Certified Threat Intelligence Analyst (312-85) (312-85) — Questions 76–150

Analysing actor campaigns, motivations and TTPs is core CTI work: it converts raw collection into contextual intelligence about adversary behaviour. This satisfies the stem's requirement for responsibilities within a dedicated CTI team's scope, rather than operational detection or incident response duties.

PIRs are formal statements that capture the intelligence needs of senior decision-makers, ensuring the CTI program produces relevant, actionable intelligence. In this M&A context, PIRs would clarify what the executives need to know about cyber threats that could affect deal valuation, integration risk, or regulatory exposure. They keep the program aligned with strategic goals rather than ad hoc collection.

This accurately captures the hierarchical relationship in threat intelligence. A raw IP address is data; adding geolocation, WHOIS, and passive DNS turns it into information; assessing that the IP belongs to a known APT infrastructure supporting an imminent campaign turns it into intelligence that can drive defensive action.

Tailoring reports to each audience ensures that the SOC receives tactical indicators, the vulnerability management team gets relevant vulnerabilities, and the CISO gets strategic recommendations. This approach maximizes the value of the intelligence and facilitates prompt action. It aligns with best practices in intelligence dissemination, where the format and content are adapted to the consumers' needs.

Publicly accessible social media and forums are classic OSINT. Researchers and actors alike post indicators, tooling discussions, and claims of intrusions in open channels. The information is available to anyone, though it requires verification because of noise, disinformation, and bragging. It remains OSINT regardless of reliability, since the defining characteristic is public availability, not accuracy.

Requirements validation ensures that CTI resources are used for intelligence needs, not for tasks owned by other functions. Legal research on breach notification laws is typically the domain of legal counsel. The CTI manager should assess whether the request supports a decision that requires threat intelligence, and if not, redirect it. This maintains program focus and avoids mission creep.

Command and Control is the Cyber Kill Chain phase where the adversary establishes persistent communication with an external host, typically via beaconing to a C2 server. This matches the stem's description of established persistent external communication, distinguishing it from Actions on Objectives.

MITRE ATT&CK catalogues adversary tactics and techniques observed in real incidents, letting you map ransomware behaviour to specific internal controls and expose coverage gaps. Most modern threat-intelligence platforms natively support ATT&CK, satisfying the stem's requirement for a widely supported framework for technique-to-control mapping during impact analysis.

Validating that IP addresses are not private or reserved is crucial because indicators should represent potentially malicious external infrastructure. Private addresses like 192.168.1.1 and 10.0.0.1 are non-routable and typically not useful as threat indicators. After validation, importing them as 'ipv4-addr' objects ensures correct classification in the platform.

Decoding the base64 payload exposes the nested indicators hidden inside, such as domains, IP addresses or file hashes, which can then be normalised into searchable fields. This satisfies the stem's searchability constraint, since encoded content cannot be matched by keyword or indicator queries until it is decoded and its embedded observables extracted.

Reconnaissance covers the attacker researching and selecting targets, harvesting email addresses, and identifying weaknesses. It satisfies the pre-target criterion because all activity happens externally, before any payload is built or delivered to the victim environment.

Defanged indicators are intentionally altered to prevent accidental clicks or execution. Platforms that consume indicators expect canonical, refanged values so they can match against logs and telemetry. Replacing hxxp with http and removing brackets restores the original URL form. This normalization is a standard processing step before ingestion and ensures the indicator is actionable.

Expiration times automatically retire indicators once their validity window lapses, so the SIEM stops matching against threat data that no longer reflects current adversary infrastructure. This directly curbs false positives caused by stale indicators, satisfying the requirement to keep detection logic aligned with fresh, actionable intelligence.

Using the vendor-provided 'sinkholed' attribute lets you keep the indicators for historical hunting while preventing them from triggering high-severity alerts, because traffic to a sinkhole is not evidence of live adversary control. This approach preserves intelligence context, reduces false positives, and allows analysts to distinguish between active C2 and research-controlled infrastructure.

Automated blocking acts on indicators without analyst context, so legitimate domains sharing infrastructure or reputation signals with threats get blocked, disrupting business services. Human verification confirms malicious intent before enforcement, preventing false positives from degrading operations.

Hypothesis-driven hunting begins with a known adversary tactic, technique or procedure, then forms a testable hypothesis and searches logs for matching evidence. This satisfies the stem's requirement of starting from the tactic and working backward, unlike data-driven or intelligence-driven approaches that begin with anomalies or feeds.

Trust is a core barrier to intelligence sharing: organizations withhold indicators and context because disclosure risks exposing sources, capabilities or ongoing investigations, and recipients may mishandle or leak the data. This directly satisfies the stem's requirement for a common sharing challenge.

OSINT draws on publicly available information such as forums, vendor advisories and social media, and is a recognised threat intelligence source category alongside human, technical and dark web sources. It satisfies the question's requirement for a recognised source type.

Strategic intelligence addresses the big picture: adversary intent, motivation, targeting trends, and business risk, and it is written for decision-makers rather than analysts. The deliverable described is a finished assessment of who would attack the new payment platform, why, and what it costs the business, which is exactly the audience, time horizon, and abstraction level strategic intelligence serves.

Monitoring anomalous process execution patterns detects living-off-the-land abuse, where attackers wield native tools such as PowerShell, WMI or certutil instead of malware. This satisfies the stem's constraint by focusing on behavioural anomalies in legitimate binaries, mapping to ATT&CK's Execution and Defense Evasion tactics, rather than relying on signature-based indicators that such techniques deliberately avoid.

GDPR governs processing and cross-border transfer of personal data, so sharing threat intelligence containing PII with international partners triggers its lawful-basis, transfer-mechanism and safeguards requirements. It directly addresses the international PII-sharing constraint in the stem.

Applying TLP markings at the section level allows for granular handling instructions. This ensures that the sensitive information is protected while allowing other parts of the report to be shared more widely if they are less sensitive. It is a best practice to mark the specific portion with the appropriate TLP and provide handling instructions.

In YARA, the '#' operator is used to count the number of occurrences of a string. The condition '#string_name >= 3' checks if the string named 'string_name' appears at least three times. This directly fulfills the requirement to match when the string appears three or more times, making it the correct choice.

Asset criticality links technical alerts to business impact. When an alert fires on a host that supports a revenue-generating service, the risk score should increase. Without this mapping, all hosts appear equal, and prioritization cannot reflect business context. This is a core input for risk-based alerting in a SOC.

The Installation phase covers malware being placed and persisted on the victim host. Endpoint Detection and Response monitors process, file and registry activity on that host, so it detects and blocks the installation attempt before the attacker proceeds to command-and-control.

Tactical consumers operate at machine speed, so their intelligence must be structured for SIEM ingestion and automated enforcement rather than human reading. Naming SOC analysts alongside automated controls satisfies the stem's requirement to address every consumer tier in a comprehensive plan, covering the operational layer that strategic and operational categories omit.

Double extortion involves both encrypting data and exfiltrating it, then threatening to leak the stolen data if the ransom is not paid. This increases pressure on victims, especially those with regulatory or reputational concerns, such as hospitals. The scenario aligns with this tactic because the group targets healthcare organizations where data sensitivity is high.

Lateral movement via SMB often involves a compromised host connecting to many servers in a short period, attempting to spread. Frequency analysis of distinct destination IPs per source on port 445 can reveal this pattern. The short-lived sessions suggest automated scanning or exploitation, making this technique effective for detecting such behavior.

Remote WMI execution runs through the WMI provider host, wmiprvse.exe, which spawns the attacker's command as a child process on the target. Seeing wmiprvse.exe as the parent of a shell or scripting engine is a strong, direct indicator of remote code execution via WMI and is available through process creation auditing.

PIRs translate broad organisational priorities into specific, answerable intelligence questions that guide collection and analysis. Defining them during Requirements Planning ensures subsequent effort addresses decision-making and risk reduction rather than producing unfocused intelligence of no operational value.

The disciplined response is to tune the feed with filtering and scoring while feeding back the observed false positives to the vendor. This preserves the feed's genuine value, reduces noise at ingestion, and applies pressure on the source to improve quality. It also documents the issue for future source evaluation, which is a core part of running a mature intelligence program.

Actionable intelligence must be timely to be relevant, accurate to be trustworthy, specific to be applicable, and provide clear guidance so recipients know what to do. These characteristics enable decision-makers to act effectively. Without these, intelligence is merely data. This definition aligns with standard threat intelligence principles and ensures the report drives mitigation or further investigation.

Source Reliability and Feed Weighting let the TIP assign confidence or weight per feed, so indicators from higher-reputation sources outrank weaker ones during correlation and scoring. This directly satisfies the requirement to prioritise intelligence by source reputation.

'ip-src' is MISP's attribute type for a source IP address, so mapping the CSV 'src_ip' column to it preserves the indicator's meaning and lets correlation engines match it against inbound traffic sources. Mapping to a generic type would lose that directionality.

Machine-readable STIX delivered over TAXII removes rekeying of indicators into each partner's platform, directly cutting manual data entry. Unstructured CSV/PDF reporting forces analysts to copy, reformat and validate fields by hand before the intelligence is usable.

A cryptographic hash like SHA-256 serves as a unique fingerprint for a file. It allows security tools to identify the exact file by comparing hashes, enabling detection, blocking, and sharing of threat intelligence. Unlike filenames or other attributes, hashes are highly specific and resistant to tampering, making them valuable IoCs.

Feeds arrive in STIX, JSON, CSV, XML and proprietary schemas, so normalising indicators into a common taxonomy before correlation is a major ingestion challenge. This lack of a universal format is distinct from volume or false-positive concerns.

The API Root defines the base resource path under which a TAXII 2.1 server exposes its collections. If it is wrong, authenticated requests return empty bodies because the client polls a non-existent path. Verifying it ensures the client queries the correct collection endpoint.

STIX 2.1 Relationship objects use the 'relationship_type' property to define the semantic link between source_ref and target_ref, such as 'communicates-with'. A parser reads this property to classify the connection, so an unrecognised or malformed value prevents parsing.

PIRs are designed to focus intelligence efforts on the most critical questions that inform decisions at various levels. They ensure that collection and analysis are driven by requirements rather than technology or data availability. This directly supports both tactical and strategic decision-making by prioritizing what matters most to the organization.

Skilled analysts are the program's core asset, so the budget must fund ongoing tradecraft training, conferences, and certifications such as CTI credentials. Without this line item, staff cannot interpret evolving threat data, directly weakening the intelligence produced.

The 'relationship' SDO connects two STIX Domain Objects with a named, directional edge, such as 'indicates' or 'uses', satisfying the requirement to express how indicators, malware and threat actors relate. It carries the relationship_type property plus source_ref and target_ref, which is precisely the linking mechanism the question asks about.

Executives need to understand how the threat affects business objectives and what actions to take. Linking intelligence to business risks and strategic goals enables informed decisions on resource allocation, risk mitigation, and policy changes. This approach ensures the report is relevant and actionable at the executive level, moving beyond technical details to strategic impact.

Analysis is where raw intelligence is evaluated for relevance, reliability, and confidence. In this scenario, the analyst applies confidence thresholds to determine which indicators should trigger alerts. This step involves contextualizing the data and making judgments about its trustworthiness, directly influencing automated alerting rules.

A TIP ingests feeds, reports and indicators from many providers, then normalises and correlates them in one repository. This centralisation satisfies the stem's benefit of consolidating disparate sources, removing the need to query each feed separately and enabling unified searching, scoring and sharing across the intelligence team.

Commercial threat intelligence feeds that specialize in cloud threats provide curated, timely, and actionable information about threat actors, including their tactics, techniques, and procedures (TTPs) and indicators of compromise. They are designed to meet specific intelligence requirements and often include analysis from multiple sources, making them ideal for a focused collection plan on cloud threats.

Traffic Light Protocol provides a simple, widely understood marking scheme that tells recipients whether content is for their eyes only, may be shared within their community, or may be shared more broadly. Applying it before sharing with an ISAC prevents accidental over-distribution and is standard practice in CTI sharing.

Strategic reports are designed for senior leadership and boards, translating technical details into business risk, actor intent, and potential impact. They avoid granular indicators and instead provide context for decision-making. This aligns with the board's need to understand the threat landscape and allocate resources. The other formats are too technical or operationally focused for this audience.

Normalising disparate SIEM log data converts differing field names, formats and timestamps into a common schema, enabling events from multiple sources to be correlated and analysed together. This satisfies the requirement for cross-source compatibility in CTI analysis.

Strategic threat intelligence delivers high-level, long-term analysis of the threat landscape, risks and adversary trends. It is written for executives and management to guide budget allocation and risk decisions, unlike tactical or operational reports focused on indicators and TTPs.

Running PowerShell with an encoded command is adversary behaviour that results in code running on the victim system, which maps to the Execution tactic. The framework classifies the technique by its immediate goal — executing the payload — not by the later download or persistence steps.

Flow diagrams map each TTP to its position in the attack chain, showing execution order from initial access through impact. This sequencing makes the actor's operational logic visible, which static lists of techniques cannot convey.

Within the Diamond Model, the Victim axis represents the target of the intrusion—the organisation, person, asset or identity being attacked. Recording the specific organisation or target aligns with this node, distinguishing it from adversary, infrastructure and capability elements.

A custom RAT with specific DGA algorithms evidences the actor's technical capability, satisfying the stem's demand for a Capability indicator rather than intent or opportunity. DGA implementation requires development skill and infrastructure, distinguishing bespoke tooling from commodity malware and demonstrating the resources the threat actor can bring to bear.

Legitimate svchost.exe lives in System32, is digitally signed by Microsoft, and is spawned by services.exe. An unsigned copy without version information running from C:\Users\Public with explorer.exe as parent violates all three of those invariants simultaneously, which is a strong masquerading signal. Escalating for memory acquisition, hash lookup, and network correlation is the defensible next step rather than assuming a benign anomaly.

The root cause is the SIEM's inability to parse and match IPv6 indicators. Updating the platform to support IPv6 ensures that all indicators, regardless of IP version, are ingested and alerted on. This is a sustainable fix that preserves the value of the trusted feed and aligns with the growing adoption of IPv6 in networks and threats.

The coverage change is a confounding variable, so the first step is to normalize the denominator by comparing like populations. Restricting both periods to Windows servers removes the workstation coverage difference and tests whether the drop persists within the covered population. If the rate is stable after normalization, the apparent decline is an artifact of scope change rather than improved security.

Cross-referencing indicators across multiple sources corroborates each observable against independent feeds, filtering out false positives and single-source bias before the data reaches detection logic. This directly satisfies the stem's reliability constraint by raising confidence in indicator accuracy, since agreement across unrelated providers is far harder to fabricate than a lone report.

Hunting the indicator across endpoints searches for existing compromise that perimeter controls cannot see, such as internal lateral movement or resident malware. This addresses the stem's high-confidence feed by proactively scoping whether the threat already evaded preventive controls.

Sysmon Event ID 10 logs process access events, including the source image, target image, and granted access rights. When a process accesses lsass.exe with access rights like 0x1010 or 0x1410, it strongly indicates credential dumping tools such as Mimikatz. This event provides the necessary telemetry to detect unauthorized memory reads of LSASS, making it the correct choice for this hunt.

Technical intelligence is composed of the atomic, machine-readable artifacts of an intrusion, such as IP addresses, domains, file hashes, and registry keys, and it is designed for automated consumption by security controls. The analyst is handling exactly those artifacts and pushing them into blocking infrastructure, which is the defining use case of technical intelligence.

The report describes adversary behavior (TTPs), so the correct first step is to translate it into ATT&CK techniques and assess current detection and control coverage. This turns vague vendor reporting into a measurable gap analysis the SOC can act on, and it prioritizes engineering work where the hospital is actually exposed rather than chasing generic IOCs.

Clarifying the CISO's needs ensures that the intelligence requirement is well-defined, including what specific information is needed, in what format, and by when. This step is critical in the direction phase to avoid misunderstandings and to guide subsequent collection and analysis. It aligns the intelligence production with the consumer's decision-making timeline and preferences.

Processing converts collected raw data into a structured, analysable format, satisfying the stem's requirement for the lifecycle phase that prepares data for analysis. It sits between collection and analysis, normalising, decrypting, and translating feeds so analysts can consume them.

A SHA-256 file hash uniquely identifies known malicious files, so it functions as a host-based artefact IOC. It satisfies the stem's requirement by being a concrete, observable indicator type that detection tooling can match against during compromise investigations.

Long-term trend forecasting draws on historical reporting spanning months or years, revealing shifts in adversary tactics, targeting and capability. That horizon supports strategic investment and policy decisions, unlike tactical indicators such as IP addresses or hashes, which expire quickly and inform only immediate detection.

Indicators decay quickly and mean little without temporal and contextual metadata, so pairing the address with confidence, observation windows, and campaign context lets detection engineers judge whether a rule is still worth deploying. This practice aligns with structured indicator handling and reduces false positives when addresses are reassigned or shared. It also supports later retrospective searches across historical data.

TLP defines four labels: TLP:RED, TLP:AMBER, TLP:GREEN and TLP:WHITE (now TLP:CLEAR). TLP:AMBER is valid, limiting sharing to the recipient's organisation and its clients on a need-to-know basis, so it satisfies the question's requirement for a genuine TLP label.

Collection Efficiency measures the proportion of gathered data that yields actionable intelligence answering Priority Intelligence Requirements. Comparing high-value reports against total raw data collected directly quantifies this yield, exposing collection sources producing excessive noise relative to PIR-relevant output. This satisfies the director's requirement to evaluate how effectively collection resources convert raw feeds into decision-useful intelligence.

Indicators of behavior (IOBs) focus on the adversary's tactics, techniques, and procedures, such as how the backdoor establishes persistence or communicates with C2. Mapping these to MITRE ATT&CK techniques allows the analyst to create detection rules that are resilient to minor changes in the malware. This approach captures the operational behavior the analyst seeks, making it the most effective for detecting a previously unknown backdoor.

DGA generates many domain names that the malware cycles through until it finds an active C2 server. This makes it difficult for defenders to blacklist all possible domains, as the set is large and changes frequently. The primary purpose is to evade detection and blocking, ensuring resilient C2 communication even if some domains are taken down.

Intelligence loses value quickly; an indicator delivered after an intrusion has succeeded cannot prevent it. Timeliness ensures defenders can block, detect, or mitigate before the adversary completes its objective. For a new program, setting expectations around delivery speed, refresh cadence, and escalation paths is essential to making intelligence operationally useful rather than merely informative after the fact.

Standardising timestamps to UTC aligns event chronology across feeds collected in different time zones, a prerequisite for correlating indicators from disparate sources. Without a shared temporal axis, sequence-dependent analysis fails, so this satisfies the normalization requirement by removing timezone offset variance between source systems.

TAXII defines a RESTful transport and collection model built specifically to carry STIX objects between producers and consumers, satisfying the stem's requirement for automated machine-readable exchange. Unlike generic transfer protocols, it standardises discovery, subscription and polling of intelligence collections, making it the default binding for STIX sharing.

In STIX 2.1 patterning, the equality operator '=' performs an exact match on the specified property value. Using '=' with the string 'malware.exe' ensures only indicators with that exact file name are matched, satisfying the requirement to filter for a specific name. This is the correct and precise way to express an exact match in STIX.