Threat Intelligence and Threat Hunting

Threat intelligence is evidence-based knowledge about existing or emerging threats to assets, including context, mechanisms, indicators, implications, and actionable advice. It exists to transform raw data into decision-ready information that reduces uncertainty and enables proactive defense. Without threat intelligence, security teams operate reactively, relying on signature-based detection that only catches known threats after they have been seen elsewhere. Intelligence provides the 'why' and 'what next' behind indicators, enabling prioritization and customized defenses.

The standard threat intelligence lifecycle consists of six phases: - Requirements: Define what intelligence is needed (e.g., 'Are APT groups targeting our industry with spear-phishing?'). - Collection: Gather raw data from sources like open-source feeds, dark web forums, ISACs, vendor reports, and internal telemetry. - Processing: Convert raw data into usable formats (e.g., normalize IOCs, translate foreign language posts). - Analysis: Apply human reasoning to identify patterns, attribution, and implications. This produces finished intelligence. - Dissemination: Deliver intelligence to consumers (SOC analysts, hunters, executives) in appropriate formats (e.g., STIX/TAXII feeds, email bulletins). - Feedback: Consumers provide feedback on relevance and accuracy, refining future requirements.

IOCs are forensic evidence that a breach has occurred (e.g., a file hash of a known malware). IOAs are real-time behaviors that suggest an attack is in progress (e.g., a process spawning cmd.exe with unusual arguments). The exam emphasizes that IOAs are more proactive because they detect attacks before data exfiltration, while IOCs confirm a breach after the fact.

STIX is a standardized language (XML/JSON) for describing threat intelligence, including observables, indicators, campaigns, and threat actors. TAXII is a protocol for exchanging STIX data over HTTPS. There are two TAXII server-client models: - Collection: Client pulls data from a server (e.g., 'get indicators from the feed'). - Channel: Server pushes data to subscribers (e.g., 'send alerts when new malware is identified').

Common TAXII API endpoints include /taxii2/collections/ to list available collections and /taxii2/collections/{id}/objects/ to retrieve STIX objects.

Threat hunting is the proactive, iterative search for threats that evade existing security controls. It is hypothesis-driven, not event-driven. The hunter assumes a breach exists and seeks evidence using intelligence and telemetry. The three main hunting models are: - Structured Hunting: Based on a specific hypothesis derived from threat intelligence (e.g., 'Recent reports indicate that APT group X uses PowerShell Empire. Let's search for Empire stagers in our environment.'). - Unstructured Hunting: Triggered by an anomaly or curiosity (e.g., 'Why is this server beaconing to a new domain?'). - Situational Awareness Hunting: Driven by changes in the environment or threat landscape (e.g., 'After patching a critical vulnerability, are there signs of exploitation?').

The hunting process follows a loop: 1. Hypothesis: Formulate a testable statement based on intelligence (e.g., 'Our network has active Cobalt Strike beacons'). 2. Collect Data: Gather relevant logs (e.g., NetFlow, DNS logs, process creation events). 3. Analyze: Use tools like SIEM queries, Python scripts, or manual inspection to find evidence. 4. Respond: If evidence found, escalate to incident response; if not, refine hypothesis or conclude. 5. Feedback: Document findings and update detection rules.

IOCs have a limited useful life. The exam emphasizes: - Expiration: IOCs should have timestamps. Old IOCs generate false positives. - Tiering: Criticality levels (e.g., high-confidence IOCs from trusted sources vs. low-confidence from open feeds). - Automation: Use TIPs to automatically push IOCs to firewalls, SIEMs, and EDR. - False Positive Management: Regularly review and remove stale or invalid IOCs.

The Cyber Kill Chain (Lockheed Martin) describes seven stages of an attack: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command & Control, Actions on Objectives. Threat hunting maps to specific stages; for example, hunting for C2 traffic targets the Command & Control stage.

MITRE ATT&CK is a knowledge base of adversary tactics and techniques. Hunters use ATT&CK to formulate hypotheses (e.g., 'Search for T1055 Process Injection') and to map observed behaviors to known adversary groups.

The Diamond Model characterizes intrusions using four core features: Adversary, Infrastructure, Capability, Victim. It helps analysts understand relationships and pivot between indicators (e.g., from a malware hash to a C2 domain used by the same adversary).

This model ranks indicators by difficulty for adversaries to change: - Hash Values: Easy to change (e.g., recompile malware with different hash). - IP Addresses: Moderately easy (use VPN, proxies). - Domain Names: Moderately hard (need to register new domain). - Network/Host Artifacts: Harder (e.g., specific registry keys, file paths). - Tools: Hard (adversary must develop new tools). - TTPs: Hardest (adversary must change behavior).

Hunters prioritize detecting TTPs over low-level IOCs because they are more persistent.

Threat intelligence feeds into SIEMs (e.g., Splunk ES Threat Intelligence Framework), firewalls (e.g., Palo Alto Networks Threat Prevention), and EDR (e.g., CrowdStrike Falcon Intelligence). The exam tests understanding of how to configure these integrations, such as setting up a STIX/TAXII feed in Splunk to auto-generate correlation searches.

A large bank receives strategic intelligence that a new banking trojan (e.g., Grandoreiro) is targeting Latin American customers via spear-phishing emails with malicious Excel attachments. The threat intelligence team processes this: they extract IOCs (hashes, C2 domains) and create STIX indicators. They push these via TAXII to the bank's SIEM (Splunk ES) and firewall (Palo Alto). The SIEM correlation search triggers on any process creation where Excel spawns a script. The firewall blocks the C2 domains. The hunting team formulates a hypothesis: 'Search for outbound connections to IPs in Brazil that are not typical for our customer base.' They use NetFlow data and find one infected workstation. Incident response contains it. Without intelligence, the bank would rely on signature updates, which might lag behind the trojan's rapid evolution. A common misconfiguration is failing to set IOC expiration: old C2 domains that are sinkholed generate false positives, causing analysts to ignore alerts.

A hospital chain uses MITRE ATT&CK to map common ransomware techniques (e.g., T1486 Data Encrypted for Impact). They receive intelligence that a new ransomware variant, 'BlackCat,' uses intermittent encryption and spreads via PsExec. The threat hunting team creates a hypothesis: 'Search for PsExec execution (Event ID 4688 with Image=*\PsExec.exe) in the last 72 hours across all servers.' They use their EDR (CrowdStrike) to run the query. They find two servers where PsExec was run by an unknown account. Further investigation reveals the attacker used compromised credentials. The team isolates the servers and resets passwords. They provide feedback to the intelligence team: 'BlackCat is using PsExec but with a renamed binary; add YARA rule to detect renamed PsExec.' The hospital also configures their TIP to automatically block execution of signed PsExec binaries from untrusted sources. A pitfall: if the hunting hypothesis is too broad (e.g., 'search for any suspicious process'), it generates thousands of alerts, overwhelming the team.

An MSSP ingests threat intelligence from 20+ feeds into a central TIP (ThreatConnect). They use TAXII to distribute client-specific intelligence. For a client in the energy sector, they filter intelligence to only include IOCs related to ICS-specific threats (e.g., TRITON malware). The hunting team runs weekly structured hunts based on the latest intelligence. For example, they search for suspicious Modbus traffic using Zeek logs. They also use the Pyramid of Pain to prioritize: they focus on detecting TTPs (e.g., use of native tools like wmic for lateral movement) rather than IP addresses. Performance consideration: the TIP must handle 100,000+ IOCs and deduplicate efficiently. A common misconfiguration is not tuning the TIP's confidence scores, leading to low-quality IOCs being blocked and causing business disruption (e.g., blocking a legitimate CDN domain that was flagged as malicious by a low-reputation feed).