APT groups are associated with some of the most consequential cyber operations, but understanding them takes more than memorising names and malware families. The useful questions are what an actor wants, which access it needs, how it maintains that access, and what evidence its activity leaves behind.
Imagine a security analyst reviewing a successful sign-in to an old service account. There is no ransomware note and no obvious malicious executable. Later, the team discovers an unexpected application permission and unusual access to sensitive documents. The account was only the beginning of the investigation.
That scenario is fictional, but it introduces the central problem of advanced persistent threats: the visible alert may represent a small part of a much longer operation. This guide explains what APT means, compares six well-documented groups, examines their tools and techniques, and turns those observations into practical questions for defenders.
Contents
- What is an advanced persistent threat?
- What do APT groups want?
- Group names, aliases and the limits of attribution
- Six APT groups worth understanding
- APT29: espionage through identities and trust
- APT41: different missions under one label
- Volt Typhoon: access held for potential future use
- Lazarus and North Korean operations: preserve the distinctions
- Sandworm: when the objective includes disruption
- MuddyWater: familiar techniques, sustained intelligence goals
- How an APT operation develops
- Initial access: the first foothold can be ordinary
- Persistence, credentials and movement through the environment
- The tools APT groups use
- Living off the land and command-and-control
- Reading attack diagrams without inventing a timeline
- A fictional investigation: from one account to an access map
- Detection: combine indicators with behaviour
- How organisations can reduce APT risk
- Responding when activity is suspected
- Common myths about APT groups
- Frequently asked questions
- A short threat-intelligence glossary
- Sources and further reading
What is an advanced persistent threat?
APT stands for Advanced Persistent Threat. NIST describes an adversary with substantial expertise and resources that pursues its objectives over time, uses multiple avenues of attack and adapts to defensive resistance. Its objectives can include collecting information, undermining an organisation’s mission or maintaining the position needed to act later. See the NIST APT definition.
The three words describe an operational capability:
- Advanced: the actor can combine skills, infrastructure and methods appropriate to its mission.
- Persistent: it continues working towards the objective, including when defenders interrupt access.
- Threat: it has the intention and capability to cause harm.
The term is about an adversary and its sustained activity. It is not a special file type, a malware product or a guarantee that every intrusion is technically novel. A sophisticated operator can still benefit from an unprotected account or an unpatched appliance.
For an analyst, a better starting question than “Does this look advanced?” is “What access and objective could explain these connected actions?” That shifts attention from the appearance of a tool to the purpose of the operation.
What do APT groups want?
An operation’s objective helps explain its targeting and the access it seeks. The same foothold could support several possible missions, so intent should be assessed from evidence rather than assumed from a single indicator.
| Objective | What the actor may seek | Why access matters |
|---|---|---|
| Political or military intelligence | Diplomatic communications, policy documents and defence information. | Continued visibility can be more valuable than an immediate public impact. |
| Industrial and economic intelligence | Research, intellectual property and commercially sensitive plans. | Access to repositories and specialist teams can reveal high-value information. |
| Financial gain | Cryptocurrency, payment workflows or assets that can be monetised. | The operation needs access to the systems and people controlling value. |
| Disruption or destruction | Interruption of services or damage to data and systems. | Impact depends on the actor reaching the relevant operational assets. |
| Strategic positioning | Access that could become useful during a later crisis. | A quiet foothold may have value before any destructive action occurs. |
The cases below show why “APT” should not be reduced to a single motive. Mandiant describes APT41 activity spanning espionage and financially motivated operations, while the joint Volt Typhoon advisory assesses positioning for possible future disruption. These are different operational purposes with different implications for risk.
An organisation should therefore ask which assets would make it useful to an adversary. Its own data may be valuable, or it may provide a trusted route into a customer, supplier or partner.
Group names, aliases and the limits of attribution
APT names are analytical labels. Different research teams observe different parts of an operation and may create different names for related activity. MITRE describes its Groups as clusters of activity and explicitly warns that associated names do not necessarily overlap exactly.
Keep four concepts separate:
| Term | Meaning in a threat report |
|---|---|
| Actor or group | A tracked cluster of adversary activity. |
| Campaign | A related set of operations within a particular context and period. |
| Malware or tool | Software used during an operation. |
| Attribution | An assessment connecting activity to an actor, organisation or state. |
Two incidents using the same publicly available tool are not automatically the work of the same group. Conversely, a group can change software while retaining its operational objective.
Good attribution reporting identifies the source of the assessment and expresses its confidence. Technical similarities, infrastructure, targeting and other evidence can contribute, but a country label should not be inferred from an IP address alone.
Throughout this guide, country and organisational associations refer to the assessments in the linked sources. The six examples are selected to illustrate different missions, rather than to rank the world’s “most dangerous” groups.
Six APT groups worth understanding
| Group | Publicly reported association | Representative focus | Main lesson |
|---|---|---|---|
| APT29 | Russia’s Foreign Intelligence Service, SVR. | Espionage, including cloud and identity access. | Identity and application permissions can be central to an intrusion. |
| APT41 | China-linked; state-sponsored espionage and separately motivated financial activity. | Multiple commercial and public-sector targets. | A single label can cover operations with different motives. |
| Volt Typhoon | PRC state-sponsored actor. | U.S. critical infrastructure. | Quiet access can support strategic positioning. |
| Lazarus Group | North Korean cyber activity; an umbrella label in some reporting. | Espionage, destructive activity and financial operations. | Preserve distinctions between units and campaign labels. |
| Sandworm | Russia’s GRU Unit 74455. | Destructive operations, including energy-sector attacks. | Business and operational impact belong in the analysis. |
| MuddyWater | Assessed subordinate element of Iran’s MOIS. | Espionage across government and commercial sectors. | Familiar software and social engineering can support sustained operations. |
These profiles describe documented activity across different periods. A historical tool association is not evidence that the same tool remains in every present-day operation.
APT29: espionage through identities and trust
APT29, also associated in reporting with names such as Midnight Blizzard and Cozy Bear, illustrates the importance of identity security. A February 2024 joint advisory led by the UK NCSC described SVR-attributed actors adapting their access methods to cloud environments. It covered account access, tokens and device registration, alongside detection and mitigation advice.
A separate Microsoft investigation published in January 2024 described password spraying against a legacy test account without MFA, followed by misuse of OAuth applications and access to corporate email. This was a reported sequence from that incident, not a universal APT29 playbook.
The defensive lesson is to follow permissions beyond the first account. An investigation should ask which applications, service principals and mailboxes that identity could reach, and whether new access paths were created.
A non-production label does not make an account harmless when its permissions cross into a production environment. Likewise, resetting one password does not by itself demonstrate that malicious application access has been removed.
APT41: different missions under one label
Mandiant’s 2019 APT41 report described Chinese state-sponsored espionage alongside financially motivated activity that appeared to serve personal gain. It is a useful counterexample to the idea that every operation assigned to a state-linked group has exactly the same purpose.
In research published on 18 July 2024, Mandiant documented a campaign affecting sectors including shipping and logistics, technology, media and automotive organisations. The report described web shells, DUSTPAN, BEACON and DUSTTRAP, as well as tools used for database extraction and transfer to OneDrive.
The lesson is about relationships between components. A web server foothold, a loader and an outbound cloud transfer can be parts of one intrusion even when different products generate the alerts.
For an investigator, the useful record connects the host, process, identity, accessed dataset and destination. A list of malware names loses much of its value if it does not explain how the actor moved from access to its objective.
Volt Typhoon: access held for potential future use
MITRE’s Volt Typhoon profile describes a PRC state-sponsored actor targeting critical infrastructure in the United States and its territories. It highlights stealth, compromised credentials and living-off-the-land activity.
The February 2024 joint advisory, AA24-038A, assessed that the actors were positioning themselves for disruptive or destructive activity in the event of a major crisis or conflict. That assessment concerns potential future capability and intent; it does not mean every compromised organisation had already suffered an operational disruption.
Reported activity included use of legitimate utilities and reliance on valid credentials. This makes a malware-only view of the incident incomplete.
For critical infrastructure defenders, the central question is what the acquired access could enable. Which identities can reach management systems? Where are the boundaries between enterprise IT and operational technology? Could the same credentials cross them? Those questions connect technical findings to the possible consequences of an intrusion.
Lazarus and North Korean operations: preserve the distinctions
The MITRE Lazarus profile explains that public reporting sometimes uses “Lazarus Group” as an umbrella for multiple North Korean operators. Personnel, infrastructure and tradecraft can overlap, while particular operations receive more specific labels.
For example, the FBI’s 26 February 2025 announcement attributed the theft of approximately $1.5 billion in virtual assets from Bybit to North Korea and referred to the specific activity as TraderTraitor. A careful article should retain that naming rather than silently treating every North Korean label as identical.
This broader body of activity illustrates why financial objectives belong in a discussion of advanced threats. Access to development environments, signing processes or asset-management workflows can have consequences beyond the confidentiality of office documents.
For defenders, assess the actual workflow that authorises a valuable action. Which people, devices and applications are trusted? How are changes reviewed? A successful authentication event is only one part of establishing whether a sensitive action was legitimate.
Sandworm: when the objective includes disruption
Sandworm demonstrates why a threat assessment must include availability and operational consequences. MITRE associates Sandworm with GRU Unit 74455 and documents its relationship to destructive campaigns. The same profile lists associated reporting names, including APT44, with the usual limits on exact overlap.
In April 2022 research conducted with CERT-UA, ESET described an attempted attack against a Ukrainian energy provider involving Industroyer2 and destructive malware. ESET assessed Sandworm responsibility with high confidence. Its report also stated that initial access and the route from IT to the industrial environment were unknown at that point.
That last detail matters. An attack diagram should not fill an evidentiary gap with a plausible-looking but unverified step.
The defensive lesson is to connect incident response with operational recovery. For an industrial operator, containment decisions need engineering context, safe operating procedures and a clear understanding of which dependencies keep essential services running.
MuddyWater: familiar techniques, sustained intelligence goals
MITRE’s MuddyWater profile describes a cyber-espionage group assessed to sit within Iran’s Ministry of Intelligence and Security. Its documented targeting spans government and commercial organisations across multiple regions.
A 2022 joint advisory, AA22-055A, described spearphishing, exploitation of publicly known vulnerabilities, DLL side-loading and obfuscated PowerShell. It discussed malware families including PowGoop, Small Sieve and POWERSTATS.
These are observations from the advisory’s reporting period. They should help explain categories of behaviour, rather than become a permanent checklist that defines every MuddyWater intrusion.
The practical lesson is to investigate how execution happened. A legitimate application loading an unexpected component, or a document leading to an unusual process chain, deserves context. Ask where the file originated, who launched it and what network activity followed. A reassuring filename is weaker evidence than a well-understood execution path.
How an APT operation develops
An operation can involve preparation, access, expansion, collection and action towards an objective. These activities may overlap, repeat or occur in parallel. A second access route may be established while the first is still being investigated.
| Operational question | Examples of relevant activity | Defender’s question |
|---|---|---|
| How will the actor reach the target? | Reconnaissance, infrastructure preparation and initial access. | Which exposed services and trust relationships matter? |
| How will access survive? | Accounts, application permissions, services or other persistence mechanisms. | What changed, who authorised it and can it be reversed? |
| What does the actor need next? | Credential access, discovery and movement to other systems. | Which identity and network boundaries were crossed? |
| What information or capability is valuable? | Collection, staging, command-and-control and exfiltration. | Which assets were accessed and what left the environment? |
| What outcome is intended? | Intelligence collection, financial action or disruption. | What is established by evidence, and what remains a hypothesis? |
MITRE ATT&CK tactics describe the tactical purposes of adversary behaviour. They provide a vocabulary for analysis rather than a mandatory sequence that every intrusion follows. Use the framework to organise observations, and preserve the actual timeline separately.
Initial access: the first foothold can be ordinary
Initial access may come from social engineering, exploitation of a reachable application, stolen credentials or a compromised trusted relationship. The entry point must be established from evidence for the incident being examined.
MITRE’s Phishing technique covers electronically delivered social engineering, including targeted spearphishing. The investigation question is wider than whether a message looked suspicious: did it lead to a credential submission, a file execution or a new application authorisation?
Valid Accounts covers abuse of existing identities. An adversary may obtain useful access without introducing a conspicuous new executable. That is why identity telemetry and a reliable account inventory are part of intrusion detection.
For a service provider, the relevant route may be an existing customer-management relationship. For a software developer, it may be a build or update process. For a university, it may be a researcher account with access to shared repositories. These examples are risk scenarios, not claims that the organisations are targets of a particular group.
The first foothold is also not necessarily the first event a defender can see. Limited retention or missing logs can leave the beginning of a timeline unresolved. Mark that uncertainty instead of presenting the earliest retained event as proven initial access.
Persistence, credentials and movement through the environment
Persistence means preserving a useful foothold. Depending on the environment, it might involve an account, an application permission, a server component or another mechanism that enables later access.
Credential access and lateral movement serve different purposes. Obtaining authentication material creates options; using an available route to another system changes the scope of the intrusion. A password reset can address one piece of that chain while leaving other permissions or sessions unexamined.
Build an access map during an investigation. Record the identity, its privileges, the affected application or host, and the resource it could reach. Then distinguish access that was possible from access actually observed in logs.
That distinction prevents two common reporting errors. Finding a powerful account does not prove every reachable file was read. Finding one accessed mailbox does not establish that the actor was confined to that mailbox.
For background on why recovered credentials matter, see DaySec’s RockYou, Hashcat and John the Ripper guide. Offline password recovery is one possible supporting activity; it does not explain every identity compromise.
The tools APT groups use
An actor’s toolkit can combine custom malware, commercial products, open-source projects and components already installed in the environment. Tool names are useful when they connect to a specific capability and a documented observation.
| Tool or category | Role | What a defender should investigate |
|---|---|---|
| PowerShell | An administration and scripting environment that can also be abused for execution and discovery. | Process ancestry, script activity, account context and follow-on connections. |
| Cobalt Strike and BEACON | Commercial adversary-simulation capabilities that also appear in malicious operations. | Whether the deployment is authorised, and the associated execution and communications. |
| Mimikatz | A credential-access tool with multiple Windows authentication-related capabilities. | Sensitive process access, identity exposure and subsequent account use. |
| Web shells | Server-side components that can provide an adversary with access through a web server. | Unexpected files, application changes and web-process activity. |
| Custom loaders and backdoors | Components that introduce or run further capabilities and maintain operator access. | The relationship between initial execution, loaded components and network activity. |
| Remote administration and transfer utilities | Software that may be legitimate in one context and unauthorised in another. | Approval, installation source, destination, account and actual usage. |
The primary references are MITRE’s pages for PowerShell, Cobalt Strike, Mimikatz and Web Shells. The group profiles above provide campaign-specific examples of custom components.
Avoid turning a capability into an attribution shortcut. Discovering Cobalt Strike does not identify the operator, and the absence of a known malware family does not establish the absence of an intrusion.
The most informative question is what a component enabled in this particular environment. A familiar program can be dangerous because of the account running it and the resource it can reach, even when the program itself has a legitimate purpose.
Living off the land and command-and-control
Living off the land, or LOTL, means abusing tools and capabilities that are already available in the environment. It can make malicious activity harder to distinguish from administration. It does not mean the activity produces no evidence or that the whole operation contains no malware.
The NSA’s February 2024 explanation of joint LOTL guidance emphasises logging, authentication controls, privilege restrictions, remote-access auditing and baseline behaviour.
Command-and-control, usually shortened to C2, is the communication that lets an operator interact with compromised systems. A network connection becomes meaningful when related to a process, account and operational context. Ordinary-looking transport or a familiar cloud service does not establish that a particular connection was authorised.
The practical implication is to keep context together. Instead of examining a destination, executable or username in isolation, ask whether that combination normally performs that action from that host. A supported administrative workflow and an unexplained use of the same utility require different responses.
Reading attack diagrams without inventing a timeline
Lifecycle diagrams are useful teaching aids because they turn many observations into a recognisable story. Their weakness is that the clean story can appear more certain than the evidence.
Use a diagram as an index to questions. If it contains “deployment,” ask what was deployed and how that is known. If it contains “control,” identify the observed communication or authenticated access. If it contains “action,” describe the actual outcome rather than assuming that data theft occurred.
A case with no established entry point should display that gap. A case with several overlapping access routes should retain that complexity. Simplification is useful when it makes the evidence understandable; it becomes misleading when it supplies missing evidence.
The same principle applies to ATT&CK mappings. A technique identifier organises a finding. It does not, by itself, prove attribution, establish an incident’s chronology or measure the effectiveness of the organisation’s controls.
A fictional investigation: from one account to an access map
Return to the opening scenario. The following exercise is an invented composite for analyst training. Its events are not attributed to any of the six groups.
Finding one: an unusual successful sign-in. An old integration account connects from an unfamiliar source. The account owner cannot immediately explain the activity. The team preserves the relevant identity records and checks normal usage, scheduled tasks and approved changes. An unfamiliar source is a lead, not yet proof of compromise.
Finding two: a new permission. Audit records show that an application received a permission it did not previously hold. The team checks who authorised the grant, its scope and whether the application is part of a recognised workflow. The account investigation has now become an application-access investigation.
Finding three: sensitive data access. The application accesses documents outside its expected business purpose. Analysts correlate object identifiers, request times and the acting identity. They distinguish a listing operation from a content retrieval and record what the available logs can actually establish.
Finding four: a second access path. A related administrative identity appears on another system. The team compares time, account relationships and host activity before deciding whether the events belong to the same incident. The second identity could represent expanded scope, but an unexplained coincidence should not become an asserted connection.
The resulting access map is more useful than any one alert:
| Observed item | Question it raises | Evidence to seek |
|---|---|---|
| Legacy integration account | Was its use authorised? | Sign-in history, owner confirmation and workflow records. |
| New application permission | Was the grant expected and appropriately scoped? | Audit trail, consenting identity and change approval. |
| Document activity | What data was actually accessed? | Resource-level access records and request semantics. |
| Related administrator activity | Did the intrusion extend to another system? | Host, identity and network correlation. |
The response team can then select containment steps that address the discovered paths, rather than treating the original password as the entire incident. A written timeline should separate observed facts, working hypotheses and unresolved questions.
Nothing in this fictional sequence is sufficient to name an APT group. The exercise teaches scope and evidence. Attribution would require additional analysis and trustworthy supporting intelligence.
Detection: combine indicators with behaviour
An indicator of compromise, or IOC, can be a file hash, domain or another observable linked to malicious activity. Indicators help find known artifacts. Behavioural analysis asks how related actions fit together, including when individual components appear legitimate.
For this guide, a practical investigation structure is:
- Identity: which account, application or session performed the action?
- Execution: which process or service carried it out, and what started it?
- Resource: which system, mailbox, repository or dataset was reached?
- Timing and destination: what happened next, and where did data or communication go?
This is an analytical checklist, not a universal detection rule. An unusual pattern can have an authorised explanation. Effective detection needs usable telemetry, an understanding of normal workflows and a way to verify the finding.
The joint event-logging guidance announcement from August 2024 highlights the importance of logging for identifying malicious activity and LOTL techniques. Collection alone is not the outcome: the records need to be available for timely investigation.
Measure that availability. Can an analyst retrieve a relevant application-permission change? Can a host event be connected to an identity? Can the organisation reconstruct access to a sensitive repository? These questions turn a broad ambition to “monitor everything” into concrete coverage requirements.
How organisations can reduce APT risk
The six cases suggest a practical defensive programme. These priorities are an editorial synthesis of the linked reports, not a guarantee that a particular control stops every actor.
- Know the important access paths. Inventory exposed services, remote-management routes, privileged identities and critical application permissions.
- Reduce preventable entry points. Maintain supported systems and prioritise remediation of exposed, exploitable weaknesses.
- Protect identities. Deploy phishing-resistant MFA where supported, remove obsolete accounts and constrain non-human identities to their required purpose.
- Limit expansion. Separate administrative roles and network access so one foothold does not automatically reach every important asset.
- Make investigations possible. Retain useful identity, application, endpoint and network records with consistent time references.
- Prepare to remove more than one foothold. Exercise response and recovery against a scenario involving accounts, applications and hosts together.
For a Greek shipping supplier, an energy contractor or a research organisation, the useful question is not simply whether its country appears in a threat report. Consider the value of its information, its dependencies and the access it provides to partners. These are example risk assessments, not claims of a specific campaign against those sectors in Greece.
Start with a small number of important workflows and prove that the controls and evidence exist. A documented ownership and review process for a powerful service account can be more actionable than an unprioritised list of hundreds of group names.
Responding when activity is suspected
A suspected intrusion needs a coordinated response proportionate to the evidence. Preserve relevant records, identify the affected assets and involve the people who understand the systems before taking actions that could destroy evidence or interrupt essential operations.
Use the developing access map to guide scope. Examine related identities, applications and reachable resources. Record which containment action addresses which access route, and verify its effect. Continue looking for alternative routes rather than assuming that the disappearance of one alert means the incident is over.
For operational technology, coordinate with engineering and safety personnel. A containment action appropriate for an office workstation may have very different consequences on a system supporting physical operations.
The final report should make three things clear: what happened according to available evidence, what remains uncertain and which changes reduce the chance or impact of a recurrence. State the basis for any actor attribution separately from the technical description of the incident.
Common myths about APT groups
| Myth | A more useful interpretation |
|---|---|
| Every APT intrusion uses a zero-day. | Documented operations also use known weaknesses, account compromise and trusted access. |
| Finding a famous tool identifies the group. | Tools can be shared, copied or used legitimately. Attribution needs more evidence. |
| A quiet network means the actor has no objective. | Some access is valuable because it can be used later. |
| An operation must remain on one host for years to be persistent. | Persistence concerns continued pursuit of the mission, not a fixed duration on one device. |
| A firewall or antivirus product settles the problem. | Identity, application permissions, telemetry and operational response also matter. |
| A country or group label tells us everything about intent. | Assess the particular campaign, target and observed behaviour. |
Frequently asked questions
Are all APT groups state-sponsored?
Many well-documented APT profiles concern state-linked activity. However, the definition describes an adversary’s resources and sustained behaviour; it does not make the acronym itself proof of state sponsorship. Use the attribution established for the specific activity.
How long does an APT attack last?
There is no universal minimum duration that turns an intrusion into an APT operation. Distinguish the duration of an individual foothold, the incident visible to one victim and the broader campaign.
What is the difference between APT and malware?
APT describes an adversary and sustained activity. Malware is software. An actor can use several malware families, and some access can rely on legitimate accounts or administration capabilities.
Can a small organisation be affected?
Size alone does not establish relevance. A smaller organisation can hold valuable information or provide trusted access to a larger partner. Assess its role and exposure rather than assuming it is either safe or inevitably targeted.
Does using MITRE ATT&CK identify the attacker?
No. ATT&CK provides a common language for behaviour and public reporting. Matching a technique helps organise evidence, but many actors can use the same technique.
A short threat-intelligence glossary
| Term | Meaning |
|---|---|
| TTPs | Tactics, techniques and procedures: purposes, methods and concrete ways an actor carries them out. |
| IOC | Indicator of compromise: an observable associated with malicious activity. |
| C2 | Command-and-control: communications used to direct or interact with compromised systems. |
| LOTL | Living off the land: abuse of capabilities already available in the environment. |
| Persistence | Maintaining a foothold or a route back into an environment. |
| Lateral movement | Moving to additional systems or resources within an environment. |
| Exfiltration | Transferring information out of the environment without authorisation. |
| Attribution | An evidence-based assessment of responsibility for activity. |
Sources and further reading
This guide uses public reporting from government agencies, MITRE and researchers describing their own investigations. Historical cases retain their reporting dates. Sources and framework terminology were reviewed on 11 November 2026; group mappings and capabilities can change as new evidence becomes available.
Definitions and analytical frameworks
- NIST: advanced persistent threat
- MITRE ATT&CK: Groups and the limits of name overlap
- MITRE ATT&CK: Enterprise tactics
Group profiles and documented cases
- MITRE: APT29
- NCSC and partners: SVR initial cloud access, February 2024
- Microsoft: Midnight Blizzard responder guidance, January 2024
- Mandiant: APT41’s dual espionage and financial operations, 2019
- Mandiant: APT41 Has Arisen From the DUST, July 2024
- MITRE: Volt Typhoon
- CISA and partners: critical-infrastructure advisory AA24-038A, 2024
- MITRE: Lazarus Group
- FBI: North Korean Bybit theft and the TraderTraitor label, February 2025
- MITRE: Sandworm
- ESET: Industroyer2 investigation, April 2022
- MITRE: MuddyWater
- CISA and partners: MuddyWater advisory AA22-055A, 2022
Tools, techniques and defensive guidance
- MITRE: Phishing
- MITRE: Valid Accounts
- MITRE: PowerShell
- MITRE: Cobalt Strike
- MITRE: Mimikatz
- MITRE: Web Shell
- NSA: joint guidance on living-off-the-land intrusions, February 2024
- CISA: joint event-logging guidance announcement, August 2024
Related DaySec guides
