CTI cheat sheet

Threat intelligence is evidence-based knowledge about an adversary, including context, mechanisms, indicators, implications, and actionable advice, sufficient to inform decisions about mitigation or response.

Data is raw observations; information is data with structure; intelligence is information that has been analyzed, contextualized, and tied to a decision - the DIKW chain must not be collapsed.

Knowledge of an adversary without relevance to your assets is not intelligence; relevance, timeliness, and actionability are the three qualifying tests.

Strategic intelligence serves executives (risk, budget, geopolitics); operational intelligence serves defenders (campaigns, TTPs); tactical intelligence serves analysts (IOCs, tooling).

Technical indicators alone decay quickly and are low-fidelity; adversary behavior (TTPs) is more costly for attackers to change and therefore more durable intelligence.

Intelligence supports four decision types: strategic (invest), operational (prioritize), tactical (detect/block), and technical (hunt/scan).

Intelligence is not threat data feeds, not vulnerability scanning output, and not a SIEM alert queue - each may be an input, none is the finished product.

A threat intelligence program exists to reduce decision uncertainty; if no decision changes as a result of the product, the effort has no intelligence value.

Source categories: internal telemetry (SIEM, EDR, DNS, proxy, honeypots), commercial feeds/vendors, open source (OSINT), closed communities (ISACs, MISP sharing groups), and government advisories.

Collection methods: HUMINT (human sources), OSINT (public), SIGINT (signals), GEOINT (geospatial), MASINT (measurement/signature), and TECHINT (technical captures such as malware samples).

Free OSINT sources include CISA advisories, MITRE ATT&CK, vendor blogs, CERT bulletins, Shodan/Censys, VirusTotal, and public sandboxes; each carries differing reliability and latency.

Paid feeds typically buy coverage, curation, and SLA; evaluate them on precision, recall, freshness, uniqueness versus existing sources, and false-positive cost.

ISACs (FS-ISAC, H-ISAC, MS-ISAC) provide sector-specific sharing under trust-group rules; membership obligations often require reciprocal sharing.

Honeypots and sinkholes generate high-fidelity, low-noise indicators of active adversary behavior directed at your environment.

Dark web and closed-forum monitoring supplies early warning of credential dumps, tooling sales, and planned campaigns, but attribution and verification are weak.

Source evaluation criteria: provenance, bias, timeliness, corroboration, access level, and historical accuracy; a single-source IOC should be treated as unverified.

MITRE ATT&CK organizes adversary behavior into Tactics (the why/goal), Techniques (the how), and Procedures (specific implementations); Enterprise, Mobile, and ICS matrices are separate.

ATT&CK tactic order follows the attack lifecycle: Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact.

The Cyber Kill Chain (Lockheed Martin) has seven phases: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, Actions on Objectives.

The Diamond Model models every intrusion event as Adversary, Capability, Infrastructure, Victim, with meta-features (timestamp, phase, result, direction, methodology, resources).

STIX 2.x is the structured language for threat intelligence (SDOs, SROs, SCOs); TAXII 2.x is the transport protocol for exchanging STIX over HTTPS.

The Traffic Light Protocol (TLP 2.0) has four levels: RED (named recipients only), AMBER (limited disclosure, organization only; AMBER+STRICT restricts to the organization), GREEN (community-wide), CLEAR (public).

The VERIS framework expresses incidents in the 4A schema: Actor, Action, Asset, Attribute, enabling statistical comparison across incidents.

The Unified Kill Chain expands the seven-phase kill chain into 18 phases spanning in, through, and out of the network, aligning with ATT&CK for detection mapping.

The NATO Admiralty Code grades source reliability (A–F) and information credibility (1–6); A1 is fully reliable and confirmed, F6 is unreliable and cannot be judged.

The intelligence cycle runs: Direction/Planning → Collection → Processing → Analysis & Production → Dissemination → Feedback, then repeats.

Direction begins with Priority Intelligence Requirements (PIRs) - questions tied to decisions - and Specific Intelligence Requirements (SIRs) that decompose each PIR into collectable tasks.

A requirement is well-formed when it names a decision, a consumer, a timeframe, and an acceptable confidence level; vague requirements produce unfocused collection.

Collection plans map each SIR to sources, methods, cost, and expected latency; gaps between requirements and available sources are documented as collection gaps.

Feedback closes the loop: consumers rate products on relevance, timeliness, and accuracy, and those ratings adjust PIRs and source prioritization.

Intelligence planning must align with organizational risk appetite and budget; PIRs should trace to crown-jewel assets and business processes.

Common lifecycle failure modes: no PIRs (collection-driven program), no feedback (products drift), and no dissemination path (intelligence never reaches decision-makers).

A threat intelligence platform (TIP) supports the lifecycle by ingesting, normalizing, deduplicating, scoring, and distributing intelligence, but does not replace analyst judgment.

Collection sources must be inventoried with owner, update cadence, format, license/terms of use, and retention policy before ingestion.

Processing steps: parse, normalize (e.g., to STIX or a common schema), deduplicate, enrich (WHOIS, ASN, passive DNS, geolocation), score confidence, and tag with context.

Indicator types and their pitfalls: IP addresses are highly volatile and shared via NAT/CDN; domains and URLs need passive DNS and registration context; file hashes lose value on repacking.

YARA rules match malware families and capabilities by byte/string patterns; Sigma rules are vendor-neutral SIEM detection logic convertible to platform query languages.

Confidence scoring should combine source reliability (Admiralty grade), corroboration count, age/decay, and observed internal hits rather than a single vendor score.

Indicator aging: apply TTLs and decay so stale indicators do not pollute blocklists; a 90-day-old IP indicator should be re-verified before blocking.

Data quality checks include format validation, false-positive suppression, allowlisting of critical infrastructure, and monitoring for feed poisoning or typosquatting in feed domains.

Legal and privacy constraints on collection: GDPR/data-protection limits on personal data, computer-misuse law limits on active scanning, and vendor license restrictions on redistribution.

Analysis methods: structured analytic techniques (ACH - Analysis of Competing Hypotheses, key assumptions check), link analysis, timeline analysis, and kill-chain/ATT&CK mapping.

ACH counters cognitive bias by listing hypotheses, scoring evidence for/against each, and seeking evidence that disproves rather than confirms.

Analytic standards (e.g., the Kent School) require products to separate sourced fact from judgment and to state confidence explicitly (e.g., 'high confidence, likely').

Estimative language should be defined in a lexicon: 'almost certain' (~95%), 'likely' (~55–75%), 'possible' (~25–45%), 'unlikely' (~20–45% against) - use consistently.

Product types: tactical indicator bulletins, campaign/actor profiles, weekly situational reports, strategic assessments, and threat briefings for executives.

Attribution should be graded and hedged; infrastructure overlap and tooling reuse suggest but do not prove identity, and false-flag operations exist.

Analysis must answer the PIR and state 'so what' - implications for the consumer's assets, plus recommended actions and confidence.

Peer review and red-teaming of analytic products reduce error; document assumptions and intelligence gaps alongside findings.

Dissemination channels: TIP portals, email/Slack, SIEM/TIP API integrations, MISP sharing, STIX/TAXII feeds, and machine-readable blocklists.

Format follows consumer: executives need a one-page strategic summary; SOC analysts need machine-ingestible indicators and detection logic; hunters need TTP detail.

TLP markings must travel with the product; redistribution beyond the TLP level is a trust violation and can end sharing-group membership.

Machine-to-machine integration paths: TAXII server → TIP → SIEM/EDR/firewall, with automated blocking gated by confidence thresholds and allowlists.

Integration with SOAR enables automated enrichment and response; high-confidence, corroborated indicators warrant automation, low-confidence ones require human review.

Detection engineering converts intelligence into Sigma/YARA/KQL rules and ATT&CK coverage maps; success is measured by detections deployed and validated, not by feeds consumed.

Metrics for dissemination: product delivery timeliness, consumer satisfaction, indicators ingested versus actioned, and detection coverage against priority techniques.

Sharing communities (MISP, ISACs) require reciprocity and sanitization; strip victim-identifying and sensitive internal data before external sharing.

Threat hunting is hypothesis-driven, iterative search through networks/endpoints for undetected adversary activity, not alert triage and not automated detection.

Hunting hypotheses derive from PIRs, ATT&CK gaps, intel reports, and anomalous telemetry; each hunt should be scoped, logged, and its findings fed back into detection.

Hunting loop: formulate hypothesis → identify data sources → query/analyze → investigate anomalies → remediate/respond → convert findings into analytics → measure coverage.

The Pyramid of Pain ranks indicators by attacker cost to change: hash values < IP addresses < domain names < network/host artifacts < tools < TTPs.

Detection engineering lifecycle: identify technique → write rule → test with adversary emulation → tune false positives → deploy → monitor efficacy.

Behavioral analytics (UEBA, EDR behavioral rules) detect TTPs that evade signature-based IOCs; baselining normal behavior is a prerequisite.

Adversary emulation (Atomic Red Team, CALDERA, MITRE Engenuity evaluations) validates whether detections actually fire for mapped techniques.

Purple teaming pairs offensive emulation with defensive detection validation to produce measurable ATT&CK coverage improvements.

Hunt metrics include hypotheses tested, dwell time of findings, new detections created, and percentage of ATT&CK techniques covered by validated analytics.

OPSEC for a CTI team: separate analyst identities from personal accounts, use dedicated infrastructure for research, and never browse adversary infrastructure from corporate IPs.

Attribution-safe research requires VPNs, VPS infrastructure, isolated VMs, and sock-puppet personas consistent with platform terms and legal constraints.

Analyst safety: malware handling only in isolated sandboxes with no shared clipboard/folders; verify hashes and use static analysis before detonation.

Program governance: define mission, charter, stakeholders, RACI, budget, and success metrics; align PIRs to enterprise risk register and business objectives.

Maturity models (e.g., CTI-CMM with five levels from ad hoc to leading) assess direction, collection, processing, analysis, dissemination, and feedback maturity.

Staffing roles: collection manager, analyst (tactical/operational/strategic), detection engineer, and program lead; analyst burnout from alert volume is a real program risk.

Metrics that matter: decisions influenced, incidents detected earlier, false-positive reduction, cost per intelligence product, and coverage of priority threats.

Legal/ethical guardrails: no unauthorized access to adversary systems, respect platform ToS, protect sources and methods, and follow data-protection law for personal data.