# Unveiling the Shadows--A Framework for APT's Defense AI and Game Theory Strategy
## 4 APT Attack Processes and Defense Implications  
Examining real-world APT incidents provides valuable insights into attack methodologies and effective defense strategies [5]. In the initial stage (Figure 3), attackers gather intelligence on their target, identifying vulnerabilities and potential entry points. Reconnaissance is the initial phase, where APT actors gather intelligence on their target before launching an attack. This stage can last weeks or even months, as adversaries employ a mix of passive and active intelligence-gathering techniques [8]. Monitoring publicly available information such as social media, job postings, and leaked credentials. Attackers collect publicly available information (OSINT--open-source intelligence) such as domain names, employee details, social media profiles, and network structures [4]. Data leaks and breaches from dark web forums also serve as critical intelligence sources [24]. Active reconnaissance (Figure 3) uses network scanning tools to detect weaknesses. Attackers interact with target systems using port scanning, vulnerability scanning, and phishing attempts to map network architecture and identify weak points [10]. Once the reconnaissance phase is complete, attackers infiltrate the system using techniques such as spear phishing by sending highly personalized emails with malicious links or attachments [10] and exploiting zero-day vulnerabilities by leveraging unknown software flaws to bypass security defenses [12; 25]. After this, they can develop watering hole attacks by infecting websites frequently visited by the target and compromising legitimate websites frequently visited by employees to inject malicious payloads [11]. The physical access remains a viable attack method, particularly in highly secured environments [25], and once the initial compromise is successful, the attackers establish a f  
Figure 3: Development of APT incidents. At this stage, attackers seek to maintain access and establish control over the compromised environment. They achieve this by deploying remote-access trojans (RATs), custom backdoors, and command and control (C2) infrastructures that allow for persistent remote access [25]. After gaining access, the attackers deploy malware or backdoors to maintain persistence in the system. This includes remote-access trojans (RATs) that enable remote control of compromised devices and fileless malware and run-in system memory to evade detection [12; 18]. The privilege escalation and lateral movement phase are characterized by the systems and data repositories [25; 26]. They achieve this by exploiting privilege escalation vulnerabilities and using credential dumping techniques (e.g., Mimikatz) to gain administrator privileges [10]. They often use kerberoasting attacks by exploiting weak Kerberos to extract domain administrator credentials [12] (in 2023) and using compromised credentials to access additional machines within the network via SMB, RDP, and SSH [5]. The attackers [19] then seek to expand their control by escalating privileges by exploiting vulnerabilities to gain administrative access and lateral movement, like spreading through the network and compromising additional systems. With control over critical systems, the attackers extract sensitive data using encrypted tunnels, bypassing network security monitoring and steganography, and hiding data within images or documents. Once attackers have access to critical assets, they extract sensitive information using encrypted tunnels by exfiltrating data via HTTPS, DNS tunneling, or VPN to avoid detection [25] or even using cloud services (Dropbox, Google Drive, etc.) to transfer files unnoticed [10; 19] or hiding data within images or legitimate documents to bypass security scans--steganography [19]. To ensure continued access and avoid detection, APT actors employ various evasion techniques, including modifying system logs, erasing traces of their presence deploying rootkits, and maintaining control despite security updates [10].