I85PREP
⌘ K
CNCDP study materials
CNCDP study resources

CNCDP: Threat Landscape and Threat Intelligence

CNCDP · Work through your exam, one topic at a time.

All guide sections

Threat Landscape and Threat Intelligence

Threat Landscape and Threat Intelligence

This domain tests whether you can characterize adversaries and turn raw indicators into decisions. Expect items on actor types, intelligence levels, analytic frameworks, sharing standards, and the difference between an indicator sweep and behavior-based detection.

Core rules and concepts

  • Actor categories: nation-state/APT (persistent, well resourced, long dwell time), organized crime and ransomware affiliates operating under ransomware-as-a-service with initial access brokers, hacktivists (disruption, defacement, DDoS), insider threat (fraud, espionage, negligence), and commodity script kiddies exploiting known CVEs.
  • Intelligence levels: strategic (board-level risk and trends), operational (campaigns, actor intent), tactical (TTPs and adversary tradecraft), technical (hashes, IPs, domains, YARA rules).
  • Pyramid of Pain (Bianco): hash values → IP addresses → domain names → network/host artifacts → tools → TTPs. The higher you detect, the more cost you impose on the adversary; IOCs decay in hours to weeks, TTPs persist for years.
  • Frameworks: MITRE ATT&CK organizes adversary behavior into 14 enterprise tactics from Reconnaissance and Resource Development through Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration and Impact; techniques carry IDs such as T1566 (Phishing) and T1486 (Data Encrypted for Impact). The Cyber Kill Chain describes seven sequential phases. The Diamond Model relates adversary, capability, infrastructure and victim.
  • Intelligence cycle: direction, collection, processing, analysis, dissemination, feedback. Analysis is where raw data becomes assessed intelligence with stated confidence.
  • Sharing: STIX 2.1 objects exchanged over TAXII 2.1; MISP for community sharing; Traffic Light Protocol 2.0 markings CLEAR, GREEN, AMBER, AMBER+STRICT, RED govern onward distribution.

Worked example

A user opens an invoice attachment; a macro spawns PowerShell, which beacons over HTTPS to a new domain, then rundll32 loads a credential dumper, and RDP is used to reach a file server. Map it: T1566.001 (spearphishing attachment) → T1204.002 (user execution) → T1059.001 (PowerShell) → T1071.001 (web protocols C2) → T1003 (OS credential dumping) → T1021.001 (RDP). Reasoning: the technique chain, not the domain or hash, is the durable product - detection should target script-block and process-creation telemetry for that sequence.

Traps that cost marks

  • Mixing tactic (the why) with technique (the how) in ATT&CK answers.
  • Treating a feed as ground truth; intelligence needs source reliability and confidence.
  • Recommending blocklists as the primary control when the activity is post-compromise.
  • Misapplying TLP: AMBER is limited distribution, RED is named recipients only, CLEAR is public.