🕵 APT Intelligence Tools

26 tools covering every aspect of threat intelligence for Indian SOC and CTI teams — from group reference databases to hunt query builders, all with India-specific context.

Reference & Analysis

APT India Reference

Complete database of APT groups targeting Indian government, defence, and critical infrastructure with TTPs and campaigns.

View database →

TTP Heatmap

Visual frequency heatmap of MITRE ATT&CK techniques used by India-targeting APTs. Prioritise your detection engineering.

View heatmap →

MITRE Comparison

Side-by-side ATT&CK technique comparison across up to three APT groups. Find shared techniques for highest-value detection rules.

Compare groups →

Malware Reference

APT-attributed malware families, capabilities, and detection indicators relevant to Indian sector organisations.

View reference →

LOLBin Reference

Living-off-the-land binaries used by APTs targeting India. Includes detection queries and defence guidance.

View LOLBins →

Credential Theft Reference

APT credential stealing techniques with MITRE mapping, detection indicators, and mitigation guidance.

View reference →

Detection & Hunting

Persistence Encyclopedia

All APT persistence mechanisms catalogued with examples, registry paths, and SIEM detection queries.

Browse encyclopedia →

Hunt Query Builder

Build threat hunt queries targeting specific APT TTPs. Outputs SPL and KQL ready to run against your SIEM.

Build hunt queries →

CTI to SIEM Converter

Convert threat intelligence IOCs and TTPs directly into SIEM detection rules in SPL or KQL format.

Convert CTI →

APT Recon Scanner

Detect APT reconnaissance activity patterns in logs. Identifies discovery TTPs used before lateral movement.

Scan for recon →

Memory Forensics Reference

APT memory-resident malware indicators and forensic artefacts. Guidance for memory acquisition and analysis.

View reference →

STIX Explorer

Browse structured APT threat intelligence in STIX format. Filter by group, sector, and technique.

Explore STIX →

Threat Modelling & Red Team

Diamond Model Builder

Build a Diamond Model of intrusion analysis for incident investigation and threat intelligence structuring.

Build model →

Purple Team Mapper

Map APT TTPs to red team test cases and blue team detection requirements for joint exercises.

Map exercises →

Red Team Mapper

Map your red team engagements to specific APT TTPs relevant to Indian sector threats.

Map TTPs →

APT Scenario Generator

Generate realistic APT attack scenarios for tabletop exercises, based on actual campaigns targeting India.

Generate scenario →

Attack Surface Analyser

Identify attack surface elements most relevant to APTs targeting your sector. Prioritise hardening efforts.

Analyse surface →

TI Maturity Assessment

Assess your threat intelligence programme maturity. Get a scored level with specific improvement recommendations.

Assess maturity →

Campaign Intelligence

Spearphish Profiler

Profile APT spearphishing campaigns targeting Indian sectors. Lure themes, infrastructure patterns, and detection.

Profile campaigns →

IOC vs IOA Reference

Understand the difference between indicators of compromise and indicators of attack. Guidance on when to use each.

Read reference →

Exfiltration Reference

APT data exfiltration techniques with MITRE mapping, volume estimates, and detection SPL/KQL queries.

View reference →

Dropper Reference

APT dropper and loader techniques — stager chains, persistence, and evasion used in India-targeting campaigns.

View reference →

C2 Reference

APT command and control techniques and infrastructure patterns. Detection guidance for each C2 category.

View reference →

Watering Hole Reference

APT watering hole attacks targeting Indian government and sector websites. Detection and mitigation guidance.

View reference →

Protocol Abuse Reference

APT protocol abuse and tunnelling techniques — DNS, HTTPS, SMB, and custom protocols used for C2 and exfil.

View reference →

APT vs Cybercrime

Distinguish targeted APT activity from commodity cybercrime. Decision framework for triage and attribution.

Read guide →

APT India Reference

Filter by Origin

TTP Frequency Heatmap

Frequency of MITRE ATT&CK techniques across all India-targeting APT groups. Darker = more groups use it.

Filter by APT Group

MITRE ATT&CK Group Comparison

Group 1

Group 2

Group 3 (optional)

APT Malware Reference

LOLBin Reference — APT Usage

Filter by LOLBin

Credential Theft Reference

Persistence Encyclopedia

Hunt Query Builder

APT Group

TTP Category

CTI to SIEM Converter

Paste IOCs or TTPs (one per line)

Target SIEM

APT Recon Scanner

Generate queries to detect APT reconnaissance activity in your logs before lateral movement begins.

Environment

Memory Forensics Reference

APT Indicators

Volatility Commands

Acquisition

STIX Intelligence Explorer

APT Group

Object Type

Diamond Model Builder

Adversary

Victim

Infrastructure

Capability

Activity (what happened)

Purple Team Mapper

APT Group

Focus Area

Red Team TTP Mapper

Target Sector

APT Scenario Generator

APT Group

Target Sector

Attack Surface Analyser

Organisation Sector

Internet-Facing Assets

TI Programme Maturity Assessment

IOC Collection & Processing 50%

TTP-Level Intelligence 50%

SIEM Integration 50%

Threat Hunting Capability 50%

Intelligence Sharing 50%

Spearphish Campaign Profiler

APT Group

IOC vs IOA Reference

APT Exfiltration Reference

APT Dropper & Loader Reference

C2 Techniques Reference

Watering Hole Attack Reference

Protocol Abuse & Tunnelling Reference

APT vs Cybercrime Decision Guide

APT Intelligence for Indian Cybersecurity Professionals

Advanced Persistent Threat (APT) groups are nation-state or state-sponsored cyber espionage and sabotage actors. Unlike opportunistic criminal actors, APT groups have specific geopolitical objectives and target specific sectors, geographies, and organisations over extended periods — often maintaining access for months or years before acting.

The groups most relevant to Indian organisations are: SideWinder (T-APT-04) — a Pakistan-linked group active since 2012 targeting Indian government, military, and defence contractors using spearphishing with RTF exploits; APT36 (Mythic Leopard) — another Pakistan-linked group targeting Indian military personnel with CrimsonRAT; SideCopy — mimicking SideWinder's techniques targeting Indian defence and government; Lazarus Group — North Korea-linked targeting Indian financial institutions; and Mustang Panda — China-linked targeting Indian government organisations.

The 26 tools in this section cover the full lifecycle of APT intelligence for Indian cybersecurity professionals — from understanding group profiles and TTPs, to building detection rules, to threat modelling your organisation's exposure, to hunting for historical activity in your logs.

Frequently Asked Questions

What is the difference between an APT group and a cybercriminal group?

APT groups are typically state-sponsored actors with long-term geopolitical objectives — espionage, IP theft, or sabotage. They are "persistent" because they maintain access over months or years. Cybercriminal groups are primarily financially motivated — ransomware, fraud, credential theft — and typically seek to monetise access quickly.

How does SideWinder typically compromise Indian targets?

SideWinder's most consistent initial access method is spearphishing emails with malicious RTF documents exploiting CVE-2017-11882 (Microsoft Equation Editor). When opened, the Equation Editor spawns a command shell that downloads a second-stage payload. Documents are crafted to appear as official government communications or defence-related notices.

What is MITRE ATT&CK and how is it relevant to APT tracking?

MITRE ATT&CK is a globally recognised knowledge base of adversary tactics, techniques, and procedures documented from real-world operations. It organises attack techniques across 14 tactical categories and documents which APT groups use each technique. The TTP Heatmap and MITRE Comparison tools on this page let you visualise which techniques India-targeting APTs use most frequently.

What is a LOLBin and why do APT groups use them?

LOLBin (Living Off the Land Binary) refers to legitimate Windows system tools that attackers use for malicious purposes to blend in with normal administrative activity. Examples include powershell.exe, certutil.exe, mshta.exe — all signed Microsoft binaries. APT groups favour LOLBins because security tools that block unsigned executables cannot block tools Windows itself ships. Detection requires behavioural analysis of how these tools are used.