Threat Intelligence: Operational Security Guide

Intelligence Levels:

• Strategic: Executive-level risk assessments
• Operational: TTPs and campaign analysis
• Tactical: IOCs (IPs, hashes, domains)
• Technical: Malware analysis and logs

Standard Models:

• MITRE ATT&CK: Adversary behavior matrix
• Diamond Model: Activity analysis
• Cyber Kill Chain: Attack lifecycle

Enterprise Example:

Microsoft Threat Intelligence maps APT groups to ATT&CK techniques

Primary Sources:

• Open Source (OSINT): VirusTotal, CVE databases
• Commercial Feeds: Recorded Future, Mandiant
• Internal Telemetry: SIEM, EDR, firewall logs
• Information Sharing: ISACs, MISP communities

STIX/TAXII Example:

{
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--a932fcc6-e032-476c-826f-cb970a5a1ade",
  "pattern": "[ipv4-addr:value = '192.0.2.1']",
  "valid_from": "2023-01-01T00:00:00Z",
  "kill_chain_phases": [
    {
      "kill_chain_name": "mitre-attack",
      "phase_name": "command-and-control"
    }
  ]
}
        

Analysis Techniques:

• Indicator Enrichment: WHOIS, passive DNS
• Campaign Tracking: Cluster related activity
• Threat Actor Profiling: Motivations, capabilities

Enterprise Tools:

• Threat Platforms: ThreatConnect, Anomali
• Sandboxes: Joe Sandbox, Cuckoo
• Automation: TheHive, Cortex

Case Study:

SolarWinds attribution used code similarities and infrastructure patterns

Implementation Points:

• SIEM: Automated IOC ingestion
• Firewalls/IPS: Block malicious IPs/domains
• EDR: Detect attacker TTPs
• Vulnerability Management: Prioritize patching

MITRE ATT&CK Mapping:

# Sigma rule for detecting Mimikatz
title: Mimikatz Command Line Arguments
description: Detects common Mimikatz arguments
tags:
  - attack.credential_access
  - attack.t1003
detection:
  selection:
    CommandLine|contains:
      - 'sekurlsa::'
      - 'kerberos::'
  condition: selection