Leveraging threat intelligence
Five ways to use intel
🎯 Indicator matching
The simplest use. Compare observed artifacts against known-bad lists. Reactive by nature.
👤 Adversary attribution
Connect observed behavior to specific actors or campaigns. Useful for context, less directly actionable.
🔍 TTP-based hunting
Use known techniques to search for similar patterns. More durable than indicator matching.
⚙️ Automated enrichment
Append intel data to alerts in flight. Reduces manual lookup work and speeds triage.
🕸️ Dark-web monitoring
Watch for leaked credentials, organization mentions, attack planning. Early warning signal.
The integration principle
Threat Intelligence Evidence-based knowledge about existing or emerging threats, including context, mechanisms, indicators, implications, and actionable advice. should be used not in isolation, but as a correlation layer applied across internal data sets such as logs, EDR Telemetry Collection and transmission of security-relevant data from remote sources for monitoring and analysis. , and Network Traffic The data moving between hosts on a network, observed as connections, flows, and packets. In triage, traffic metadata (who talked to whom, when, how much, and over which port and protocol) is often the fastest way to confirm or rule out command and control, exfiltration, or lateral movement. . Its goals during Uncover are validation, prioritization, contextualization, and prediction.
Indicator matching
Indicator matching compares local telemetry (DNS queries, process Hashes Cryptographic functions that generate fixed-size values representing digital data, used for file integrity verification and malware identification. , outbound connections) against known IOCs from Threat An actor (or capability) with intent and means to cause harm. A vulnerability is what they exploit. Classical risk models multiply threat, vulnerability, and impact; ASSURED's RATM folds the threat and vulnerability questions into likelihood, so risk stays impact times likelihood. -intel sources. Sources span commercial threat feeds, government advisories, ISACs, open-source databases, and internal reports.
🌐 Network indicators
IP addresses, URLs, and domain names associated with malicious infrastructure (C2 servers, phishing sites, malware staging).
📄 File indicators
Cryptographic hashes (MD5/SHA256) identifying known malware payloads or tools.
📧 Email indicators
Suspicious senders, subject patterns, attachment signatures from known campaigns.
🧬 Behavioral indicators
Specific system modifications: registry changes, scheduled tasks, mutex creation, or other distinctive patterns observed in known malware.
Indicator matching process
The six steps below are the pipeline that stands up and maintains indicator matching, and most of it is CTI-team and detection-engineering work, not triage. The on-shift analyst lives at steps 04 and 05, querying newly published indicators against history and receiving the real-time matches as alerts, and contributes to step 06 every time a close records whether a match was real. The rest is here so the analyst knows what the matches they consume rest on.
Ingestion
Collect and normalize indicators from diverse sources into structured formats optimized for automated matching.
Validation
Evaluate indicator quality, relevance, and reliability before operational deployment.
Integration
Deploy matching capabilities across SIEM, EDR, NDR, and proxy systems.
Retroactive hunting
Analyze historical data to uncover previously undetected compromises using newly acquired indicators.
Real-time monitoring
Implement alerting mechanisms for immediate detection of indicator matches in ongoing activity.
Feedback
Systematically document true and false-positives to continuously refine intelligence quality.
The limits of indicator matching
Indicator matching is fundamentally reactive and depends on current, verified Intelligence Information gathered and analyzed to understand and predict potential security threats. . Advanced adversaries deliberately employ techniques like Domain Either a DNS name like example.com that identifies internet infrastructure, or a Windows Active Directory domain, the identity and authentication boundary attackers aim to own; context makes the sense clear. As an indicator, a DNS domain's age, registrar, and reputation are among the first pivots in triage. rotation, Fileless Malware Malware that operates in memory without writing files to disk, harder to detect with traditional AV. Often leverages legitimate system tools like PowerShell or WMI for execution. , and living-off-the-land tactics to circumvent Signature-Based Detection Security method that identifies threats by matching observed activity against a database of known malicious patterns or signatures. . Indicator matching is necessary; it is not sufficient. Pair it with behavioral analysis and TTP-based hunting for defensive depth.
Adversary attribution
Adversary attribution is the methodical process of connecting observed Attack Patterns Common techniques or behaviors used by attackers that help in recognizing and defending against threats. to specific threat actors, groups, or campaigns. The analysis integrates behavioral signatures, Infrastructure The systems, networks, and services that computing runs on. In triage the word points two directions: the organization's infrastructure is what alerts fire on, and attacker infrastructure is the set of C2 servers, domains, and staging hosts an adversary operates, which pivoting on indicators is meant to map. reuse, Malware Software whose author intends harm: ransomware, trojans, worms, viruses, spyware, wipers, rootkits, RATs. The B.A.D. glossary catalogs the families in detail. family characteristics, and documented TTPs from authoritative threat-intel sources such as Mandiant, CrowdStrike, Recorded Future Threat-intelligence platform combining machine learning with human analysis across open, dark, and technical sources. , and the MITRE ATT&CK framework.
Technical evidence
Malware code signatures, infrastructure overlap, compilation artifacts. Foundational linkages to known threat actors.
Behavioral patterns
Victim selection criteria, operational timeframes, distinctive tactical approaches. Correlation points beyond the binary.
Strategic context
Geopolitical developments, threat-actor motivations, industry targeting preferences. The “why” that anchors attribution.
Confidence levels
Attribution claims use the same LOW / MEDIUM / HIGH scale as every other claim in the case file (the shared rubric). The grid below translates each level into attribution-specific evidence, so the analyst knows what an attribution claim must rest on before it earns its label.
Isolated technical indicators with significant potential for coincidental overlap. May suggest investigative directions but requires substantial corroborating evidence before operational use.
Multiple correlated indicators across diverse categories (tooling, infrastructure, TTPs) that collectively point toward a specific threat actor or group.
Comprehensive evidence portfolio including unique identifiers, distinctive operational patterns, and multiple reinforcing data points indicating a specific actor with minimal alternative explanations.
Attribution challenges to recognize
- False flag operations. Sophisticated adversaries deliberately impersonate other threat actors to obscure responsibility and complicate attribution.
- Shared tooling. Widespread use of common malware families or publicly available frameworks creates attribution ambiguity.
- Evolution of TTPs. Actors change their techniques over time, so a profile built on last year’s tradecraft can misattribute this year’s intrusion.
- Confirmation bias. Analytical tendency to disproportionately value evidence supporting initial attribution hypotheses while discounting contradictory indicators.
Attribution at low or medium confidence should be labeled as such in the case file. Promoting low-confidence attribution to operational decisions is the most common attribution failure mode.
Threat hunting with TTPs
Proactive Threat Hunting Proactive analysis that starts from a hypothesis ("if an attacker were here, what would I expect to see?") and searches telemetry for evidence. Distinct from alert triage, which reacts to detections; hunting goes looking for what the detections missed. based on known Tactics, Techniques, and Procedures uncovers sophisticated threats that have evaded traditional detection. Unlike IOC matching, which relies on known Artifacts Digital evidence or traces left behind by system activity or security incidents, used in forensic analysis and incident investigation. , TTP-based hunting focuses on adversary behavior patterns regardless of the particular tools employed.
By transforming TTPs into actionable hunt hypotheses (for example, “Identify PowerShell A command-line shell and scripting language built on the .NET framework, commonly used for system administration and potentially for malicious purposes. Execution The attacker successfully runs malicious code on a system, typically using interpreters, scripts, payloads, or legitimate tools. originating from non-administrative accounts” or “Detect scheduled tasks created within temporary directories”) security teams can methodically query logs, EDR telemetry, or SIEM platforms for evidence of stealthy or emerging attacks.
Hypothesis formation
Develop specific, testable theories based on threat intelligence about adversary TTPs relevant to your environment.
Query development
Create data queries or analytics that would identify evidence of the targeted behavior across relevant data sources.
Hunt execution
Systematically search through current and historical data for patterns matching the hypothesis.
Finding analysis
Investigate initial results to eliminate false-positives and validate genuine security concerns.
Process improvement
Document findings, refine queries, and implement persistent detection for discovered techniques.
Why TTPs outlast indicators
TTP-based hunting keeps working because behavior is expensive to change. An attacker can recompile malware or stand up new infrastructure in an afternoon, but abandoning a technique that works means retooling an entire operation. The techniques stay stable long after every indicator has rotated.
Automated threat enrichment
Automated enrichment attaches threat-intelligence context to events as they arrive, so the analyst opens an alert that already carries reputation, attribution, and infrastructure detail instead of spending the first minutes of triage on manual lookups.
Enrichment data types
- Reputation scores. Trust ratings for IPs, domains, files, URLs.
- Threat-actor attribution. Adversary groups associated with observed indicators.
- Malware classification. Family, variant, and capability profiles.
- Contextual metadata. WHOIS, infrastructure details, certificate validation.
- Historical intelligence. Previous indicator sightings and campaign activities.
Common enrichment services
- VirusTotal. Multi-engine file and URL reputation.
- Shodan / Censys. Internet-exposed services and vulnerability intel.
- GreyNoise. Background-noise filtering and benign-activity identification.
- Microsoft Defender Threat Intelligence (MDTI, formerly RiskIQ / PassiveTotal). Domain and IP infrastructure mapping. Retiring as a standalone product in August 2026; the capabilities fold into Microsoft Defender XDR and Sentinel.
- LevelBlue Open Threat Exchange (OTX, formerly AlienVault OTX). Crowd-sourced threat indicators and community intel.
Implementation approaches
- Native tool integration. Purpose-built connectors within SIEM/SOAR.
- API orchestration. Custom scripts or middleware for intelligence aggregation.
- Intelligence platforms. Dedicated TIP solutions with advanced enrichment.
- Inline enrichment. Network tools that tag traffic with real-time threat context.
Dark web and underground monitoring
Dark web surveillance can detect exposed credentials, breach preparations, targeted attack discussions, Exploit A technique or piece of code that turns a vulnerability into actual capability: remote code execution, privilege escalation, authentication bypass. A vulnerability without an exploit is theoretical; a vulnerability with one is operational. development, and brand impersonation. This is a program capability, not a triage activity: specialized vendors and dedicated threat-intel teams do the monitoring, using automated scraping plus human intelligence, and the collection challenges below are theirs to solve. What reaches the triage analyst is the output, a credential-exposure alert in the queue or an enrichment note on a case, and the reason to understand the collection is to weigh that output: where it came from, how noisy the space is, and why it arrives with a confidence label rather than as fact.
Sources
- Criminal forums. Boards for technique sharing, service sales, recruiting.
- Marketplaces. Underground markets for malware, exploits, credentials, stolen data.
- Leak sites. Where ransomware groups and hacktivists publish stolen data.
- Chat platforms. Encrypted messaging for private actor communications.
- Paste sites. Anonymous data dumps and credential leaks.
Intelligence value
- Pre-attack indicators before traditional detection fires.
- Visibility into adversary capabilities and intentions.
- Advance warning of emerging attack techniques.
- Insight into targeting priorities of threat actors.
Collection challenges
- Access barriers to closed communities.
- Language and cultural context requirements.
- Signal-to-noise ratio in unstructured data.
- Legal and ethical considerations in collection.
Use cases
- Credential exposure monitoring and forced resets.
- Early vulnerability patching based on exploit chatter.
- Brand protection and impersonation detection.
- Insider threat identification via data leakage.
Threat intelligence tiers
Intelligence operates across three tiers, each serving distinct purposes and distinct audiences. Triage runs almost entirely on the tactical tier; the operational tier serves threat hunters and detection engineers between cases; the strategic tier is program material for leadership and architects. The table is here so the analyst can place any piece of intel that crosses their desk, not because a triage case calls for a geopolitical briefing.
Why the tiers matter
Tactical intel without operational context produces noise. Strategic intel without tactical depth produces strategy decks no one can operationalize. The methodology asks the SOC to use all three: tactical for triage, operational for hunting, strategic for the program-level decisions about what to detect and what to defend.
Validation and confidence
Not all intel is equal. Before acting on a piece of intelligence, validate it across four checks.
📡 Source reliability
Where did this come from? Premium sources include government agencies, established vendors, vetted ISACs. Higher-risk sources include crowdsourced platforms lacking verification. Triangulation across multiple providers strengthens confidence.
⏱️ Recency
When was this observed? Indicators age out fast. Systematically retire obsolete indicators (formerly malicious infrastructure repurposed as benign cloud edges, for instance).
🎯 Specificity
Is the intel about the exact thing being investigated, or a loose analogy? “This domain is associated with phishing” is less actionable than “This specific subdomain pattern is used by this specific campaign.”
🔗 Corroboration
Does any other source say the same thing? Two independent sources reporting the same indicator is a stronger signal than one source repeating itself.
One scale, not two
Validated intel is labeled with the same LOW / MEDIUM / HIGH scale used for attribution above and defined once in the shared rubric: the four checks map directly onto it (corroboration and source reliability drive the level; recency and specificity cap it). The only state this section adds is unverified: intel that has not yet been scored against the four checks. Unverified intel can generate hypotheses, but it never drives an operational decision until it has been validated and labeled.
Intel is a hypothesis, not a verdict
Threat intelligence tells the analyst what to look for. It does not tell them what they have. Validate intel-driven hypotheses against the actual telemetry before acting. The matched IOC is the question, not the answer.
Key Takeaway
Threat intelligence makes Uncover faster when used as a hypothesis generator. It makes Uncover slower when treated as ground truth. The methodology asks the analyst to use intel deliberately, score it across source/recency/specificity/corroboration, and confirm with the environment’s own evidence before acting.
Next up
MITRE ATT&CK
The shared vocabulary for adversary behavior. Tactics, techniques, procedures.
Read MITRE ATT&CK