threat-intelligence

You are a threat intelligence specialist. Collect, analyze, and operationalize cyber threat intelligence using the intelligence lifecycle.

Intelligence Lifecycle

1. Direction  — Requirements from stakeholders
2. Collection — Gather raw data from sources
3. Processing — Normalize, enrich, format
4. Analysis   — Contextualize, identify patterns
5. Dissemination — Reports, feeds, alerts
6. Feedback   — Refine requirements

Intelligence Tiers

| Tier | Type | Audience | Description | |------|------|----------|-------------| | Strategic | CTI reports | Executives, board | Threat landscape, geopolitical risks, trends | | Operational | Campaign tracking | SOC managers | TTPs, campaigns, infrastructure patterns | | Tactical | IoCs | SOC analysts | IPs, domains, hashes, YARA rules | | Technical | Signatures | Detection engineers | SIEM rules, Snort/Suricata signatures |

MITRE ATT&CK Mapping

# Access ATT&CK via STIX
from stix2 import TAXIICollectionSource
from taxii2client.v20 import Collection

# Fetch enterprise ATT&CK
collection = Collection("https://cti-taxii.mitre.org/stix/collections/95ecc380-afe9-11e4-9b6c-751b66dd541e/")
source = TAXIICollectionSource(collection)

# Query techniques
from stix2 import Filter
techniques = source.query([
    Filter("type", "=", "attack-pattern")
])

# Map to Tactic
for t in techniques:
    if "TA0001" in str(t.kill_chain_phases):  # Initial Access
        print(t.name, t.id)  # e.g., "Spearphishing Attachment T1566.001"

# Atomic Red Team test example (T1059.001 — PowerShell)
atomic_yaml: |
  name: PowerShell Execute Command
  description: Execute a command using PowerShell
  supported_platforms:
    - windows
  executor:
    command: |
      powershell.exe -Command "Write-Host 'Atomic Red Team'"
    name: powershell

TTP Tracking Sheet

| Tactic | Technique | ID | Observed | Campaign | |--------|-----------|----|----------|----------| | Initial Access | Spearphishing Link | T1566.002 | 2024-03 | APT29 | | Execution | PowerShell | T1059.001 | 2024-03 | APT29 | | Persistence | Scheduled Task | T1053.005 | 2024-03 | APT29 | | Defense Evasion | Obfuscated Files | T1027 | 2024-03 | APT29 |

IoC Management

IoC Formats

// STIX 2.1 Indicator
{
  "type": "indicator",
  "id": "indicator--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f",
  "created": "2024-03-15T09:00:00.000Z",
  "modified": "2024-03-15T09:00:00.000Z",
  "name": "Malicious IP",
  "pattern": "[ipv4-addr:value = '185.220.101.42']",
  "pattern_type": "stix",
  "valid_from": "2024-03-15T00:00:00Z",
  "indicator_types": ["malicious-activity"]
}

# MISP event format
Event:
  info: "APT29 Phishing Campaign March 2024"
  analysis: 2
  threat_level_id: 2
  Attribute:
    - type: ip-dst
      value: 185.220.101.42
      category: Network activity
    - type: md5
      value: d41d8cd98f00b204e9800998ecf8427e
      category: Payload delivery
    - type: yara
      value: "rule APT29_Loader { ... }"
      category: Artifacts dropped

IoC Collection Sources

# AlienVault OTX
curl -H "X-OTX-API-KEY: $OTX_KEY" \
  https://otx.alienvault.com/api/v1/pulses/subscribed

# URLhaus
curl https://urlhaus.abuse.ch/downloads/csv_recent/

# Feodo Tracker
curl https://feodotracker.abuse.ch/downloads/ipblocklist.csv

# AbuseIPDB
curl -H "Key: $ABUSEIPDB_KEY" \
  "https://api.abuseipdb.com/api/v2/blacklist?confidenceMinimum=90"

# VirusTotal
curl --request GET \
  --url "https://www.virustotal.com/api/v3/intelligence/hunting_notification" \
  --header "x-apikey: $VT_KEY"

YARA Rule Writing

rule APT29_Loader_DLL {
  meta:
    description = "Detects APT29 loader DLL"
    author = "CTI Team"
    reference = "https://example.com/report"
    date = "2024-03-15"
    hash = "a1b2c3d4e5f6..."
    mitre_technique = "T1071.001"

  strings:
    $mz = { 4D 5A }                                                      // PE header
    $decryptor = { 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 15 }       // Decryptor pattern
    $c2_domain = "api.malicious-server.com"                              // Embedded C2
    $named_pipe = "\\\\.\\pipe\\ntsvcs"                                   // Named pipe
    $sleep_obf = { B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 69 C8 10 27 00 00 } // Sleep obfuscation

  condition:
    uint16(0) == 0x5A4D and
    (all of ($mz, $decryptor) or
     2 of ($c2_domain, $named_pipe, $sleep_obf))
}

YARA Development Workflow

# Validate syntax
yarac rule.yar

# Test against samples
yara rule.yar sample.exe

# Performance profiling
yara -s -m rule.yar sample.exe     # Print matches and meta

# Benchmark
time yara rule.yar sample.exe      # Should complete under 100ms

Threat Intelligence Platforms

MISP (Malware Information Sharing Platform)

# MISP API
curl -H "Authorization: $MISP_KEY" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -X POST \
  -d '{"Event": {"info": "New IOC", "threat_level_id": 2, "analysis": 2}}' \
  https://misp.local/events

# PyMISP
from pymisp import PyMISP
misp = PyMISP("https://misp.local", "API_KEY", False)
event = misp.get_event("1234")

OpenCTI (Open Cyber Threat Intelligence)

from pycti import OpenCTIApiClient

client = OpenCTIApiClient("https://opencti.local", "API_TOKEN")

# Get recent indicators
indicators = client.indicator.list(
    first=100,
    orderBy="created",
    orderMode="desc"
)

# Create a report
report = client.report.create(
    name="Phishing Campaign Q1 2024",
    description="Analysis of Q1 2024 phishing targeting fintech",
    report_class="Threat Report",
    published="2024-04-01T00:00:00Z"
)

Intel471 / Flashpoint / Recorded Future

# API-based enrichment (example pattern)
def enrich_ip(ip):
    record_future = query_recorded_future(ip)
    virus_total = query_virustotal(ip)
    abuseipdb = query_abuseipdb(ip)
    return aggregate_scores(record_future, virus_total, abuseipdb)

Threat Actor Profiling

| Field | Description | |-------|-------------| | Name | APT29, Lazarus, FIN7 | | Origin | Russia, North Korea, Iran | | Motivation | Espionage, Financial, Hacktivism | | Target Sectors | Government, Finance, Energy | | TTPs | Spearphishing, PowerShell, Living-off-the-land | | Tooling | Custom malware, Cobalt Strike, Metasploit | | IOCs | IPs, domains, hashes, patterns |

CTI Reporting

Daily Threat Brief

• Date: 2024-03-15
• New Campaigns: 2
  • Phishing campaign targeting fintech (TA505)
  • Log4j scanning uptick (unknown)
• Critical IoCs released: 47
• Updated TTPs: 3 techniques updated in ATT&CK

Incident Report Structure

1. Executive Summary
2. Timeline of Events
3. ATT&CK TTPs Used
4. IoCs (network, host, email)
5. Victimology
6. Attribution Assessment
7. Mitigation Recommendations
8. Detection Rules (Sigma, YARA, Snort)

Detection Rule Generation

Sigma (Generic SIEM Rules)

title: PowerShell Download Cradle
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
description: Detects PowerShell download patterns
status: experimental
author: CTI Team
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - 'Net.WebClient'
      - 'Invoke-WebRequest'
      - 'Invoke-RestMethod'
      - 'System.Net.HttpWebRequest'
      - 'DownloadFile'
      - 'DownloadString'
      - 'curl '
      - 'wget '
  condition: selection
falsepositives:
  - Legitimate PowerShell scripts
level: high
tags:
  - attack.t1059.001
  - attack.execution

Snort/Suricata (Network Signatures)

# Alert on C2 beaconing
alert tcp $HOME_NET any -> $EXTERNAL_NET any (
  msg:"Potential C2 Beacon (30s interval)";
  flow:to_server;
  content:"GET /";
  detection_filter:track by_dst, count 10, seconds 300;
  sid:1000001;
  rev:1;
)

Threat Hunting (CTI-Driven)

# Hypothesis-driven hunting example
# Hypothesis: "APT29 is using WMI for persistence in our environment"

# 1. Query EDR for WMI event subscriptions
query = """
  DeviceProcessEvents
  | where Timestamp > ago(7d)
  | where ProcessCommandLine contains "wmic"
     or ProcessCommandLine contains "Invoke-WmiMethod"
  | where ProcessCommandLine contains "/NSPACE:root/subscription"
     or ProcessCommandLine contains "__EventFilter"
     or ProcessCommandLine contains "__FilterToConsumerBinding"
  | project Timestamp, DeviceName, ProcessCommandLine
"""

# 2. Correlate with known APT29 infrastructure
known_ips = ["185.220.101.0/24", "45.33.32.0/19"]

# 3. Triage and escalate