Cyber Threat Intelligence and Adversary Tradecraft
Levels and frameworks
Intelligence runs the cycle: planning and direction, collection, processing, analysis and production, dissemination. Threat intelligence has tiers - strategic (intent and posture of a state actor), operational (campaigns), tactical (TTPs), and technical (indicators). The exam expects fluency in three models:
- Cyber Kill Chain (Lockheed Martin): reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives.
- MITRE ATT&CK: tactics as the why, techniques as the how - T1566 phishing, T1071 application-layer protocol, T1059 command and scripting, T1071.004 DNS.
- Diamond Model: adversary, capability, infrastructure, victim, linked by a shared event. Snap a new intrusion onto a known diamond to test attribution hypotheses. Pyramid of Pain ranks indicators by how much they hurt the adversary: hash, IP, domain, network artifact, tools, TTPs. Detection strategy should climb the pyramid.
Tradecraft and sharing
Attribution is probabilistic; use calibrated confidence language. Expect false flags, shared infrastructure, and proxy actors. Share in STIX over TAXII, tag with TLP (RED, AMBER, AMBER+STRICT, GREEN, CLEAR), and note that technical indicators expire as infrastructure rotates.
Worked example
An intrusion uses a signed but abused legitimate binary to proxy execution, then a cloud storage domain for C2. Reasoning: blocking the domain is a short-lived win at the domain tier. The durable detection is behavioral - a signed office binary making unexpected network connections - mapping to T1118-style signed binary proxy execution. That is a TTP-tier detection, high on the pyramid.
Traps that cost marks
Treating an IP blocklist as a strategy; presenting attribution as certainty; ignoring TLP handling; and assuming a shared tool implies a shared actor.