← All cheat sheets

CYBER THREAT INTELLIGENCE

Plain-text reference · 7 KB. Read it, search it (Ctrl-F) or print it.

Cyber Threat Intelligence (CTI) is evidence-based knowledge about threats used
to inform decisions. This is a defensive reference: the frameworks, standards,
and sharing formats a blue team uses to produce, score, and exchange intel.
For enrichment lookups (VirusTotal, AbuseIPDB, GreyNoise) see IOC-ENRICHMENT;
for TTP mapping see MITRE-ATTACK.

LEVELS OF INTELLIGENCE#

Strategic    # risk/trends for leadership; non-technical, long horizon
Operational  # campaigns, actor intent & capability; informs defence planning
Tactical     # TTPs (how actors operate); maps to ATT&CK, drives detections
Technical    # atomic IOCs (hashes, IPs, domains); short-lived, machine-speed

THE INTELLIGENCE CYCLE#

1 Direction     # define requirements (PIRs - priority intelligence reqs)
2 Collection    # gather from feeds, OSINT, telemetry, sharing groups
3 Processing    # normalise, deduplicate, translate into a common format
4 Analysis      # turn data into assessed intelligence (the hard part)
5 Dissemination # deliver to the right consumer in a usable form
6 Feedback      # did it meet the requirement? refine and repeat

PYRAMID OF PAIN (David J. Bianco, 2013)#

How much pain you cause the adversary by denying each indicator type.
Bottom = trivial for them to change, top = costly.
  TTPs                       # tough!   - behaviour; forces re-tooling
  Tools                      # challenging
  Network / Host Artifacts   # annoying
  Domain Names               # simple
  IP Addresses               # easy
  Hash Values                # trivial  - one byte changes the hash
Lesson: detections built on TTPs outlast those built on atomic IOCs.

CORE ANALYTIC FRAMEWORKS#

Cyber Kill Chain (Lockheed Martin, 7 phases):
  Reconnaissance > Weaponization > Delivery > Exploitation >
  Installation > Command & Control (C2) > Actions on Objectives
Diamond Model (Caltagirone/Pendergast/Betz): every event has four features -
  Adversary, Capability, Infrastructure, Victim (+ meta: timestamp, phase...)
MITRE ATT&CK: tactics/techniques for tactical intel (see MITRE-ATTACK)
F3EAD (intel-driven ops): Find, Fix, Finish, Exploit, Analyze, Disseminate

INDICATORS#

IOC  = Indicator of Compromise - artefact of an intrusion (hash, IP, domain)
IOA  = Indicator of Attack - behaviour showing intent (not just an artefact)
Prefer IOAs + TTPs over atomic IOCs; IOCs age fast and cause false positives.
Common IOC types:
  file hash (MD5/SHA-1/SHA-256), IPv4/IPv6, domain, URL, email address,
  X.509 cert fingerprint, mutex, registry key, JA3/JA4 TLS fingerprint,
  user-agent, YARA/Sigma rule (behavioural)

STIX 2.1 (OASIS Standard - the data model)#

STIX = Structured Threat Information eXpression. JSON. Current version 2.1.
Object families:
  SDO  STIX Domain Objects - the "nouns" (18), e.g.:
       attack-pattern, campaign, course-of-action, grouping, identity,
       indicator, infrastructure, intrusion-set, location, malware,
       malware-analysis, note, observed-data, opinion, report,
       threat-actor, tool, vulnerability
  SRO  STIX Relationship Objects - relationship, sighting (the "verbs")
  SCO  STIX Cyber-observable Objects - file, ipv4-addr, domain-name, url...
  Meta marking-definition (TLP), language-content, extension-definition;
       objects ship wrapped in a bundle (the bundle is not itself an SDO)
indicator uses the STIX patterning language, e.g.:
  [file:hashes.'SHA-256' = 'aec070...']
  [ipv4-addr:value = '198.51.100.23']   # RFC 5737 example range
Every SDO/SRO: type, spec_version, id (type--UUID), created, modified.
(SCOs have no created/modified; marking-definition only has created.)

TAXII 2.1 (OASIS Standard - the transport)#

TAXII = Trusted Automated eXchange of Intelligence Information.
RESTful over HTTPS; carries STIX. Media type:
  application/taxii+json;version=2.1
Endpoints (producer side):
  GET /taxii2/                     # Discovery - lists API Roots
  GET /<root>/collections/         # list Collections
  GET /<root>/collections/<id>/objects/   # pull STIX objects
  POST .../objects/                # push (if writable)
  GET .../objects/<id>/versions/ , /manifest/ , /status/<id>
Collections = request/response sharing (poll for new objects since a marker).
Clients: MISP, OpenCTI, Anomali, ThreatConnect, most SIEMs can poll.

TLP 2.0 - TRAFFIC LIGHT PROTOCOL (FIRST, 2022)#

How far a recipient may share. TLP 2.0 labels:
  TLP:RED           # named recipients only; do not share
  TLP:AMBER+STRICT  # recipient org only
  TLP:AMBER         # recipient org and its clients/need-to-know
  TLP:GREEN         # community; not public
  TLP:CLEAR         # no sharing restriction, subject to standard copyright
                    #   (replaced the old TLP:WHITE)
Label in the subject/first line and on each STIX marking-definition.

SOURCE SCORING (ADMIRALTY / NATO SYSTEM)#

Rate source reliability and information credibility separately:
  Reliability  A..F  # A reliable ... F cannot be judged
  Credibility  1..6  # 1 confirmed ... 6 cannot be judged
e.g. "B2" = usually reliable, probably true. Avoid "A1" by reflex.
State confidence in words too (e.g. ODNI: high / moderate / low).

PLATFORMS#

MISP (open source):
  events -> attributes + objects; galaxies (incl. ATT&CK), taxonomies (incl.
  TLP), warninglists (reduce FPs on known-good), feeds, sightings,
  sharing groups, synchronisation (push/pull between instances)
OpenCTI (Filigran, open source):
  STIX 2.1-native knowledge graph; ingests via connectors; import/export
  STIX bundles and TAXII collections
MISP supports STIX 2.1 import/export, with TAXII via an add-on server
(misp-taxii-server); OpenCTI is STIX 2.1-native with TAXII connectors.
Commercial TIPs: Anomali, ThreatConnect, Recorded Future (out of scope).

THREAT-ACTOR NAMING (BEWARE DUPLICATION)#

Vendors name the same actor differently - always cross-map, never assume:
  Mandiant   APTxx / FINxx / UNCxxxx (uncategorised)
  CrowdStrike  animal by origin/category (BEAR=Russia, PANDA=China,
               KITTEN=Iran, CHOLLIMA=DPRK; SPIDER=eCrime, JACKAL=hacktivist)
  Microsoft    weather taxonomy since 2023 (e.g. *Typhoon, *Sandstorm)
Attribution is an assessment, not a fact. Keep confidence explicit and
separate observed activity from the named-actor conclusion.

GOOD PRACTICE#

- Drive collection from requirements (PIRs), not "collect everything".
- Prefer durable detections (TTPs/behaviour) over atomic IOCs.
- Record provenance, first/last-seen, and a confidence score on every IOC.
- Expire IOCs; stale indicators are a top source of false positives.
- Respect TLP on everything you receive before you reshare.
- Enrich before you act (see IOC-ENRICHMENT); one feed hit is not a verdict.

REFERENCES (verify against primary sources)#

STIX 2.1 / TAXII 2.1  OASIS CTI TC - docs.oasis-open.org (cti.github.io)
Pyramid of Pain       detect-respond.blogspot.com (D. Bianco, 2013)
Diamond Model         activeresponse.org / apps.dtic.mil
Cyber Kill Chain      lockheedmartin.com
TLP 2.0               first.org/tlp
ATT&CK                attack.mitre.org
MISP / OpenCTI        misp-project.org / docs.opencti.io

Defensive reference on CyberRamen. Offensive / red-team sheets live on OffensiveRamen.com.