AV-06 · State-backed and foreign targeted intrusions

State-backed intrusions often pursue espionage, long-term access, or pre-positioning for future disruption. The tradecraft is patient and the objectives are strategic — which means defenders need longer retention, stronger fundamentals, and the ability to investigate slow campaigns.

$ action: Harden identity and edge access, protect high-value systems, extend telemetry retention, and build investigation procedures for slow campaigns — not just fast incident response.

1. Why This Threat Exists

Cyber operations are cheaper and less visible than most other forms of statecraft. Intelligence collection, pre-positioning, influence operations, and infrastructure disruption can all happen through network intrusions that leave no physical trace. Public and private sector organizations get targeted based on what they know, who they connect to, and what they operate — not just their size.

These intrusions don't always start with sophisticated malware. Many begin with phishing emails, credential stuffing against VPN portals, or exploitation of known vulnerabilities on edge devices. What distinguishes them is patience, targeting quality, and discipline about staying quiet after initial access.

Critical infrastructure operators, telecom providers, managed service providers, research institutions, and supply chain vendors often become targets not because of their own data, but because of who they have trusted access to.

2. What These Threats Can Do

A targeted intrusion may focus on credential collection, mailbox access, network topology data, VPN credentials, source code, administrative paths into partner environments, or long-term footholds intended for future operations. In some cases the immediate goal is intelligence; in others it's positioning for a later disruption.

Persistence and stealth drive the impact. An attacker who moves slowly and deliberately through your environment can expand access, map your defenses, and identify weak controls over weeks or months without triggering obvious alerts — especially if telemetry retention is short.

Investigation has to think in campaign terms. Repeated low-volume authentication anomalies, unusual API access patterns, credential reuse across systems, and subtle persistence artifacts spread over days are more diagnostic than a single loud alert.

3. How to Defend Against Targeted Intrusions

Start with strong fundamentals. Phishing-resistant authentication, privileged access controls, edge hardening, centralized logging with meaningful retention — these are the controls that make targeted intrusion significantly harder. Sophisticated attackers benefit most from organizations that have skipped the basics.

Map your high-value assets and likely attack paths. What would an adversary want? Which systems hold credentials that reach everything else? Which admin accounts have the broadest access? Build detection coverage specifically for those paths.

Practice investigations that span weeks. Teams need procedures for scoping a slow campaign: timeline reconstruction, evidence preservation across long windows, hypothesis tracking, and escalation processes that don't require a noisy alert to trigger.

detection-signals

$Low-volume authentication anomalies against high-value accounts — logins from unusual ASNs, new devices, or off-hours — that repeat over a period of days or weeks rather than in a single burst.
$Cloud admin console or API access from a principal that normally authenticates through a different method, or access to resources that principal has never touched.
$A scheduled task, registry run key, or service appears on a critical host without a corresponding change ticket or deployment record.
$Periodic outbound connections to destinations outside the organization's known cloud and SaaS providers, especially with consistent timing suggesting automated beaconing.
$Audit logs show a chain of reconnaissance behaviors — directory enumeration, mailbox access, network share browsing — spread across multiple days from the same account.

telemetry-sources

$Identity/SSO and cloud control-plane logs with long retention.
$EDR/XDR and host audit logs for persistence, privilege use, and admin tooling.
$Zeek/Suricata/NetFlow for outbound and east-west behavior over time.
$Email and collaboration logs (mailbox access, forwarding rules, admin changes).
$Asset inventory, admin path maps, and change records for high-value systems.

recommended-tools-and-guides

open Zeek Track protocol metadata and long-term traffic patterns for retrospective analysis. open Suricata Alert on known suspicious traffic patterns and protocol abuse. open Sigma Standardize and tune detections across multiple log sources and environments. open Arkime Support packet-indexed retrospective analysis for suspicious sessions over time. open /learning/threat-informed-defense-attack-technique-mapping Use ATT&CK-style mapping to structure targeted-intrusion detections and gap analysis.

related-learning-modules

Build fundamentals and workflows that directly support defending against this threat pattern.

open /learning/threat-informed-defense-attack-technique-mapping Threat-Informed Defense Using ATT&CK-Style Technique Mapping open /learning/network-security-monitoring-zeek-suricata Network Security Monitoring with Zeek and Suricata open /learning/incident-response-playbooks-framework-functions Incident Response Playbooks Aligned to Recognized Cybersecurity Framework Functions

related-tool-pages

Use these detailed tool guides to practice safe validation, evidence collection, and triage workflows for this threat.

open /learning/tools/zeek Zeek open /learning/tools/suricata Suricata open /learning/tools/sigma Sigma open /learning/tools/arkime Arkime open /learning/tools/security-onion Security Onion

lab-safe-detection-workflows

These commands are for learning, validation, and defensive triage in your own lab or authorized environment. Adapt to your tooling and log locations.

Long-window network telemetry review (lab / NSM workflow)

zeek -r targeted-activity-sample.pcap local
zeek-cut ts id.orig_h id.resp_h service uid < conn.log | head -n 80
tshark -r targeted-activity-sample.pcap -Y tls.handshake -T fields -e frame.time -e ip.dst -e tls.handshake.extensions_server_name | head -n 50

$ why: Use metadata and protocol context to identify repeated destinations, unusual SNI values, and low-volume recurring sessions.

Investigation tracking worksheet setup (evidence discipline)

printf "date,signal,source,host_or_account,hypothesis,confidence,next_action\n" > campaign-investigation-log.csv
printf "asset,owner,criticality,admin_path,logging_status,retention\n" > high-value-assets.csv

$ why: Targeted-intrusion investigations often fail due to poor tracking of hypotheses and high-value asset context rather than lack of tools.

triage-questions

?Which systems and accounts are strategically high-value to an adversary, and are any of them in the current signals?
?Does the activity form a recognizable campaign pattern across multiple days — reconnaissance, access, collection — rather than a single isolated event?
?Is there evidence of persistence artifacts, credential abuse, or staged collection behavior that suggests the attacker intended to stay?
?Do we have enough telemetry retention to scope backward from the first observable signal to understand how long this has been happening?
?What containment step reduces ongoing risk without destroying the evidence needed to understand the full scope of the campaign?

defender-actions.checklist

$Protect high-value accounts and systems with stronger auth and monitoring.
$Maintain longer telemetry retention for key identity, endpoint, and network logs.
$Map likely attack paths and detection gaps using threat-informed methods.
$Practice long-duration incident investigations and evidence tracking.
$Prioritize edge hardening and privileged access controls to reduce campaign success rates.

study-workflow

Learn what normal behavior looks like for this area (auth, exposure, config, or internal traffic).
Identify the logs and telemetry that should show the behavior.
Practice one safe validation in a lab or authorized environment.
Write a short playbook for detection, triage, and response.
Review the related tool guides under /learning/tools.

<- previous threat AV-05 · Insider threat and privilege misuse -> next threat AV-07 · Supply chain and third-party compromise