Al

i
son,ananal
ysti
nanXYZor
gani
zat
ion,want
stor
etr
iev
einf
ormat
ionaboutacompany
’swebsi
te
f
rom t
het
imeofi
tsi
ncept
ionaswel
last
her
emov
edi
nfor
mat
ionf
rom t
het
argetwebsi
te.
Whatshoul
dAl
i
sondot
ogett
hei
nfor
mat
ionheneeds?

Al
i
sonshoul
duseSmar
tWhoi
stoext
ractt
her
equi
redwebsi
tei
nfor
mat
ion.

Al
i
sonshoul
drecov
ercachedpagesoft
hewebsi
tef
rom t
heGoogl
esear
chengi
necachet
oex
tract
t
her
equi
redwebsi
tei
nfor
mat
ion.

Al
i
sonshoul
duseht
tps:
//ar
chi
eve.
orgt
oext
ractt
her
equi
redwebsi
tei
nfor
mat
ion.

Al
i
sonshoul
drunt
heWebDat
aExt
ract
ort
ool
toext
ractt
her
equi
redwebsi
tei
nfor
mat
ion.

Joewor
ksasat
hreati
ntel
l
igenceanal
ystwi
thXsecur
it
yInc.Hei
sassessi
ngt
heTIpr
ogr
am by
compar
ingt
hepr
ojectr
esul
tswi
tht
heor
igi
nalobj
ect
ivesbyr
evi
ewi
ngpr
ojectchar
ter
.Hei
sal
so
r
evi
ewi
ngt
hel
i
stofexpect
eddel
i
ver
abl
est
oensur
ethateachoft
hosei
sdel
i
ver
edt
oanaccept
abl
e
l
evel
ofqual
i
ty.
I
dent
if
ytheact
ivi
tyt
hatJoei
sper
for
mingt
oassessaTIpr
ogr
am’
ssuccessorf
ail
ure.Modul
e3

I
dent
if
yingar
easoff
urt
heri
mpr
ovement

Det
ermi
ningt
hecost
sandbenef
it
sassoci
atedwi
tht
he
pr
ogr
am

Det
ermi
ningt
hef
ulf
il
lmentofst
akehol
der
s

Conduct
ingagapanal
ysi
s

Mr
.Bob,
athr
eatanal
yst
,isper
for
minganal
ysi
sofcompet
inghy
pot
heses(
ACH)
.Hehasr
eachedt
o
ast
agewher
ehei
srequi
redt
oappl
yhi
sanal
ysi
sski
l
lsef
fect
ivel
ytor
ejectasmanyhy
pot
hesesand
sel
ectt
hebesthy
pot
hesesf
rom t
hei
dent
if
iedbunchofhy
pot
heses,andt
hisi
sdonewi
tht
hehel
p
ofl
i
stedev
idence.Then,hepr
epar
esamat
ri
xwher
eal
lthescr
eenedhy
pot
hesesar
epl
acedont
he
t
op,
andt
hel
i
stedev
idencef
ort
hehy
pot
hesesar
epl
acedatt
hebot
tom.
Whatst
ageofACHi
sBobcur
rent
lyi
n?

Ref
inement

I
nconsi
stency

Di
agnost
ics

Ev
idence

Ki
m,an anal
yst
,isl
ooki
ng f
oran i
ntel
l
igence-
shar
ing pl
atf
orm t
o gat
herand shar
ethr
eat
i
nfor
mat
ionf
rom av
ari
etyofsour
ces.Hewant
stouset
hisi
nfor
mat
iont
odev
elopsecur
it
ypol
i
cies
t
oenhancet
heov
eral
lsecur
it
ypost
ureofhi
sor
gani
zat
ion.
Whi
choft
hef
oll
owi
ngshar
ingpl
atf
ormsshoul
dbeusedbyKi
m?

Por
tDr
oidnet
wor
kanal
ysi
s

Omni
Peek

Bl
uel
i
vthr
eatexchangenet
wor
k

Cuckoosandbox

Kat
hywant
stoensur
ethatsheshar
est
hreati
ntel
l
igencecont
aini
ngsensi
ti
vei
nfor
mat
ionwi
tht
he
appr
opr
iat
eaudi
ence.Hence,
sheusedt
raf
fi
cli
ghtpr
otocol
(TLP)
.
Whi
ch TLP col
orwoul
d si
gni
fyt
hati
nfor
mat
ion shoul
d be shar
ed onl
y wi
thi
n a par
ti
cul
ar
communi
ty?
Gr
een

Red

Whi
te

Amber

I
nwhi
choft
hef
oll
owi
ngat
tacksdoest
heat
tackerexpl
oitv
ulner
abi
l
iti
esi
nacomput
erappl
i
cat
ion
bef
oret
hesof
twar
edev
elopercanr
eleaseapat
chf
ort
hem?

Zer
o-dayat
tack

Act
iveonl
i
neat
tack

Di
str
ibut
ednet
wor
kat
tack

Adv
ancedper
sist
entat
tack

I
nwhi
choft
hef
oll
owi
ngf
ormsofbul
kdat
acol
l
ect
ionar
elar
geamount
sofdat
afi
rstcol
l
ect
edf
rom
mul
ti
plesour
cesi
nmul
ti
plef
ormat
sandt
henpr
ocessedt
oachi
evet
hreati
ntel
l
igence?

Hy
bri
dfor
m

Unst
ruct
uredf
orm

Pr
oduct
ionf
orm
St
ruct
uredf
orm

Secur
it
yTechI
nc.i
sdev
elopi
ngaTIpl
anwher
eitcandr
ivemor
eadv
ant
agesi
nlessf
unds.I
nthe
pr
ocessofsel
ect
ingaTIpl
atf
orm,i
twant
stoi
ncor
por
ateaf
eat
uret
hatr
anksel
ement
ssuchas
i
ntel
l
igencesour
ces,t
hreatact
ors,at
tacks,anddi
git
alasset
soft
heor
gani
zat
ion,sot
hati
tcanput
i
nmor
efundst
owar
dther
esour
ceswhi
char
ecr
it
ical
fort
heor
gani
zat
ion’
ssecur
it
y.
Whi
choft
hef
oll
owi
ngkeyf
eat
uresshoul
dSecur
it
yTechI
nc.consi
deri
nthei
rTIpl
anf
orsel
ect
ing
t
heTIpl
atf
orm?

Sear
ch

Scor
ing

Open

Wor
kfl
ow

Whi
choft
hef
oll
owi
ngchar
act
eri
sti
csofAPTr
efer
stonumer
ousat
tempt
sdonebyt
heat
tackert
o
gai
nent
ryt
othet
arget
’snet
wor
k?

At
tackor
igi
nat
ionpoi
nts

Ti
mel
i
ness

Ri
skt
oler
ance

Mul
ti
phased
Jame,apr
ofessi
onalhacker
,ist
ryi
ngt
ohackt
heconf
ident
iali
nfor
mat
ionofat
argetor
gani
zat
ion.
Hei
dent
if
iedt
hev
ulner
abi
l
iti
esi
nthet
argetsy
stem andcr
eat
edat
ail
oreddel
i
ver
abl
emal
i
cious
pay
loadusi
nganexpl
oitandabackdoort
osendi
ttot
hev
ict
im.
Whi
choft
hef
oll
owi
ngphasesofcy
berki
l
lchai
nmet
hodol
ogyi
sJameexecut
ing?

I
nst
all
ati
on

Reconnai
ssance

Weaponi
zat
ion

Expl
oit
ati
on

Ji
m wor
ksasasecur
it
yanal
ysti
nal
argemul
ti
nat
ionalcompany
.Recent
ly,agr
oupofhacker
s
penet
rat
edi
ntot
hei
ror
gani
zat
ionalnet
wor
kandusedadat
ast
agi
ngt
echni
quet
ocol
l
ectsensi
ti
ve
dat
a.Theycol
l
ect
edal
lsor
tsofsensi
ti
vedat
aaboutt
heempl
oyeesandcust
omer
s,busi
ness
t
act
icsoft
heor
gani
zat
ion,
financi
ali
nfor
mat
ion,
net
wor
kinf
rast
ruct
urei
nfor
mat
ion,
andsoon.
Whatshoul
dJi
m dot
odet
ectt
hedat
ast
agi
ngbef
oret
hehacker
sexf
il
tr
atef
rom t
henet
wor
k?

Ji
m shoul
danal
yzemal
i
ciousDNSr
equest
s,DNSpay
load,
unspeci
fi
eddomai
ns,
anddest
inat
ionof
DNSr
equest
s.

Ji
m shoul
dident
if
ythewebshel
lrunni
ngi
nthenet
wor
kbyanal
yzi
ngser
veraccess,
err
orl
ogs,
suspi
ciousst
ri
ngsi
ndi
cat
ingencodi
ng,
useragentst
ri
ngs,
andsoon.

Ji
m shoul
dmoni
tornet
wor
ktr
aff
icf
ormal
i
ciousf
il
etr
ansf
ers,
fil
eint
egr
it
ymoni
tor
ing,
andev
ent
l
ogs.

Ji
m shoul
dident
if
ytheat
tackatani
nit
ial
stagebychecki
ngt
hecont
entoft
heuseragentf
iel
d.
I
nwhi
choft
hef
oll
owi
ngst
oragear
chi
tect
urei
sthedat
ast
oredi
nal
ocal
i
zedsy
stem,ser
ver
,or
st
oragehar
dwar
eandcapabl
eofst
ori
ngal
i
mit
edamountofdat
aini
tsdat
abaseandl
ocal
l
y
av
ail
abl
efordat
ausage?

Di
str
ibut
edst
orage

Cent
ral
i
zedst
orage

Obj
ect
-basedst
orage

Cl
oudst
orage

At
eam oft
hreati
ntel
l
igenceanal
yst
sisper
for
mingt
hreatanal
ysi
sonmal
war
e,andeachoft
hem
hascomeupwi
tht
hei
rownt
heor
yandev
idencet
osuppor
tthei
rtheor
yonagi
venmal
war
e.
Now,t
oident
if
ythemostconsi
stentt
heor
youtofal
lthet
heor
ies,whi
choft
hef
oll
owi
nganal
yti
c
pr
ocessesmustt
hreati
ntel
l
igencemanageruse?

Anal
ysi
sofcompet
inghy
pot
heses(
ACH)

Appl
i
cat
iondecomposi
ti
onandanal
ysi
s(ADA)

Thr
eatmodel
i
ng

Aut
omat
edt
echni
cal
anal
ysi
s

Gui
ana&Co.i
sawel
l
-est
abl
i
shedcy
ber
-secur
it
ycompanyi
ntheUni
tedSt
ates.Theor
gani
zat
ion
i
mpl
ement
edt
heaut
omat
ionoft
askssuchasdat
aenr
ichmentandi
ndi
cat
oraggr
egat
ion.Theyal
so
j
oinedv
ari
ouscommuni
ti
est
oincr
easet
hei
rknowl
edgeaboutt
heemer
gingt
hreat
s.Howev
er,t
he
secur
it
yteamscanonl
ydet
ectandpr
eventi
dent
if
iedt
hreat
sinar
eact
iveappr
oach.Basedont
hreat
i
ntel
l
igencemat
uri
tymodel
,ident
if
ythel
evelofGui
ana& Co.t
oknow t
hest
ageatwhi
cht
he
or
gani
zat
ionst
andswi
thi
tssecur
it
yandv
ulner
abi
l
iti
es.

Lev
el3:
CTIpr
ogr
am i
npl
ace

Lev
el1:
prepar
ingf
orCTI

Lev
el2:
incr
easi
ngCTIcapabi
l
iti
es

Lev
el0:
vaguewher
etost
art

Andr
ewsandSonsCor
p.hasdeci
dedt
oshar
ethr
eati
nfor
mat
ionamongshar
ingpar
tner
s.Gar
ry,a
t
hreatanal
yst
,wor
kingi
nAndr
ewsandSonsCor
p.,wasaskedt
ofol
l
owat
rustmodelnecessar
yto
est
abl
i
sht
rustbet
weenshar
ingpar
tner
s.I
nthet
rustmodelusedbyhi
m,t
hef
ir
stor
gani
zat
ion
makesuseofabodyofev
idencei
nasecondor
gani
zat
ion,andt
hel
eveloft
rustbet
weent
het
wo
or
gani
zat
ionsdependsont
hedegr
eeandqual
i
tyofev
idencepr
ovi
dedbyt
hef
ir
stor
gani
zat
ion.
Whi
choft
hef
oll
owi
ngt
ypesoft
rustmodel
isusedbyGar
ryt
oest
abl
i
sht
het
rust
?

Di
recthi
stor
ical
trust

Medi
atedt
rust

Mandat
edt
rust

Val
i
dat
edt
rust

Ji
ani
samemberoft
hesecur
it
yteam atTr
ini
ty,I
nc.Hewasconduct
ingar
eal
-t
imeassessmentof
sy
stem act
ivi
ti
esi
nor
dert
oacqui
ret
hreati
ntel
l
igencef
eeds.Heacqui
redf
eedsf
rom sour
cesl
i
ke
honey
net
s,P2Pmoni
tor
ing,
inf
rast
ruct
ure,
andappl
i
cat
ionl
ogs.
Whi
choft
hef
oll
owi
ngcat
egor
iesoft
hreati
ntel
l
igencef
eedwasacqui
redbyJi
an?

Ext
ernal
int
ell
i
gencef
eeds

CSVdat
afeeds

I
nter
nal
int
ell
i
gencef
eeds

Pr
oact
ivesur
vei
l
lancef
eeds

Whi
choft
hef
oll
owi
ngt
ypesoft
hreatat
tri
but
iondeal
swi
tht
hei
dent
if
icat
ionoft
hespeci
fi
cper
son,
soci
ety
,oracount
rysponsor
ingawel
l
-pl
annedandexecut
edi
ntr
usi
onorat
tackov
eri
tst
arget
?

Campai
gnat
tri
but
ion

Tr
ueat
tri
but
ion

Nat
ion-
stat
eat
tr
ibut
ion

I
ntr
usi
on-
setat
tri
but
ion

Moses,at
hreati
ntel
l
igenceanal
ystatI
nfoTechI
nc.
,want
stof
indcr
uci
ali
nfor
mat
ionaboutt
he
pot
ent
ial
thr
eat
stheor
gani
zat
ioni
sfaci
ngbyusi
ngadv
ancedGoogl
esear
choper
ator
s.Hewant
sto
i
dent
if
ywhet
heranyf
akewebsi
tesar
ehost
edt
hatar
esi
mil
art
otheor
gani
zat
ion’
sURL.
Whi
choft
hef
oll
owi
ngGoogl
esear
chquer
iesshoul
dMosesuse?

cache:
www.
inf
otech.
org
i
nfo:
www.
i
nfot
ech.
org

r
elat
ed:
www.
inf
otech.
org

l
i
nk:
www.
inf
otech.
org

Whati
sthecor
rectsequenceofst
epsi
nvol
vedi
nschedul
i
ngat
hreati
ntel
l
igencepr
ogr
am?
1.
Rev
iewt
hepr
ojectchar
ter
2.
Ident
if
yal
ldel
i
ver
abl
es
3.
Ident
if
ythesequenceofact
ivi
ti
es
4.
Ident
if
ytaskdependenci
es
5.
Dev
elopt
hef
inal
schedul
e
6.
Est
imat
edur
ati
onofeachact
ivi
ty
7.
Ident
if
yandest
imat
eresour
cesf
oral
lact
ivi
ti
es
8.
Def
ineal
lact
ivi
ti
es
9.
Bui
l
dawor
kbr
eakdownst
ruct
ure(
WBS)

1-
->9-
->2-
->8-
->3-
->7-
->4-
->6-
->5

1-
->2-
->3-
->4-
->5-
->6-
->9-
->8-
->7

3-
->4-
->5-
->2-
->1-
->9-
->8-
->7-
->6

1-
->2-
->3-
->4-
->5-
->6-
->7-
->8-
->9

Henr
y,at
hreati
ntel
l
igenceanal
ystatCy
ber
Sof
tInc.
,i
swor
kingonat
hreati
ntel
l
igencepr
ogr
am.He
was assi
gned t
o wor
k on est
abl
i
shi
ng cr
it
eri
aforpr
ior
it
izat
ion ofi
ntel
l
igence needs and
r
equi
rement
s.
Whi
ch oft
he f
oll
owi
ng consi
der
ati
ons mustbe empl
oyed byHenr
yto pr
ior
it
ize i
ntel
l
igence
r
equi
rement
s?
Under
standdat
arel
i
abi
l
ity

Under
standf
requencyandi
mpactofat
hreat

Pr
oduceact
ionabl
edat
a

Dev
elopacol
l
ect
ionpl
an

AnXYZor
gani
zat
ionhi
redMr
.Andr
ews,
athr
eatanal
yst
.Inor
dert
oident
if
ythet
hreat
sandmi
ti
gat
e
t
heef
fectofsucht
hreat
s,Mr
.Andr
ewswasaskedt
oper
for
mthr
eatmodel
i
ng.Dur
ingt
hepr
ocess
oft
hreatmodel
i
ng,hecol
l
ect
edi
mpor
tanti
nfor
mat
ionaboutt
het
hreatact
orandchar
act
eri
zedt
he
anal
yti
cbehav
ioroft
headv
ersar
ythati
ncl
udest
echnol
ogi
caldet
ail
s,goal
s,andmot
ivest
hatcanbe
usef
uli
nbui
l
dingast
rongcount
ermeasur
e.
Whatst
ageoft
het
hreatmodel
i
ngi
sMr
.Andr
ewscur
rent
lyi
n?

Thr
eatr
anki
ng

Thr
eatdet
ermi
nat
ionandi
dent
if
icat
ion

Thr
eatpr
ofi
l
ingandat
tri
but
ion

Sy
stem model
i
ng

Li
zzy
,an anal
yst
,want
stor
ecogni
ze t
he l
evelofr
isks t
othe or
gani
zat
ion so as t
o pl
an
count
ermeasur
esagai
nstcy
berat
tacks.Sheused at
hreatmodel
i
ng met
hodol
ogywher
eshe
per
for
medt
hef
oll
owi
ngst
ages:
St
age1:
Bui
l
dasset
-basedt
hreatpr
ofi
l
es
St
age2:
Ident
if
yinf
rast
ruct
urev
ulner
abi
l
iti
es
St
age3:
Dev
elopsecur
it
yst
rat
egyandpl
ans
Whi
choft
hef
oll
owi
ngt
hreatmodel
i
ngmet
hodol
ogi
eswasusedbyLi
zzyi
ntheaf
orement
ioned
scenar
io?

DREAD

OCTAVE

VAST

TRI
KE

Enr
ageTechCompanyhi
redEnr
ique,asecur
it
yanal
yst
,forper
for
mingt
hreati
ntel
l
igenceanal
ysi
s.
Whi
l
e per
for
ming dat
a col
l
ect
ion pr
ocess,he used a count
eri
ntel
l
igence mechani
sm wher
ea
r
ecur
siv
eDNSser
veri
sempl
oyedt
oper
for
mint
erser
verDNScommuni
cat
ionandwhenar
equesti
s
gener
atedf
rom anynameser
vert
other
ecur
siv
eDNSser
ver
,ther
ecur
siv
eDNSser
ver
slogt
he
r
esponsest
hatar
erecei
ved.Theni
trepl
i
cat
est
hel
oggeddat
aandst
orest
hedat
aint
hecent
ral
dat
abase.Usi
ng t
hese l
ogs,he anal
yzed t
he mal
i
cious at
tempt
sthatt
ook pl
ace ov
erDNS
i
nfr
ast
ruct
ure.
Whi
choft
hef
oll
owi
ngcy
bercount
eri
ntel
l
igence(
CCI
)gat
her
ingt
echni
quehasEnr
iqueusedf
or
dat
acol
l
ect
ion?

Dat
acol
l
ect
iont
hroughDNSzonet
ransf
er

Dat
acol
l
ect
iont
hroughDNSi
nter
rogat
ion

Dat
acol
l
ect
iont
hroughdy
nami
cDNS(
DDNS)

Dat
acol
l
ect
iont
hroughpassi
veDNSmoni
tor
ing
At
hreatanal
ystobt
ainsani
ntel
l
igencer
elat
edt
oat
hreat
,wher
ethedat
aissenti
nthef
orm ofa
connect
ionr
equestf
rom ar
emot
ehostt
otheser
ver
.Fr
om t
hisdat
a,heobt
ainsonl
ytheI
Paddr
ess
oft
hesour
ceanddest
inat
ionbutnocont
ext
uali
nfor
mat
ion.Whi
l
epr
ocessi
ngt
hisdat
a,heobt
ains
cont
ext
uali
nfor
mat
ionst
ati
ngt
hatmul
ti
pleconnect
ionr
equest
sfr
om di
ff
erentgeo-
locat
ionsar
e
r
ecei
vedbyt
heser
verwi
thi
nashor
tti
mespan,
andasar
esul
t,t
heser
veri
sst
ressedandgr
adual
l
y
i
tsper
for
mancehasr
educed.Hef
urt
herper
for
medanal
ysi
sont
hei
nfor
mat
ionbasedont
hepast
andpr
esentexper
ienceandconcl
udest
heat
tackexper
iencedbyt
hecl
i
entor
gani
zat
ion.
Whi
choft
hef
oll
owi
ngat
tacksi
sper
for
medont
hecl
i
entor
gani
zat
ion?

DHCPat
tacks

Bandwi
dthat
tack

Di
str
ibut
edDeni
al-
of-
Ser
vice(
DDoS)at
tack

MACspoof
ingat
tack

Mi
l
ey,ananal
yst
,want
stor
educet
heamountofcol
l
ect
eddat
aandmaket
hest
ori
ngandshar
ing
pr
ocesseasy
.Sheusesf
il
ter
ing,t
aggi
ng,andqueui
ngt
echni
quet
osor
toutt
her
elev
antand
st
ruct
ureddat
afr
om t
hel
argeamount
sofunst
ruct
ureddat
a.
Whi
choft
hef
oll
owi
ngt
echni
quewasempl
oyedbyMi
l
ey?

Nor
mal
i
zat
ion

Conv
eni
encesampl
i
ng

Dat
avi
sual
i
zat
ion

Sandboxi
ng
Whi
choft
hef
oll
owi
ngcomponent
sref
erst
oanodei
nthenet
wor
kthatr
out
est
het
raf
fi
cfr
om a
wor
kst
ati
ont
oext
ernalcommandandcont
rolser
verandhel
psi
nident
if
icat
ionofi
nst
all
edmal
war
e
i
nthenet
wor
k?

Repeat
er

Net
wor
kint
erf
acecar
d(NI
C)

Gat
eway

Hub

Mi
chael
,at
hreatanal
ystatanor
gani
zat
ionnamedTechTop,wasaskedt
oconductacy
ber
-t
hreat
i
ntel
l
igenceanal
ysi
s.Af
terobt
aini
ngi
nfor
mat
ionr
egar
dingt
hreat
s,hehasst
art
edanal
yzi
ngt
he
i
nfor
mat
ionandunder
standi
ngt
henat
ureoft
het
hreat
s.
Whatst
ageoft
hecy
ber
-t
hreati
ntel
l
igencei
sMi
chael
cur
rent
lyi
n?

Knownknowns

Unknownsunknown

Knownunknowns

Unknownunknowns

Anat
tackeri
nst
ruct
sbot
stousecamouf
lagemechani
sm t
ohi
dehi
sphi
shi
ngandmal
war
edel
i
ver
y
l
ocat
ionsi
nther
api
dlychangi
ngnet
wor
kofcompr
omi
sedbot
s.I
nthi
spar
ti
cul
art
echni
que,
asi
ngl
e
domai
nnameconsi
stsofmul
ti
pleI
Paddr
esses.
Whi
choft
hef
oll
owi
ngt
echni
quei
susedbyt
heat
tacker
?
Fast
-Fl
uxDNS

Dy
nami
cDNS

DNSzonet
ransf
er

DNSi
nter
rogat
ion

Tr
acywor
ksasaCI
SO i
nal
argemul
ti
nat
ionalcompany
.Sheconsumest
hreati
ntel
l
igencet
o
under
standt
hechangi
ngt
rendsofcy
bersecur
it
y.Sher
equi
resi
ntel
l
igencet
ounder
standt
he
cur
rentbusi
nesst
rendsand makeappr
opr
iat
edeci
sionsr
egar
ding new t
echnol
ogi
es,secur
it
y
budget
,impr
ovementofpr
ocesses,andst
aff
.Thi
sint
ell
i
gencehel
psheri
nmi
nimi
zi
ngbusi
ness
r
isksandpr
otect
ingt
henewt
echnol
ogyandbusi
nessi
nit
iat
ives.
I
dent
if
ythet
ypeoft
hreati
ntel
l
igenceconsumeri
sTr
acy
.

Oper
ati
onal
user
s

St
rat
egi
cuser
s

Tact
ical
user
s

Techni
cal
user
s

Dur
ingt
hepr
ocessoft
hreati
ntel
l
igenceanal
ysi
s,John,at
hreatanal
yst
,successf
ull
yext
ract
edan
i
ndi
cat
ionofadv
ersar
y’si
nfor
mat
ion,
suchasModusoper
andi
,tool
s,communi
cat
ionchannel
s,and
f
orensi
csev
asi
onst
rat
egi
esusedbyt
headv
ersar
ies.
I
dent
if
ythet
ypeoft
hreati
ntel
l
igenceanal
ysi
sisper
for
medbyJohn.
Oper
ati
onal
thr
eati
ntel
l
igenceanal
ysi
s

St
rat
egi
cthr
eati
ntel
l
igenceanal
ysi
s

Techni
cal
thr
eati
ntel
l
igenceanal
ysi
s

Tact
ical
thr
eati
ntel
l
igenceanal
ysi
s

John,apr
ofessi
onalhacker
,ist
ryi
ngt
oper
for
m APTat
tackont
het
argetor
gani
zat
ionnet
wor
k.He
gai
nsaccesst
oasi
ngl
esy
stem ofat
argetor
gani
zat
ionandt
ri
est
oobt
ainadmi
nist
rat
ivel
ogi
n
cr
edent
ial
stogai
nfur
theraccesst
othesy
stemsi
nthenet
wor
kusi
ngv
ari
oust
echni
ques.
Whatphaseoft
headv
ancedper
sist
entt
hreatl
i
fecy
clei
sJohncur
rent
lyi
n?

Per
sist
ence

I
nit
ial
int
rusi
on

Sear
chandexf
il
tr
ati
on

Expansi
on

St
evewor
ksasananal
ysti
naUK-
basedf
ir
m.Hewasaskedt
oper
for
m net
wor
kmoni
tor
ingt
ofi
nd
anyev
idenceofcompr
omi
se.Dur
ingt
henet
wor
kmoni
tor
ing,hecamet
oknow t
hatt
her
ear
e
mul
ti
plel
ogi
nsf
rom di
ff
erentl
ocat
ionsi
nashor
tti
mespan.Mor
eov
er,heal
soobser
vedcer
tai
n
i
rr
egul
arl
ogi
npat
ter
nsf
rom l
ocat
ionswher
etheor
gani
zat
iondoesnothav
ebusi
nessr
elat
ions.
Thi
sresembl
est
hatsomebodyi
str
yingt
ost
eal
conf
ident
ial
inf
ormat
ion.
Whi
choft
hef
oll
owi
ngkeyi
ndi
cat
orsofcompr
omi
sedoest
hisscenar
iopr
esent
?

Unusual
act
ivi
tyt
hroughpr
ivi
l
egeduseraccount
Geogr
aphi
cal
anomal
i
es

Unusual
out
boundnet
wor
ktr
aff
ic

Unexpect
edpat
chi
ngofsy
stems

Al
i
ce,ananal
yst
,shar
edi
nfor
mat
ionwi
thsecur
it
yoper
ati
onmanager
sandnet
wor
koper
ati
ons
cent
er(
NOC)st
afff
orpr
otect
ingt
heor
gani
zat
ionalr
esour
cesagai
nstv
ari
oust
hreat
s.I
nfor
mat
ion
shar
edbyAl
i
cewashi
ghl
ytechni
calandi
ncl
udet
hreatact
orTTPs,
mal
war
ecampai
gns,
tool
sused
byt
hreatact
ors,
andsoon.
Whi
choft
hef
oll
owi
ngt
ypesoft
hreati
ntel
l
igencewasshar
edbyAl
i
ce?

Oper
ati
onal
thr
eati
ntel
l
igence

Techni
cal
thr
eati
ntel
l
igence

Tact
ical
thr
eati
ntel
l
igence

St
rat
egi
cthr
eati
ntel
l
igence

Ananal
ystwant
stodi
ssemi
nat
ethei
nfor
mat
ionef
fect
ivel
ysot
hatt
heconsumer
scanacqui
reand
benef
itoutoft
hei
ntel
l
igence.
Whi
choft
hef
oll
owi
ngcr
it
eri
amustananal
ystconsi
deri
nor
dert
omaket
hei
ntel
l
igenceconci
se,
to
t
hepoi
nt,accur
ate,andeasi
l
yunder
standabl
eandmustconsi
stofar
ightbal
ancebet
weent
abl
es,
nar
rat
ive,
number
s,gr
aphi
cs,
andmul
ti
medi
a?

Ther
ightt
ime
Ther
ightor
der

Ther
ightpr
esent
ati
on

Ther
ightcont
ent

Ti
miswor
kingasananal
ysti
nanABC or
gani
zat
ion.Hi
sor
gani
zat
ionhadbeenf
aci
ngmany
chal
l
engesi
nconv
ert
ingt
her
aw t
hreati
ntel
l
igencedat
aint
omeani
ngf
ulcont
ext
uali
nfor
mat
ion.
Af
teri
nspect
ion,hef
oundt
hati
twasduet
onoi
seobt
ainedf
rom mi
srepr
esent
ati
onofdat
afr
om
hugedat
acol
l
ect
ions.Hence,
iti
simpor
tantt
ocl
eant
hedat
abef
oreper
for
mingdat
aanal
ysi
susi
ng
t
echni
ques such as dat
areduct
ion.He needs t
o choose an appr
opr
iat
ethr
eati
ntel
l
igence
f
ramewor
kthataut
omat
ical
l
yper
for
msdat
acol
l
ect
ion,
fil
ter
ing,
andanal
ysi
sforhi
sor
gani
zat
ion.
Whi
choft
hef
oll
owi
ngt
hreati
ntel
l
igencef
ramewor
ksshoul
dhechooset
oper
for
m sucht
asks?

Thr
eatgr
id

Hi
ghChar
ts

TCcompl
ete

SI
GVERI
F

Ty
rion,apr
ofessi
onalhacker
,ist
arget
inganor
gani
zat
iont
ost
ealconf
ident
iali
nfor
mat
ion.He
want
stoper
for
m websi
tef
oot
pri
nti
ngt
oobt
aint
hef
oll
owi
ngi
nfor
mat
ion,whi
chi
shi
ddeni
nthe
webpageheader
.
Connect
ionst
atusandcont
entt
ype
Accept
-r
angesandl
ast
-modi
fi
edi
nfor
mat
ion
X-
power
ed-
byi
nfor
mat
ion
Webser
veri
nuseandi
tsv
ersi
on
Whi
choft
hef
oll
owi
ngt
ool
sshoul
dTy
rionuset
ovi
ewheadercont
ent
?

Vangaur
denf
orcer

Bur
psui
te

Aut
oShun

Hy
dra

Sam wor
ksasananal
ysti
nanor
gani
zat
ionnamedI
nfoTechSecur
it
y.Hewasaskedt
ocol
l
ect
i
nfor
mat
ionf
rom v
ari
oust
hreati
ntel
l
igencesour
ces.I
nmeet
ingt
hedeadl
i
ne,
hef
orgott
over
if
ythe
t
hreati
ntel
l
igencesour
cesanduseddat
afr
om anopen-
sour
cedat
apr
ovi
der
,whoof
fer
edi
tata
v
eryl
ow cost
.Thoughi
twasbenef
ici
alatt
hei
nit
ialst
agebutr
ely
ingonsuchdat
apr
ovi
der
scan
pr
oduceunr
eli
abl
edat
aandnoi
seput
ti
ngt
heor
gani
zat
ionnet
wor
kint
ori
sk.
Whatmi
stakeSam di
dthatl
edt
othi
ssi
tuat
ion?

Sam di
dnotuset
hepr
opert
echnol
ogyt
ouseorconsumet
hei
nfor
mat
ion.

Sam di
dnotuset
hepr
operst
andar
dizat
ionf
ormat
sforr
epr
esent
ingt
hreat
dat
a.

Sam usedunr
eli
abl
eint
ell
i
gencesour
ces.

Sam useddat
awi
thoutcont
ext
.

Anor
gani
zat
ionsuf
fer
ed manymaj
orat
tacksand l
ostcr
it
icali
nfor
mat
ion,suchasempl
oyee
r
ecor
ds,andf
inanci
ali
nfor
mat
ion.Ther
efor
e,t
hemanagementdeci
dest
ohi
reat
hreatanal
ystt
o
ext
ractt
hest
rat
egi
cthr
eati
ntel
l
igencet
hatpr
ovi
deshi
gh-
lev
eli
nfor
mat
ionr
egar
dingcur
rentcy
ber
-
secur
it
ypost
ure,
thr
eat
s,det
ail
sont
hef
inanci
ali
mpactofv
ari
ouscy
ber
-act
ivi
ti
es,
andsoon.
Whi
choft
hef
oll
owi
ngsour
ceswi
l
lhel
ptheanal
ystt
ocol
l
ectt
her
equi
redi
ntel
l
igence?

Act
ivecampai
gns,
att
acksonot
heror
gani
zat
ions,
dat
afeedsf
rom ext
ernal
thi
rdpar
ti
es

Humans,
soci
almedi
a,chatr
ooms

OSI
NT,
CTIv
endor
s,I
SAO/
ISACs

Campai
gnr
epor
ts,
mal
war
e,i
nci
dentr
epor
ts,
att
ackgr
oupr
epor
ts,
humani
ntel
l
igence

Sar
ahi
sasecur
it
yoper
ati
onscent
er(
SOC)anal
ystwor
kingatJW Wi
l
li
amsandSonsor
gani
zat
ion
basedi
nChi
cago.Asapar
tofsecur
it
yoper
ati
ons,shecont
act
sinf
ormat
ionpr
ovi
der
s(shar
ing
par
tner
s)f
orgat
her
ingi
nfor
mat
ionsuchascol
l
ect
ionsofv
ali
dat
edandpr
ior
it
izedt
hreati
ndi
cat
ors
al
ongwi
thadet
ail
edt
echni
calanal
ysi
sofmal
war
esampl
es,bot
net
s,DDoSat
tackmet
hods,and
v
ari
ousot
hermal
i
cioust
ool
s.She f
urt
herused t
he col
l
ect
ed i
nfor
mat
ion att
he t
act
icaland
oper
ati
onal
lev
els.
Sar
ahobt
ainedt
her
equi
redi
nfor
mat
ionf
rom whi
choft
hef
oll
owi
ngt
ypesofshar
ingpar
tner
?

Pr
ovi
der
sofcompr
ehensi
vecy
ber
-t
hreati
ntel
l
igence

Pr
ovi
der
soft
hreati
ndi
cat
ors

Pr
ovi
der
soft
hreatdat
afeeds

Pr
ovi
der
soft
hreatact
ors

H&P,I
nc.i
s a smal
l
-scal
e or
gani
zat
ion t
hathas deci
ded t
o out
sour
ce t
he net
wor
k secur
it
y
moni
tor
ingduet
olackofr
esour
cesi
ntheor
gani
zat
ion.Theyar
elooki
ngf
ort
heopt
ionswher
ethey
candi
rect
lyi
ncor
por
atet
hreati
ntel
l
igencei
ntot
hei
rexi
sti
ngnet
wor
kdef
ensesol
uti
ons.
Whi
choft
hef
oll
owi
ngi
sthemostcost
-ef
fect
ivemet
hodst
heor
gani
zat
ioncanempl
oy?

Recr
uitmanagedsecur
it
yser
vicepr
ovi
der
s(MSSP)

Lookf
orani
ndi
vi
dual
wit
hint
heor
gani
zat
ion

Recr
uitdat
amanagementsol
uti
onpr
ovi
der

Recr
uitt
her
ightt
alent

Bob,
athr
eatanal
yst
,wor
ksi
nanor
gani
zat
ionnamedTechTop.Hewasaskedt
ocol
l
ecti
ntel
l
igence
t
oful
fi
ltheneedsandr
equi
rement
soft
heRedTeam pr
esentwi
thi
ntheor
gani
zat
ion.
Whi
choft
hef
oll
owi
ngar
etheneedsofaRedTeam?

I
ntel
l
igenceext
ract
edl
atestat
tacksanal
ysi
sonsi
mil
aror
gani
zat
ions,
whi
chi
ncl
udesdet
ail
sabout
l
atestt
hreat
sandTTPs

I
ntel
l
igencer
elat
edt
oincr
easedat
tackst
arget
ingapar
ti
cul
arsof
twar
eoroper
ati
ngsy
stem
v
ulner
abi
l
ity

I
ntel
l
igenceonl
atestv
ulner
abi
l
iti
es,
thr
eatact
ors,
andt
hei
rtact
ics,
techni
ques,
andpr
ocedur
es
(
TTPs)

I
ntel
l
igencet
hatr
eveal
sri
sksr
elat
edt
ovar
iousst
rat
egi
cbusi
nessdeci
si
ons

Wal
terandSonsCompanyhasf
acedmaj
orcy
berat
tacksandl
ostconf
ident
ialdat
a.Thecompany
hasdeci
dedt
oconcent
rat
emor
eont
hesecur
it
yrat
hert
hanot
herr
esour
ces.Ther
efor
e,t
heyhi
red
Al
i
ce,
athr
eatanal
yst
,toper
for
m dat
aanal
ysi
s.Al
i
cewasaskedt
oper
for
m qual
i
tat
ivedat
aanal
ysi
s
t
oext
ractusef
uli
nfor
mat
ionf
rom col
l
ect
edbul
kdat
a.
Whi
choft
hef
oll
owi
ngt
echni
queswi
l
lhel
pAl
i
cet
oper
for
m qual
i
tat
ivedat
aanal
ysi
s?

Br
ainst
ormi
ng,
int
erv
iewi
ng,
SWOTanal
ysi
s,Del
phi
techni
que,
andsoon

Fi
ndi
ngl
i
nksbet
weendat
aanddi
scov
ert
hreat
-r
elat
edi
nfor
mat
ion

Regr
essi
onanal
ysi
s,v
ari
anceanal
ysi
s,andsoon

Numer
ical
cal
cul
ati
ons,
stat
ist
ical
model
i
ng,
measur
ement
,resear
ch,
andsoon

Anet
wor
kadmi
nist
rat
orwor
kingi
nanABCor
gani
zat
ioncol
l
ect
edl
ogf
il
esgener
atedbyat
raf
fi
c
moni
tor
ingsy
stem,whi
chmaynotseem t
ohav
eusef
uli
nfor
mat
ion,butaf
terper
for
mingpr
oper
anal
ysi
sbyhi
m,t
hesamei
nfor
mat
ioncanbeusedt
odet
ectanat
tacki
nthenet
wor
k.
Whi
choft
hef
oll
owi
ngcat
egor
iesoft
hreati
nfor
mat
ionhashecol
l
ect
ed?

Det
ect
ioni
ndi
cat
ors

Low-
lev
eldat
a

St
rat
egi
crepor
ts

Adv
isor
ies

At
hreatanal
ystwant
stoi
ncor
por
atear
equi
rementi
nthet
hreatknowl
edger
eposi
tor
ythatpr
ovi
des
anabi
l
ityt
omodi
fyordel
etepastori
rr
elev
antt
hreatdat
a.
Whi
choft
hef
oll
owi
ngr
equi
rementmusthei
ncl
udei
nthet
hreatknowl
edger
eposi
tor
ytof
ulf
ilhi
s
needs?
Pr
otect
ionr
anki
ng

Ev
aluat
ingper
for
mance

Dat
amanagement

Sear
chabl
efunct
ional
i
ty

Dani
eli
sapr
ofessi
onalhackerwhoseai
mist
oat
tackasy
stem t
ost
ealdat
aandmoneyf
orpr
ofi
t.
Heper
for
mshacki
ng t
o obt
ain conf
ident
ialdat
asuch associ
alsecur
it
ynumber
s,per
sonal
l
y
i
dent
if
iabl
einf
ormat
ion (
PII
)ofan empl
oyee,and cr
edi
tcar
dinf
ormat
ion.Af
terobt
aini
ng
conf
ident
ial
dat
a,hef
urt
hersel
l
sthei
nfor
mat
ionont
hebl
ackmar
kett
omakemoney
.
Dani
elcomesunderwhi
choft
hef
oll
owi
ngt
ypesoft
hreatact
or.

I
nsi
dert
hreat

St
ate-
sponsor
edhacker
s

I
ndust
ri
alspi
es

Or
gani
zedhacker
s

An anal
ysti
s conduct
ing t
hreati
ntel
l
igence anal
ysi
sin a cl
i
entor
gani
zat
ion,and dur
ing t
he
i
nfor
mat
iongat
her
ingpr
ocess,hegat
her
edi
nfor
mat
ionf
rom t
hepubl
i
clyav
ail
abl
esour
cesand
anal
yzedt
oobt
ainar
ichusef
ulf
orm ofi
ntel
l
igence.Thei
nfor
mat
ionsour
cet
hatheusedi
s
pr
imar
il
yusedf
ornat
ionalsecur
it
y,l
aw enf
orcement
,andf
orcol
l
ect
ingi
ntel
l
igencer
equi
redf
or
busi
nessorst
rat
egi
cdeci
sionmaki
ng.
Whi
choft
hef
oll
owi
ngsour
cesofi
ntel
l
igencedi
dtheanal
ystuset
ocol
l
ecti
nfor
mat
ion?
OSI
NT

I
SAC

SI
GINT

OPSEC

I
nat
eam oft
hreatanal
yst
s,t
woi
ndi
vi
dual
swer
ecompet
ingov
erpr
oject
ingt
hei
rownhy
pot
heses
on a gi
ven mal
war
e.Howev
er,t
ofi
nd l
ogi
calpr
oof
sto conf
ir
m t
hei
rhy
pot
heses,t
he t
hreat
i
ntel
l
igencemanagerusedade-
biasi
ngst
rat
egyt
hati
nvol
vesl
ear
ningst
rat
egi
cdeci
sionmaki
ngi
n
t
heci
rcumst
ancescompr
isi
ngmul
ti
stepi
nter
act
ionswi
thnumer
ousr
epr
esent
ati
ves,ei
therhav
ing
orwi
thoutanyper
fectr
elev
anti
nfor
mat
ion.
Whi
choft
hef
oll
owi
ngde-
biasi
ngst
rat
egi
est
het
hreati
ntel
l
igencemanagerusedt
oconf
ir
mthei
r
hy
pot
heses?

Gamet
heor
y

Deci
siont
heor
y

Cogni
ti
vepsy
chol
ogy

Machi
nel
ear
ning

Cy
ber
solTechnol
ogi
es i
nit
iat
ed a cy
ber
-t
hreati
ntel
l
igence pr
ogr
am wi
that
eam oft
hreat
i
ntel
l
igenceanal
yst
s.Dur
ingt
hepr
ocess,t
heanal
yst
sst
art
edconv
ert
ingt
her
aw dat
aint
ousef
ul
i
nfor
mat
ionbyappl
yi
ngv
ari
oust
echni
ques,suchasmachi
ne-
basedt
echni
ques,andst
ati
sti
cal
met
hods.
I
nwhi
choft
hef
oll
owi
ngphasesoft
het
hreati
ntel
l
igencel
i
fecy
clei
sthet
hreati
ntel
l
igencet
eam
cur
rent
lywor
king?
Anal
ysi
sandpr
oduct
ion

Pl
anni
nganddi
rect
ion

Di
ssemi
nat
ionandi
ntegr
ati
on

Pr
ocessi
ngandexpl
oit
ati
on

Al
i
ce,at
hreati
ntel
l
igenceanal
ystatHi
TechCy
berSol
uti
ons,want
stogat
heri
nfor
mat
ionf
or
i
dent
if
yingemer
gingt
hreat
stot
heor
gani
zat
ionandi
mpl
ementessent
ial
techni
quest
opr
eventt
hei
r
sy
stems and net
wor
ks f
rom such at
tacks.Al
i
ce i
s sear
chi
ng f
oronl
i
ne sour
ces t
o obt
ain
i
nfor
mat
ionsuchast
hemet
hodusedt
olaunchanat
tack,
andt
echni
quesandt
ool
susedt
oper
for
m
anat
tackandt
hepr
ocedur
esf
oll
owedf
orcov
eri
ngt
het
racksaf
teranat
tack.
Whi
choft
hef
oll
owi
ngonl
i
nesour
cesshoul
dAl
i
ceuset
ogat
hersuchi
nfor
mat
ion?

Fi
nanci
alser
vices

Hacki
ngf
orums

Soci
alnet
wor
kingsi
tes

Jobsi
tes

Kar
ry,at
hreatanal
ystatanXYZor
gani
zat
ion,i
sper
for
mingt
hreati
ntel
l
igenceanal
ysi
s.Dur
ingt
he
dat
acol
l
ect
ionphase,heusedadat
acol
l
ect
ionmet
hodt
hati
nvol
vesnopar
ti
cipant
sandi
spur
ely
basedonanal
ysi
sandobser
vat
ionofact
ivi
ti
esandpr
ocessesgoi
ngonwi
thi
nthel
ocalboundar
ies
oft
heor
gani
zat
ion.
I
dent
if
ythet
ypedat
acol
l
ect
ionmet
hodusedbyt
heKar
ry.
Rawdat
acol
l
ect
ion

Expl
oit
eddat
acol
l
ect
ion

Passi
vedat
acol
l
ect
ion

Act
ivedat
acol
l
ect
ion