Module 19 of 20 — Professional Practice

Threat Intelligence & Analysis

Threat intelligence transforms raw data into actionable security insights. Understanding attacker TTPs, leveraging intelligence feeds, and applying structured analysis enables proactive defense against known and emerging threats.

MITRE ATT&CK Framework

ATT&CK catalogs real-world adversary behaviors as a matrix of tactics and techniques. Use it to map detections, identify gaps, and benchmark defenses.

Initial Access

Techniques to gain foothold in target environment.

Key Techniques:
Phishing (T1566)Valid Accounts (T1078)External Remote Services (T1133)Supply Chain Compromise (T1195)
Example:SolarWinds SUNBURST used supply chain compromise to distribute backdoored updates.

Execution

Run malicious code on target systems.

Key Techniques:
Command and Scripting Interpreter (T1059)User Execution (T1204)Native API (T1106)Scheduled Task/Job (T1053)
Example:Malware executing PowerShell scripts with encoded commands to evade detection.

Persistence

Maintain presence across reboots and credential changes.

Key Techniques:
Account Manipulation (T1098)Create or Modify System Process (T1543)Web Shell (T1505)External Remote Services (T1133)
Example:APT28 creates Windows scheduled tasks to ensure malware restarts after reboot.

Privilege Escalation

Gain higher-level permissions on systems.

Key Techniques:
Process Injection (T1055)DLL Search Order Hijacking (T1574)Unquoted Service Path (T1574)Access Token Manipulation (T1134)
Example:EternalBlue exploited Windows SMB vulnerability to gain SYSTEM privileges.

Defense Evasion

Avoid detection and hide activity.

Key Techniques:
Obfuscated Files/Information (T1027)Disable Security Tools (T1562)Process Hollowing (T1055)File Deletion (T1070)
Example:Maze ransomware used process injection and AMSI bypass to avoid EDR detection.

Credential Access

Steal account credentials for later use.

Key Techniques:
OS Credential Dumping (T1003)Keylogging (T1056)Brute Force (T1110)Two-Factor Authentication Interception (T1111)
Example:APT41 used Mimikatz to dump credentials from LSASS memory.

Discovery

Gather information about victim environment.

Key Techniques:
System Information Discovery (T1082)Network Share Discovery (T1135)Account Discovery (T1087)Process Discovery (T1057)
Example:Attackers enumerate AD domain controllers, user accounts, group memberships.

Lateral Movement

Move through network to reach target systems.

Key Techniques:
Remote Services (T1021)Pass the Hash (T1075)Internal Spearphishing (T1534)Remote Execution (T1050)
Example:NotPetya used PsExec and WMI to spread laterally across corporate networks.

Collection

Gather data of interest from target.

Key Techniques:
Data from Local System (T1005)Screen Capture (T1113)Audio Capture (T1125)Email Collection (T1114)
Example:Ransomware exfiltrates data before encryption for double extortion.

Exfiltration

Steal data from target environment.

Key Techniques:
Exfiltration Over C2 Channel (T1041)Automated Exfiltration (T1020)Transfer via Removable Media (T1052)
Example:FIN7 used HTTP/HTTPS C2 channels to slowly exfiltrate credit card data.

Impact

Disrupt availability or integrity of systems.

Key Techniques:
Data Encrypted for Impact (T1486)Service Stop (T1489)Network Denial of Service (T1498)Resource Hijacking (T1496)
Example:Colonial Pipeline DarkSide ransomware forced shutdown of fuel pipeline operations.

Threat Intelligence Lifecycle

Intelligence is a cycle, not a one-time effort. Each stage adds value and feeds the next.

Planning & Direction

Define intelligence requirements based on business risk and threat landscape.

  • What assets are high-value?
  • Which threat actors target our sector?
  • What TTPs should we detect?

Collection

Gather raw data from internal logs, external feeds, OSINT, sensors.

  • Network traffic (Zeek, Suricata)
  • Endpoint telemetry (EDR)
  • Threat feeds (FireEye, Mandiant, AlienVault)
  • Dark web monitoring
  • Honeypots

Processing

Normalize, enrich, correlate data to make it usable.

  • Parse logs to common schema (STIX/TAXII)
  • Enrich IOCs with geo/reputation
  • De-duplicate, normalize timestamps

Analysis

Identify patterns, assess relevance, produce actionable intelligence.

Dissemination

Deliver intelligence to stakeholders in usable formats.

Feedback

Measure effectiveness, refine requirements, close loop.

Threat Intelligence Sources

Select feeds based on coverage, timeliness, format compatibility, and cost.

AlienVault OTX

Open-source
Format:STIX/TAXII
Coverage:Broad, community-contributed IOCs
Use Case:Small teams, general threat awareness, blocking known bad IPs/domains.

MISP (Malware Information Sharing Platform)

Open-source platform
Format:MISP format, STIX
Coverage:Customizable—share within org or trusted community.
Use Case:ISAC/ISAO sharing, building internal threat intel platform.

Mandiant Advantage / FireEye

Commercial (premium)
Format:API, reports, TTP analysis
Coverage:APT-level intel, deep attribution analysis, vulnerability impact.
Use Case:Enterprises facing sophisticated adversaries, board-level reporting.

Recorded Future

Commercial
Format:API, dashboards, alerts
Coverage:Real-time dark web, geopolitical, technical intel.
Use Case:Proactive risk monitoring, brand protection, supply chain risk.

CISA Known Exploited Vulnerabilities (KEV) Catalog

Government
Format:CSV, JSON feed
Coverage:Vulnerabilities actively exploited in the wild.
Use Case:Prioritize patching—CISA binding operational directive requires federal agencies remediate KEV within specific SLAs.

Types of Threat Intelligence

Intelligence serves different audiences. Tailor format and content to consumers.

Strategic Intelligence

Audience: Executives, board members
Format: Briefings, risk dashboards, trend reports
Purpose: Inform business decisions, investment priorities, risk acceptance.
Example: Quarterly threat landscape report showing increased ransomware targeting healthcare.

Operational Intelligence

Audience: SOC analysts, incident responders
Format: IOCs, TTP profiles, alert rules, hunt hypotheses
Purpose: Enable detection, hunting, and incident response.
Example: YARA rules for new malware family, Sigma detection rules for specific ATT&CK techniques.

Technical Intelligence

Audience: Security engineers, forensics teams
Format: Malware hashes, C2 infrastructure, exploit code samples
Purpose: Technical implementation: block, detect, analyze.
Example: List of IPs, domains, SHA256 hashes from recent phishing campaign.

Tactical Intelligence

Audience: SOC, threat hunters
Format: ATT&CK technique mappings, behavioral analytics
Purpose: Improve detection coverage across MITRE framework.
Example: Mapping BlueAlpha group to ATT&CK T1078 (Valid Accounts) and associated detection hypotheses.

Key Takeaways

  • MITRE ATT&CK maps TTPs—use it to assess detection coverage and threat actor behavior.
  • Intelligence lifecycle (plan→collect→process→analyze→disseminate→feedback) structures delivery.
  • Strategic vs. technical intel serves different audiences—tailor outputs accordingly.
  • Actionable intelligence drives concrete security actions: blocks, hunts, patches, tool tuning.
Module 19 of 20
DevSecOps & Secure SDLCNext: Cybersecurity Careers