Threat Intelligence, Hunting, and Analytics
Intelligence tiers
Strategic intel describes adversary intent, operational intel describes campaigns and TTPs, tactical intel maps to ATT&CK techniques, and technical intel supplies IOCs such as hashes, domains and IPs. Assess every feed on confidence, freshness, source reliability and sharing constraints (TLP).
Pyramid of pain
Hashes are trivially changed, IPs and domains are cheap, tools are harder, and TTPs are hardest for an adversary to abandon. Detections anchored on TTPs remain effective long after IOC-based rules expire; treat IOCs as enrichment and scoping aids rather than the foundation of your detection library.
Hypothesis-driven hunting
A hunt is not exploratory browsing. Structure it as: hypothesis → required data sources → query → findings → new or tuned detection. Start from a technique, express it in platform query language, and baseline against normal environment behavior. Portable rules (for example Sigma) can be translated across platforms; validate before production using adversary-emulation frameworks rather than assuming a rule works.
Analytics quality
Correlation and user-behavior analytics raise signal by combining weak indicators per entity. Precision matters: a rule firing hundreds of times daily trains analysts to ignore it, which is worse than having no rule.
Worked example
Hypothesis: adversaries use certutil -urlcache to fetch payloads. Query process events for certutil with URL arguments over 30 days. Result: two hits, both from the patch-management service account on a known server. Reasoning: environmental context explains both as benign, but the rule should now scope to workstations and non-service contexts, cutting noise while retaining coverage of the actual technique.
Traps that cost marks
- Blocking IOCs without context or expiry.
- Hunting without a written hypothesis, producing findings you cannot operationalize.
- Ignoring false-positive rate when deploying a detection.
- Relying on stale infrastructure intel for domains that have been re-registered or sinkholed.