APT / Nation-State Intrusion

Advanced Persistent Threat activity by a sophisticated, well-resourced adversary characterized by long dwell time, custom tooling, stealthy persistence, and focused intelligence or strategic targeting.

Triage

2 procedures
P1

Characterize Adversary TTPs and Assess Attribution

~120 min
P1

Container Escape Detected

~90 min

Containment

2 procedures
P1

Isolate Compromised Kubernetes Workload

~120 min
P1

Contain Compromised Serverless Function

~90 min
Sponsored

Preservation

1 procedure
P2

Capture Cluster etcd Snapshot for Control-Plane Forensics

~60 min

Collection

2 procedures
P1

Collect Kubernetes Control-Plane Audit Trail

~120 min
P1

Collect Serverless Execution and Management Evidence

~90 min

Analysis

4 procedures
P2

Analyze the Supply-Chain Backdoor Payload

~240 min
P2

Hunt Historical Dwell Time and Hidden Persistence

~300 min
P2

Analyze Container Escape Primitives and Cluster-Wide Exposure

~240 min
P2

Analyze Cloud IAM Privilege Escalation

~240 min

Eradication

1 procedure
P1

Assume-Breach Rebuild and Identity Reset

~480 min

Post-Incident Review

1 procedure
P3

Threat-Intel Sharing and Sector Reporting

~240 min