TPFP TI cheat sheet

Intelligence cycle: direction/planning → collection → processing → analysis → dissemination → feedback; each phase feeds the next and feedback restarts direction.

Data vs information vs intelligence: raw observables are data; contextualized data is information; information assessed for relevance to a decision is intelligence.

Pyramid of Pain (Bianco), low to high attacker cost: hash values → IP addresses → domain names → network/host artifacts → tools → TTPs.

Levels of intelligence: strategic (leadership, long-term risk), operational (campaigns, targeting), tactical (TTPs and immediate defense).

Intelligence types by source: HUMINT, SIGINT, OSINT, MASINT, GEOINT, TECHINT; cyber adds closed/paid feeds and telemetry.

A threat actor is characterized by motivation, capability, and intent; APT implies sustained resourcing and persistence, not a specific country.

Indicator confidence decays with time: IP and domain indicators are volatile; TTP-based detection is more durable than atomic indicators.

Diamond Model nodes: adversary, capability, infrastructure, victim; edges are social-political, technical, and operational relationships.

Source categories: OSINT (public), commercial/paid feeds, ISACs and sector sharing groups, government advisories (CISA, NCSC), and internal telemetry.

Collection planning matches requirements to sources; define scope, cadence, format, and retention before ingesting any feed.

Indicator standards: STIX 2.1 objects (indicator, malware, threat-actor, observed-data) transported over TAXII 2.1 collections.

Feed quality checks: freshness (last seen), coverage, false-positive rate, deduplication, and provenance of the original sighting.

Honeypots and sinkholes provide high-fidelity, low-noise collection; sinkhole data reveals malware families still beaconing internally.

Passive DNS and WHOIS/RDAP history enrich domains with resolution and registration context that current records alone do not show.

Crawling and scraping must respect robots.txt, terms of service, and rate limits; unauthenticated access to private forums is unauthorized.

Normalization before storage: convert timestamps to UTC, standardize hashes to lowercase, and map fields to a common schema.

Structured Analytic Techniques counter bias: ACH (Analysis of Competing Hypotheses), key assumptions check, devil's advocacy, red team analysis.

Confidence language: use an explicit scale (e.g., low/moderate/high) tied to source reliability and corroboration, not to analyst seniority.

Admiralty grading: source reliability A–F crossed with information credibility 1–6; A1 is fully reliable and confirmed.

Kill Chain (Lockheed Martin) phases: reconnaissance, weaponization, delivery, exploitation, installation, C2, actions on objectives.

ATT&CK maps adversary behavior to tactics (why) and techniques (how); use technique IDs (e.g., T1566) for consistent reporting.

Pivoting: from an indicator, expand via passive DNS, certificate transparency, WHOIS, malware similarity, and infrastructure overlap.

False positive vs false negative trade-off: tightening detection reduces noise but raises missed detections; tune to the asset's risk.

Products: tactical indicator feeds, operational campaign reports, strategic assessments; each has a distinct audience and time horizon.

TLP 2.0 markings: RED (named recipients only), AMBER (organization plus clients on need-to-know), AMBER+STRICT (organization only), GREEN (community), CLEAR (public).

TLP marking must travel with the content; re-sharing requires the recipient to honor the original marking and any added caveats.

Sharing models: hub-and-spoke (ISAC/ISAO), peer-to-peer bilateral, and automated machine-to-machine via TAXII.

STIX/TAXII enables structured, automatable sharing; PDF and email remain common but are not machine-readable.

Traffic Light Protocol is not a legal contract; sharing agreements (NDA, MOU, ISAC membership terms) define actual obligations.

De-identification before sharing: strip victim names, internal IPs, and PII unless the agreement and law permit disclosure.

Dissemination timing: tactical indicators need speed, strategic assessments need accuracy; late intelligence loses operational value.

Feedback loop: recipients report whether shared indicators were seen and were accurate, which recalibrates source grading.

OPSEC process: identify critical information, analyze threats, analyze vulnerabilities, assess risk, apply countermeasures.

Attribution is probabilistic; legal and policy responses require a standard of proof higher than analytic confidence alone.

Computer Fraud and Abuse Act (US) and Computer Misuse Act (UK) criminalize unauthorized access; "authorized" requires explicit written scope.

GDPR and similar privacy laws restrict processing of personal data; threat intel containing PII needs a lawful basis and minimization.

Rules of engagement for active defense define permitted actions, escalation paths, and legal sign-off before any countermeasure.

Hacking back is generally unlawful in most jurisdictions and risks collateral damage to third parties and misattribution.

Handling sensitive sources: compartmentalize access, log who viewed what, and protect human sources whose exposure risks harm.

Ethical duties: accuracy, avoiding fear amplification, disclosing uncertainty, and not naming victims without consent.

TIP (Threat Intelligence Platform) aggregates, deduplicates, scores, and distributes indicators; examples include MISP and OpenCTI.

MISP: open-source sharing platform with events, attributes, galaxies, and taxonomies; supports STIX export and TAXII.

OpenCTI: graph-based knowledge base on STIX 2.1 with connectors to feeds, sandboxes, and SIEMs.

SIEM correlates logs and alerts; SOAR automates response playbooks; TIP feeds both with curated indicators.

Sandboxes (Cuckoo, CAPE, vendor clouds) produce behavioral reports; treat sandbox output as untrusted and evasive.

Enrichment services: VirusTotal, passive DNS, WHOIS/RDAP, certificate transparency, and hash reputation lookups.

Detection engineering tools: Sigma (vendor-neutral rules), YARA (file/memory patterns), Suricata/Snort (network signatures).

Feed integration hygiene: rate-limit API calls, cache results, rotate keys, and monitor for expired or revoked credentials.

IR lifecycle (NIST SP 800-61): preparation → detection and analysis → containment, eradication, recovery → post-incident activity.

Intelligence-driven IR: use TTPs and IOCs to scope the intrusion, prioritize containment, and predict the adversary's next move.

Hypothesis-driven hunting: form a testable hypothesis from intel (e.g., T1566 phishing), then query telemetry to confirm or refute.

Hunting loop: hypothesis → data collection → query/analysis → finding → new detection or hunt; document negative results too.

IOC sweep vs TTP hunt: IOC sweeps are fast but fragile; behavioral hunts survive infrastructure rotation.

Pivot during IR: from a compromised host, examine parent-child process trees, network egress, scheduled tasks, and persistence.

Purple teaming converts hunt findings into detections validated by controlled adversary emulation (e.g., Atomic Red Team).

Post-incident: update intel requirements, add detections, and share sanitized indicators per TLP and legal review.