Skip to main content

Mastering the Intelligence Lifecycle - Cybrary

Advanced Cyber Threat Intelligence

1. Introduction to the Intelligence Lifecycle

The course begins by outlining the intelligence lifecycle, a structured approach comprising:

  • Collection: Gathering raw data from various sources.
  • Processing: Organizing and structuring the collected data.
  • Analysis: Interpreting processed data to generate actionable intelligence.
  • Dissemination: Sharing intelligence with relevant stakeholders.

This framework ensures a systematic method for developing and leveraging threat intelligence programs.

2. Data Collection Sources

Effective threat intelligence begins with robust data collection from both internal and external sources:

Internal Sources:

  • Endpoint Logs: Data from devices within the organization.
  • Network Traffic: Information from firewalls, routers, and switches.
  • Security Tools: Outputs from SIEMs, IDS/IPS, and antivirus solutions.

External Sources:

  • Private Feeds: Subscription-based services like Recorded Future or Anomali.
  • Community Sharing: Information from ISACs and ISAOs.
  • Public Data: Open-source intelligence (OSINT) from platforms like VirusTotal or Shodan.
Example: An organization might use internal firewall logs to detect unusual outbound traffic and correlate this with external threat feeds to identify potential command-and-control (C2) communications.
Example: A security team may gather IOCs (Indicators of Compromise) from their SIEM (internal) and compare them with OSINT sources like Abuse.ch (external) for validation.

3. Processing and Data Management

Raw data must be processed to extract meaningful insights:

  • Standardization: Utilizing formats like STIX and TAXII to ensure consistency.
  • Scoring Systems: Applying CVSS (Common Vulnerability Scoring System) to assess the severity of vulnerabilities.
Example: By converting diverse threat data into STIX format, analysts can more easily share and interpret information across different platforms and organizations.

4. Analysis Techniques

This is the core of the course and emphasizes the importance of deep, structured analysis.

Structured Analytic Techniques:

  • ACH (Analysis of Competing Hypotheses): Evaluating multiple hypotheses to determine the most probable explanation.
  • Cyber Kill Chain: Understanding attack stages to disrupt adversaries (e.g., Reconnaissance → Delivery → Exploitation).
  • Diamond Model: Maps adversary, victim, infrastructure, and capability relationships.

Campaign Analysis:

  • MITRE ATT&CK Framework: Mapping adversary tactics and techniques to understand behavior patterns.
  • Heatmaps and Visualizations: Identifying trends and anomalies in attack data.

Visual Analysis

Visual Analysis is a technique used by cyber threat analysts to detect patterns, anomalies, and relationships in large datasets by representing the data visually. Instead of reviewing long logs or tables, visual tools allow analysts to quickly interpret complex attack data and identify potential threats more efficiently.

Real-World Example:

Imagine a SOC team investigating a series of login attempts. Instead of combing through thousands of log entries, they use a heatmap that highlights login activity by time and location. This immediately reveals that most logins are from internal IPs, but there’s a suspicious spike from a foreign country at 3 AM, which could indicate a brute-force or credential stuffing attempt.

Tools Often Used:

  • Maltego – for mapping relationships between actors and infrastructure.
  • ELK Stack (Elasticsearch, Logstash, Kibana) – for visualizing logs and timelines.
  • MITRE ATT&CK Navigator – to track adversary techniques across campaigns.

Course of Action (CoA)

In the Course of Action step, analysts and defenders recommend specific defensive or responsive actions based on the findings from threat intelligence. These actions are tied closely to where the adversary is in the Cyber Kill Chain and the nature of their tactics.

Real-World Example:

If an organization detects a phishing campaign that leads to credential theft (Delivery → Exploitation in the Kill Chain), a recommended course of action might include:

  • Blocking the phishing domain.
  • Resetting affected user passwords.
  • Deploying Multi-Factor Authentication (MFA).
  • Educating employees on phishing recognition.

The Diamond Model can also assist by analyzing the adversary, their infrastructure, capabilities, and the victim profile to suggest targeted responses.

Example: A campaign using phishing and credential dumping techniques can be tracked using ATT&CK to predict the next steps.
Example: During the analysis of a phishing campaign, ACH can help determine whether the observed activities align more closely with financially motivated cybercriminals or state-sponsored actors.

5. Attribution and Bias Management

Attributing cyberattacks to specific actors involves careful consideration:

  • Attribution Challenges: Similar tools and techniques can be used by different threat actors.
  • Cognitive Biases: Awareness of biases like confirmation bias is crucial.
  • Logical Fallacies: Avoiding flawed reasoning that leads to false conclusions.

Nation-State Attribution

Nation-State Attribution is the process of linking a cyberattack to a state-sponsored actor. This is particularly complex and sensitive because it involves geopolitical implications and requires strong, corroborated evidence. Analysts typically use a combination of malware signatures, TTPs (Tactics, Techniques, and Procedures), infrastructure, and historical context.

Real-World Example:

A ransomware variant is discovered in a bank’s network. The malware uses custom encryption routines and communicates with C2 servers linked to known infrastructure used by a group like APT28 (Fancy Bear). These are linked through:

  • Malware code similarity.
  • Infrastructure re-use (same domains or IPs).
  • Timezone-based activity patterns.

The analysis might suggest Russia-based nation-state involvement, but analysts must avoid jumping to conclusions due to false flag tactics — where attackers mimic other groups to mislead attribution.

Example: Jumping to conclusions based on previous incidents without verifying data can lead to false positives.
Example: The presence of a particular malware strain should not automatically result in attributing an attack to a known group without supporting evidence.

6. Dissemination and Feedback

The final stage of the lifecycle involves sharing intelligence and gathering feedback.

Intelligence Types:

  • Tactical Intelligence: Short-term, technical details like IPs and malware hashes.
  • Operational Intelligence: Information about ongoing campaigns or TTPs.
  • Strategic Intelligence: High-level analysis for decision-makers.

Sharing Intelligence:

  • Collaboration with other organizations enhances defense.
  • Feedback improves future data collection and analysis.
Example: Sharing IOC data with a sector-specific ISAC can help identify industry-wide threats.
Example: A strategic report highlighting emerging ransomware trends can inform executive decisions on investing in backup and recovery solutions.

Reference: Screenshots and course summary content taken from Advanced Cyber Threat Intelligence - LinkedIn Learning.

Labels:

Comments

Post a Comment

Please do not enter any spam link here.

Popular posts from this blog

How to Pass CompTIA Security+ SY0-701 in 2 Months (839 Score Breakdown + Resources)

How I Scored 839/900 on CompTIA Security+ SY0-701 — 2-Month Prep Strategy That Actually Worked Score: 839/900  |  Exam: CompTIA Security+ SY0-701  |  Prep Time: 2 Months  |  Total Questions: 76 (including 3 PBQs) I'm not going to sugarcoat it — CompTIA Security+ is not easy, but it is very passable with the right strategy. I cleared it with an 839 out of 900, and in this post I'll share exactly how I did it, domain by domain, so you can replicate the approach without wasting time. My 2-Month Study Plan Month 1 — Domain-by-domain study: Read, take notes, and build comparison tables and mnemonics for tricky concepts. Month 2 — Heavy practice testing: Full focus on practice tests and PBQ simulations. Time management drills every session. The biggest mistake people make is spending 90% of their time reading and only 10% practicing. I flipped that in month 2 — and it made all the difference. Domain 1 — General Security Concepts What to focu...
Post a Comment
Read more

How to Protect ourselves from Online Banking frauds: Tips & Ticks

Awareness is necessity Nowadays, Online banking frauds are increasing day by day, and awareness about Internet use, Internet Security and cyber crime can be helpful in mitigating cyber crime. So here I am sharing some security guidelines you should follow during bank transactions as given by Delhi Police. Safe Bank Transaction Tips: Always do banking transactions on self-computer and mobile devices, installed with original operating system. Use the latest Antivirus software in order to detect and stay protected from most of the threats and vulnerabilities in the applications installed on computers. Never disclose ATM PIN codes and OTP “One Time Password” sent by the bank through SMS or on Email with anyone, even if he is an employee at the bank, as bank never ask you about the codes of your account or any credit card details. Avoid using public computers for making banking transactions. Avoid electronic banking transactions if you are connected to the Internet via...
Post a Comment
Read more

OLX fraud : Beware of this new fraud/scam of 'Army men'

Awareness is necessity Nowadays, OLX related frauds are increasing, such as share OLX password/OTP, QR code scams, Paytm link scam etc. The most occurring cases are related to Army personnel. Instead of writing all the things, it will be better to watch the video by a YouTuber, Mr. Rohit R Gaba and lets see How fraudster makes fools to people as Army personnel. Here, in the video, the fraudster talked about QR code. Let's understand what a QR code is and how fraud can be occurred by QR code. QR code ( Quick Response code ), We can store so much information within it in text form. I made one QR code that stores information such as a person's name, aadhar card number, etc. We can store any data with the QR code. Same fraudster store bank details and malicious code so that when you scan that QR code, the money will be debit from the account directly. How to protect ourselves from online OLX frauds? Always prefer face to face meetings with buyers or sellers and ...
Post a Comment
Read more

Every SOC Analyst Must Know These Windows Event IDs — Here's Why

Imagine you are the security guard of a massive office building. Every time someone enters, leaves, opens a cabinet, or tries to break in — it gets recorded in a logbook. Now imagine if that logbook could automatically tell you when something suspicious happened. That is exactly what Windows Event Logs are — the logbook of your Windows system, and for a SOC analyst, it is the single most important source of truth. In this blog, we will break down Windows Event Logs from scratch — what they are, how to read them, how to query them like a pro using PowerShell, and most importantly, which Event IDs you must memorize for your SOC analyst interview. Let's dive in. 1. What Are Windows Event Logs? Windows Event Logs are records that Windows automatically creates whenever something significant happens on the system — a user logs in, a service crashes, a file is accessed, an audit policy changes, a script runs. Think...
Post a Comment
Read more

Protecting Yourself from Vishing & Smishing frauds in India

Awareness is necessity Vishing & Smishing fraud is a type of scam that involves the use of text messages and Voice calls to trick individuals into revealing sensitive personal information such as bank account details, passwords, and credit card numbers. This type of fraud has become increasingly common in India, with many people falling victim to these scams every year. In this blog, we will discuss what Vishing & Smishing frauds are, how it works, and what steps you can take to prevent falling victim to these scams. What is Vishing & Smishing Fraud? Vishing & Smishing fraud is a type of social engineering scam that involves the use of text messages and Voice calls to trick individuals into revealing sensitive personal information. The term "vishing" is a combination of "voice" and "phishing," which refers to the use of voice calls to trick individuals into revealing personal information. In "Smishing" fraud, scammers use t...
Post a Comment
Read more

A new WhatsApp Scam : Amazon's 30th anniversary celebration free gifts!

Awareness is necessity One of my friend sent a message yesterday asking me to take a survey to claim free gifts as part of Amazon’s 30th Anniversary celebration. Did you receive this kind of message ? If yes then beware !!! It’s a new whatsapp scam. " Letme inform you first that according to WIKIPEDIA Jeff Bezos founded Amazon in July 1994. Now count the years . It's only 26 years. And here in the title they mentioned a 30th anniversary celebration. There are several ways to identify the link whether it is original or fake. When users click on the message, a new window opens saying “Congratulations, you have been chosen to participate in our survey”. Users are asked to answer four questions. After the user submits the answers , Bunch of gift boxes appears on the screen asking user to make a selection. In most cases it is the Huawei Mate 40 pro . I marked red squares on screenshots , when you try to click on that button or sign-in la...
Post a Comment
Read more