APT Intelligence Tools
26 tools covering every aspect of threat intelligence for Indian SOC and CTI teams -- from group reference databases to hunt query builders, all with India-specific context.
Reference & Analysis
APT India Reference
Complete database of APT groups targeting Indian government, defence, and critical infrastructure with TTPs and campaigns.
View database →TTP Heatmap
Visual frequency heatmap of MITRE ATT&CK techniques used by India-targeting APTs. Prioritise your detection engineering.
View heatmap →MITRE Comparison
Side-by-side ATT&CK technique comparison across up to three APT groups. Find shared techniques for highest-value detection rules.
Compare groups →Malware Reference
APT-attributed malware families, capabilities, and detection indicators relevant to Indian sector organisations.
View reference →LOLBin Reference
Living-off-the-land binaries used by APTs targeting India. Includes detection queries and defence guidance.
View LOLBins →Credential Theft Reference
APT credential stealing techniques with MITRE mapping, detection indicators, and mitigation guidance.
View reference →Detection & Hunting
Persistence Encyclopedia
All APT persistence mechanisms catalogued with examples, registry paths, and SIEM detection queries.
Browse encyclopedia →Hunt Query Builder
Build threat hunt queries targeting specific APT TTPs. Outputs SPL and KQL ready to run against your SIEM.
Build hunt queries →CTI to SIEM Converter
Convert threat intelligence IOCs and TTPs directly into SIEM detection rules in SPL or KQL format.
Convert CTI →APT Recon Scanner
Detect APT reconnaissance activity patterns in logs. Identifies discovery TTPs used before lateral movement.
Scan for recon →Memory Forensics Reference
APT memory-resident malware indicators and forensic artefacts. Guidance for memory acquisition and analysis.
View reference →STIX Explorer
Browse structured APT threat intelligence in STIX format. Filter by group, sector, and technique.
Explore STIX →Threat Modelling & Red Team
Diamond Model Builder
Build a Diamond Model of intrusion analysis for incident investigation and threat intelligence structuring.
Build model →Purple Team Mapper
Map APT TTPs to red team test cases and blue team detection requirements for joint exercises.
Map exercises →Red Team Mapper
Map your red team engagements to specific APT TTPs relevant to Indian sector threats.
Map TTPs →APT Scenario Generator
Generate realistic APT attack scenarios for tabletop exercises, based on actual campaigns targeting India.
Generate scenario →Attack Surface Analyser
Identify attack surface elements most relevant to APTs targeting your sector. Prioritise hardening efforts.
Analyse surface →TI Maturity Assessment
Assess your threat intelligence programme maturity. Get a scored level with specific improvement recommendations.
Assess maturity →Campaign Intelligence
Spearphish Profiler
Profile APT spearphishing campaigns targeting Indian sectors. Lure themes, infrastructure patterns, and detection.
Profile campaigns →IOC vs IOA Reference
Understand the difference between indicators of compromise and indicators of attack. Guidance on when to use each.
Read reference →Exfiltration Reference
APT data exfiltration techniques with MITRE mapping, volume estimates, and detection SPL/KQL queries.
View reference →Dropper Reference
APT dropper and loader techniques -- stager chains, persistence, and evasion used in India-targeting campaigns.
View reference →C2 Reference
APT command and control techniques and infrastructure patterns. Detection guidance for each C2 category.
View reference →Watering Hole Reference
APT watering hole attacks targeting Indian government and sector websites. Detection and mitigation guidance.
View reference →Protocol Abuse Reference
APT protocol abuse and tunnelling techniques -- DNS, HTTPS, SMB, and custom protocols used for C2 and exfil.
View reference →APT vs Cybercrime
Distinguish targeted APT activity from commodity cybercrime. Decision framework for triage and attribution.
Read guide →Why threat intelligence is different for organisations operating in India.
Advanced Persistent Threat (APT) groups are nation-state or state-sponsored cyber espionage and sabotage actors. Unlike opportunistic criminal actors who target any vulnerable organisation for financial gain, APT groups have specific geopolitical objectives and target specific sectors, geographies, and organisations over extended periods — often maintaining access for months or years before acting. For Indian organisations, threat intelligence is not about tracking all global APT activity. It is about understanding which specific groups have India in their targeting mandate, what sectors they focus on, what techniques they use, and what their infrastructure looks like — so that detections can be precisely calibrated.
The groups most relevant to Indian organisations are: Sidewinder (T-APT-04) — a Pakistan-linked group active since 2012 targeting Indian government, military, and defence contractors using spearphishing with RTF exploits; APT36 (Mythic Leopard) — another Pakistan-linked group targeting Indian military personnel with CrimsonRAT malware; SideCopy — a Pakistan-linked group mimicking Sidewinder's techniques targeting Indian defence and government; Lazarus Group — a North Korea-linked group targeting Indian financial institutions and cryptocurrency exchanges; and Mustang Panda — a China-linked group that has targeted Indian government organisations.
The 26 tools in this section cover the full lifecycle of APT intelligence for Indian cybersecurity professionals — from understanding group profiles and their TTPs, to building detection rules targeting their specific techniques, to threat modelling your organisation's exposure, to hunting for historical activity in your logs. All tools include India-specific context that generic global threat intelligence platforms typically lack.
Frequently asked questions — APT intelligence
What is the difference between an APT group and a cybercriminal group?
APT (Advanced Persistent Threat) groups are typically state-sponsored or state-directed actors with long-term geopolitical objectives — espionage, intellectual property theft, or sabotage of critical infrastructure. They are "persistent" because they maintain access over months or years and return after being evicted. Cybercriminal groups are primarily financially motivated — ransomware, fraud, credential theft — and typically seek to monetise their access quickly. Many Indian organisations face both: APT groups targeting sensitive government or defence data, and criminal groups targeting financial systems and customer data.
How does Sidewinder typically compromise Indian targets?
Sidewinder's most consistent initial access method is spearphishing emails with malicious RTF documents exploiting CVE-2017-11882, a vulnerability in Microsoft's Equation Editor component (EQNEDT32.EXE). When the document is opened, the Equation Editor spawns a command shell that downloads a second-stage payload. Documents are crafted to appear relevant to the target — official government communications, defence-related notices, or policy documents. Despite the vulnerability being patched in 2017, it remains effective against many Indian government systems running unpatched Office versions.
What is MITRE ATT&CK and how is it relevant to APT tracking?
MITRE ATT&CK is a globally recognised knowledge base of adversary tactics, techniques, and procedures documented from real-world cyber operations. It organises attack techniques across 14 tactical categories — from Initial Access through to Impact — and documents which specific APT groups use each technique. For SOC teams, ATT&CK provides a common language for describing threats and a structured framework for measuring detection coverage. The TTP heatmap and MITRE Comparison tools on this page let you visualise which techniques India-targeting APT groups use most frequently, so you can prioritise detection engineering accordingly.
What is a LOLBin and why do APT groups use them?
LOLBin (Living Off the Land Binary) refers to legitimate Windows system tools that attackers use for malicious purposes to blend in with normal administrative activity and evade detection. Examples include powershell.exe, certutil.exe, mshta.exe, and wscript.exe — all signed Microsoft binaries present on every Windows system. APT groups favour LOLBins because security tools that block unsigned executables or unfamiliar applications cannot block tools that Windows itself ships. Detection requires behavioural analysis of how these tools are being used, not just their presence.