When the number of events flowing into the SIEM system is too high, organizations may begin to limit data sources (by excluding certain systems), reduce the level of log detail, or shorten event retention periods. These decisions may seem necessary from a financial or performance perspective, but they can significantly reduce the quality of security monitoring. If certain events do not reach the SIEM system, it may retain only the final suspicious activity and lose the context necessary to understand the attack chain. This may make it impossible to identify the initial point of entry, reconstruct the course of the attack, determine which accounts or systems have been compromised, or ascertain whether data has been accessed. In such circumstances, the SIEM system will continue to operate and generate alerts, but the security team will be unable to gather the data needed to determine the scale and scope of the incident.

Organizations in the critical infrastructure and manufacturing sectors face yet another challenge. It relates to operational technology (OT) and industrial control systems (ICS) environments. OT and ICS networks are monitored passively because active scanning and automated responses to detected events (EDR, SOAR) can disrupt the continuity of critical or manufacturing systems, leading to massive financial losses or even life-threatening situations. Passive network monitoring and NDR solutions provide valuable information; however, this monitoring may be limited by proprietary or encrypted industrial protocols.

This is not the only challenge involved with OT/ICS environment. According to the PURDUE model[23], the OT/ICS infrastructure is completely separated from the IT environment. An OT NDR system may have its own console, asset inventory, alert classification, and response procedures, while the IT security team independently manages SIEM, EDR/XDR, UEBA, SOAR, and identity monitoring systems. In this model, an OT alert may not reach IT security systems, and an IT alert may not include information about the severity level or the role of the industrial asset. This can make it difficult to detect an APT attack. A suspicious event in the IT environment may appear to be a routine administrative task until it is linked to access to a gateway dedicated to accessing the OT/ICS network.

OT and IT monitoring, as well as the incident response plan, should be integrated into a single process. This process should include shared resource identification, consistent time synchronization, a shared identity context, information on business and process criticality, and a clearly defined matrix of responsibilities among the security team, network teams, OT engineers, plant operators, and incident response personnel. At the same time, the process should include separate incident response procedures for the IT and OT environments.

Conclusion

SIEM systems support security teams in detecting APT attacks, primarily in the area of analyzing events occurring in the IT environment and alerting about detected anomalies. These systems alert security teams about events that have been previously defined as suspicious, such as those indicating an unauthorized presence on the network or on a host, or the abuse of privileges.

A SIEM system will be effective if the organization ensures the quality of the data fed into it and the quality of the correlation rules on which it operates. This means that when deciding what to log, what to forward to the SIEM, and configuring what should trigger an alert, the organization must have knowledge about the threats it faces and where those threats might appear within its infrastructure. Such information should be provided by the CTI service and threat modeling, which should be conducted regularly by the organization, with consideration of its specific context and data from CTI.

For SIEM systems to successfully detect APT threats, the logs fed into such systems and correlation rules must utilize CTI information on threat actors’ activities, as well as data on the TTPs and tools these actors use. Furthermore, the SIEM system must be aware of areas particularly vulnerable to compromise – all those where valuable data is stored or those that are critical to the organization’s ability to function.

Organizations must also monitor all their systems, including those that are part of both the ICT network and the OT/ICS networks. Although the Purdue model assumes a complete separation of the industrial environment from the office environment, and the specific nature of OT networks and ICS systems necessitates a passive approach, the monitoring process for both environments and the response plans must function as a single, integrated mechanism.

We must also keep in mind the limitations of SIEM systems. APT attacks are complex and protracted. Without supplementary solutions, a SIEM system will be less effective at detecting this type of threat. By implementing tools such as UEBA, EDR/XDR, and NDR, however, we can enhance threat detection and improve the quality of the logs fed into the SIEM. Furthermore, by deploying SOAR technology and integrating it with the SIEM, we can reduce response time by automating the process.

So what is the final answer to the question of whether and how SIEM can help detect an APT attack? It’s actually quite simple – if it is part of a mature cybersecurity ecosystem based on information about the ICT infrastructure, OT/ICS, and knowledge of potential threats, and if its operation is supported by other cybersecurity solutions, then yes, it is capable of detecting and alerting on an ongoing APT attack.

---

[1] NIST Special Publication 800-39, Managing Information Security Risk: Organization, Mission, and Information System View, National Institute of Standards and Technology https://csrc.nist.gov/pubs/sp/800/39/final

[2] Lockheed Martin, The Cyber Kill Chain®: https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html

[3] MITRE ATT&CK® Framework: https://attack.mitre.org/

[4] CISA, Identifying and Mitigating Living Off the Land Techniques: https://www.cisa.gov/resources-tools/resources/identifying-and-mitigating-living-land-techniques

[5] https://attack.mitre.org/groups/G0016/

[6] https://cloud.google.com/blog/topics/threat-intelligence/apt29-wineloader-german-political-parties

[7] https://attack.mitre.org/groups/G0010/

[8] https://cloud.google.com/blog/topics/threat-intelligence/stockstay-turla-intelligence-gathering

[9] https://attack.mitre.org/groups/G0032/

[10] https://labs.cloudsecurityalliance.org/research/csa-research-note-lazarus-windows-kernel-zeroday-defense-202/

[11] https://attack.mitre.org/groups/G0129/

[12] https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF

[13] https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF

[14] https://www.justice.gov/opa/press-release/file/1328521/download

[15] https://www.gov.uk/government/news/uk-exposes-series-of-russian-cyber-attacks-against-olympic-and-paralympic-games

[16] https://crn.pl/aktualnosci/wykryto-sprawcow-najwiekszego-cyberataku-na-polska-energetyke-cyberatak/#:~:text=W%20efekcie%20wysiada%20system%20operacyjny%20i%20trzeba,lat.%20Sandworm%20jest%20aktywny%20od%202009%20r.

[17] https://www.gov.pl/web/sluzby-specjalne/ustalenia-abw-i-skw-dot-atakow-hakerskich

[18] https://www.mandiant.com/resources/blog/unc1151-linked-to-belarus-government

[19] https://blog.google/threat-analysis-group/update-threat-landscape-ukraine

[20] https://cert.pl/tag/unc1151/#:~:text=Tag%20%23unc1151%20%7C%20CERT%20Polska.%20Tag%20%23unc1151.,te%20w%20przesz%C5%82o%C5%9Bci%20dotyczy%C5%82y%20innych%20dostawc%C3%B3w%20poczty.

[21] https://attack.mitre.org/groups/G0047/

[22] https://strapi.eurepoc.eu/uploads/Eu_Repo_C_APT_profile_Gamaredon_13d3d3be46.pdf

[23] NIST SP 800-82 Rev. 3 (Guide to Operational Technology (OT) Security: https://csrc.nist.gov/pubs/sp/800/82/r3/final