The Cybersecurity and Infrastructure Security Agency (CISA) issued a primer to protect critical infrastructure due to heightened tensions with Iran. Organizations should adopt a state of heightened awareness and increase vigilance by monitoring security capabilities and identifying anomalous behavior. It is crucial to confirm reporting processes so personnel know how and when to report incidents. Exercising incident response plans ensures personnel are prepared and have the necessary access and knowledge. Iranian cyber threat actors, often linked to the Islamic Revolutionary Guard Corps (IRGC), have demonstrated increasingly sophisticated capabilities. Historically, Iran has engaged in activities ranging from DDoS attacks to data theft and destructive wiper malware. Examples include attacks on U.S. financial institutions, a New York dam's SCADA system, and the Sands Las Vegas Corporation. CISA recommends reducing vulnerability through disabling unnecessary ports and protocols, and enhancing network and email traffic monitoring. Patching externally facing equipment and logging PowerShell usage are also advised. Ensuring backups are up-to-date and air-gapped is a critical mitigation step. Mitigations for specific Iranian Advanced Persistent Threat techniques include managing access controls, disabling NTLM, and using unique passwords. Detection methods involve monitoring processes interacting with Isass.exe and using tools like AuditD for Linux. Strategies to combat obfuscated files, compressed data, PowerShell misuse, user execution, and scripting are provided, emphasizing monitoring, policy enforcement, and user training.