APT attack detection methods
Cyberespionnage : the APT threat

Detecting this type of attack is difficult, and requires multiple methods on several levels.

Quite often, detection comes from a source outside the company. For example, government agencies, private companies or CERT/CSIRT (Computer Emergency Response Team / Computer Security Incident Response Team) structures notify "victim" companies. In the course of their incident response, these structures may come across elements that point to other victims. This could be malware containing strings linked to other companies, or domain names close to company names, etc.

In the end, detecting APT incidents always comes down to two things:

• detect malware or attacker tools on one or more company workstations or servers;

• detect communications between malware or tools and servers...