Threat Intelligence and Indicators of Compromise

Threat intelligence is evidence-based knowledge about existing or emerging threats to an organization. It includes context, mechanisms, indicators, and actionable advice. For SY0-701, threat intelligence is categorized into three levels: strategic, tactical, and operational. Strategic intelligence is high-level, often used by executives to understand risk and allocate resources. Tactical intelligence focuses on the tactics, techniques, and procedures (TTPs) of threat actors. Operational intelligence provides specific details about a particular attack or campaign, including IOCs.

The lifecycle consists of six phases: direction, collection, processing, analysis, dissemination, and feedback. - Direction: Define requirements. For example, an organization may prioritize intelligence on ransomware groups targeting healthcare. - Collection: Gather raw data from multiple sources: open-source intelligence (OSINT), commercial feeds, internal logs, dark web monitoring. - Processing: Convert raw data into a usable format. This includes normalization, deduplication, and enrichment. - Analysis: Correlate data to identify patterns, attribution, and emerging threats. Analysts use frameworks like MITRE ATT&CK to map TTPs. - Dissemination: Share intelligence with stakeholders, such as SOC analysts, incident responders, or executives. Formats include STIX/TAXII for automated sharing. - Feedback: Evaluate the effectiveness of the intelligence and refine future collection.

IOCs are forensic artifacts that indicate a system has been compromised. Common IOCs include: - File hashes: MD5, SHA-1, SHA-256 of malware samples. Example: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 - IP addresses: C2 server IPs, scanning sources. Example: 203.0.113.5 - Domain names: Malicious domains used for phishing or C2. Example: malware.example.com - URLs: Specific paths used in attacks. Example: http://malware.example.com/evil.exe - Registry keys: Persistence mechanisms like HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\ - File paths: Locations where malware drops files. Example: C:\Users\Public\svchost.exe - Network signatures: Patterns in traffic, such as specific user-agent strings or beacon intervals.

IOCs are often shared in structured formats like STIX (Structured Threat Information Expression) and TAXII (Trusted Automated eXchange of Indicator Information). STIX defines the data model, while TAXII specifies how to transport it.

Attackers know defenders use IOCs for detection. To evade, they: - Change hashes: Polymorphic malware generates unique hashes each time it replicates. - Rotate IPs: Use fast-flux DNS or cloud IPs that change frequently. - Use domain generation algorithms (DGAs): Automatically generate many domains, making blacklisting ineffective. - Encrypt C2 traffic: Use HTTPS or custom encryption to hide signatures. - Leverage living-off-the-land binaries (LOLBins): Use legitimate tools like PowerShell or WMI to avoid file-based IOCs.

- Automated IOC ingestion: Use TIPs like MISP (Malware Information Sharing Platform) to automate feed processing. - Prioritize IOCs: Not all IOCs are equal; focus on high-fidelity indicators (e.g., specific TTPs) over low-fidelity ones (e.g., IP addresses). - YARA rules: Create custom rules to detect malware families based on byte sequences. Example rule:

rule SilentBanker
  {
      strings:
          $a = {6A 40 68 00 30 00 00 6A 14 8D 91}
          $b = {8D 4D B0 2B C1 83 C0 27 99 6A 4E 59 F7 F9}
      condition:
          $a or $b
  }

- Integration with SIEM: Correlate IOCs with logs using tools like Splunk or ELK. For example, a query to find connections to a known bad IP:

index=network sourcetype=firewall dest_ip=203.0.113.5

This model structures intrusion events around four core features: adversary, capability, infrastructure, and victim. It helps analysts understand the relationships and pivot on indicators.

ATT&CK is a knowledge base of adversary TTPs. It maps to the tactical intelligence level. For example, the technique "T1059.001" corresponds to PowerShell execution. Using ATT&CK, defenders can identify which TTPs are covered by their controls.

A SOC analyst at a mid-sized enterprise notices a spike in alerts from the endpoint detection system. The alerts indicate suspicious file writes to network shares. The analyst checks the threat intelligence feed from their commercial provider and sees a new IOC: a SHA-256 hash of a ransomware variant called 'LockBit 3.0'. The feed also includes the associated C2 domain 'evil.lockbit.com'. Using the SIEM, the analyst queries for any endpoints that contacted that domain in the last 24 hours. Three machines match. The analyst then isolates those machines from the network and initiates the incident response process. The correct response includes blocking the domain at the firewall, adding the hash to the endpoint blocklist, and scanning all shares for encrypted files. A common mistake is to rely solely on the hash without checking for related IOCs (like the domain), which could miss lateral movement. Also, analysts sometimes forget to verify the feed's confidence level; if the feed is low-confidence, they might block legitimate traffic.

A threat hunter is tasked with identifying signs of a nation-state group known as APT29. The hunter reviews the group's TTPs from MITRE ATT&CK: they often use PowerShell for execution (T1059.001) and WMI for lateral movement (T1047). The hunter writes a YARA rule to detect a specific PowerShell script pattern used by APT29. They also collect logs from Windows Event IDs 4104 (PowerShell script block logging) and 4688 (process creation). After scanning 1,000 endpoints, they find one machine where PowerShell executed a base64-encoded command that matches the YARA rule. Further investigation reveals that the machine also made connections to an IP address listed in a recent intelligence bulletin. The hunter escalates to incident response. A common mistake is to hunt without a hypothesis (e.g., 'let's see what we find') which leads to alert fatigue. Instead, using a known TTP narrows the search.

A bank participates in the Financial Services ISAC (FS-ISAC). They receive a flash alert about a new phishing campaign targeting bank employees. The alert contains IOCs: a domain 'secure-bank-login.com' and an email subject line 'Urgent: Account Verification'. The bank's security team immediately blocks the domain at the email gateway and web proxy. They also create a SIEM rule to detect any emails with that subject line. Within an hour, the block stops 50 emails from reaching employees. The correct response also includes notifying employees via a security awareness email. A common mistake is to only block the domain but not search for any emails that may have already been delivered. The team should also check the mail logs for any successful deliveries and remediate accordingly.