What is APT?

NIST's glossary describes an advanced persistent threat as "an adversary that possesses sophisticated levels of expertise and significant resources", able to use "multiple attack vectors including, for example, cyber, physical, and deception." The objectives it lists are the ones a SOC deals with: "establishing and extending footholds" in the target's infrastructure to exfiltrate information, to undermine part of its mission, or to be in position to do either later. The last part of the definition is where "persistent" comes from. The actor "pursues its objectives repeatedly over an extended period; adapts to defenders' efforts to resist it". For a defender, closing one ticket does not close the intrusion: remove one foothold and expect the actor to come back through another.

APT names the actor, not the malware

MITRE ATT&CK keeps two separate catalogs, Groups and Software. Groups are "activity clusters that are tracked by a common name in the security community", and the Groups page listed 182 of them when we checked in October 2026. Malware families and tools live under Software and link back to the groups reported to use them. The question "is APT a malware?" comes partly from vendor naming: ATT&CK notes that Sofacy and Sednit, two aliases of APT28, have been used in reporting "both to refer to the threat group and its associated malware." When a report says Sofacy, check which of the two it means.

ATT&CK also warns that one organization's group definition may only partly overlap another's, and it does not present aliases as exact matches. Mapping aliases across vendors is covered on the threat actor page. For triage, the useful part of a group entry is the list of techniques it has been seen using.

Two APT examples, as ATT&CK records them

Nearly every procedure in the last column is a normal action done by the wrong person: a login with a real password, a scheduled task with a Windows-looking name, an archive tool, an upload to a cloud service the company already allows. None of it needs a zero-day or exotic malware to reach your queue. The TTPs page explains why behavior outlasts tooling, and the MITRE ATT&CK guide shows how the technique IDs fit together.

What an APT looks like in triage telemetry

No single alert says APT. You get a run of low-severity events spread over days or weeks, each with an innocent explanation, which is what people mean by low and slow. These are the signals worth a second look, with the reason each one usually gets closed:

The last row is where an intrusion becomes data loss, and the exfiltration page covers what the transfer looks like on the network. Between the second and fourth rows you will usually also find lateral movement, which spreads the activity across several hosts and, in most SOCs, across several analysts' queues.

A simulated case: four closed tickets, one intrusion

Simulated example generated by SOCSimulator Research. The organization, accounts, hosts, addresses and times are invented; the event IDs and field names are Microsoft's.

Day 1   08:52  VPN     j.ortega  logon from 203.0.113.44, ASN never seen for this user     closed: MFA passed, user travelling
Day 4   02:47  WS-221  4702      \Microsoft\Windows\Defrag\ScheduledDefrag updated by j.ortega  closed: Windows maintenance task
Day 4   02:53  WS-221  4702      \Microsoft\Windows\Defrag\ScheduledDefrag updated by j.ortega  merged into the same ticket
Day 9   10:00  proxy   WS-221    rundll32.exe to a cloud storage API over HTTPS, every 30 min (+/- 40 s)  closed: allowed category
Day 18  23:05  FS03    xdr       7z.exe a -p[redacted] -mhe=on C:\ProgramData\upd.7z D:\Finance\*  no alert
Day 18  23:41  fw      FS03      198.51.100.20:443, 1.8 GB outbound, first contact                  escalated

Three different analysts closed the first three tickets, and each closure was reasonable on the data inside that ticket. What connects them is one account and one workstation. Day 4 was the moment to stop it. A defrag task changed at 02:47 by a person's account and changed again six minutes later matches the modify, run and restore procedure ATT&CK records for APT29. The second 4702 is the restore. Comparing the TaskContentNew field of the two events would have shown the command that ran in between.

This query looks for the same pattern across every host in Microsoft Sentinel:

// Same scheduled task updated two or more times on one host within an hour (event 4702)
SecurityEvent
| where TimeGenerated > ago(30d)
| where EventID == 4702
| extend TaskName = extract(@'<Data Name="TaskName">([^<]+)</Data>', 1, EventData)
| summarize Updates = count(), FirstUpdate = min(TimeGenerated), LastUpdate = max(TimeGenerated),
    Accounts = make_set(SubjectUserName) by Computer, TaskName
| where Updates >= 2 and LastUpdate - FirstUpdate < 1h
| order by LastUpdate desc

SecurityEvent has no task name column, so the query pulls TaskName out of EventData. Windows only logs event 4702 when the Audit Other Object Access Events subcategory is enabled. Patch nights produce legitimate pairs, so exclude your update windows and the accounts your deployment tooling runs as. What is left is short enough to read by hand, and any row with a person's account in Accounts deserves a look at the task content.

Detect by behavior, escalate on evidence

Attribution is not a tier-1 job, and it rarely changes what you do in the first hour. A ticket that says "possible APT29" sends the next analyst off to read the news. A ticket that says "valid account from a new ASN, scheduled task modified and restored on WS-221, periodic HTTPS from rundll32.exe (T1078, T1053.005, T1071.001)" gives them something to check. Write down the behavior and the technique IDs and leave the group name to threat intelligence.

Escalate to incident response when one host or account shows two different stages, such as a suspicious logon followed by a persistence change, or when you find a staged archive or an outbound transfer nobody can explain. Bring in CTI when an artifact matches a documented procedure (a task path, a C2 service, an archive naming habit), because they can tell you which groups use it and what usually follows. Pass the timeline to threat hunting as well, since the first host you found is seldom the only one. The indicators of attack page explains why behaviors like these stay useful long after a list of IPs has gone stale.