FOR578: Cyber Threat Intelligence

GIAC Cyber Threat Intelligence (GCTI)
GIAC Cyber Threat Intelligence (GCTI)
  • In Person (6 days)
  • Online
36 CPEs
Cyber threat intelligence represents a force multiplier for organizations looking to update their response and detection programs to deal with increasingly sophisticated advanced persistent threats. Malware is an adversary's tool but the real threat is the human one, and cyber threat intelligence focuses on countering those flexible and persistent human threats with empowered and trained human defenders. During a targeted attack, an organization needs a top-notch and cutting-edge threat hunting or incident response team armed with the threat intelligence necessary to understand how adversaries operate and to counter the threat. FOR578: Cyber Threat Intelligence will train you and your team in the tactical, operational, and strategic level cyber threat intelligence skills and tradecraft required to make security teams better, threat hunting more accurate, incident response more effective, and organizations more aware of the evolving threat landscape.

What You Will Learn

There Is No Teacher But The Enemy!

All security practitioners should attend FOR578: Cyber Threat Intelligence to sharpen their analytical skills. This course is unlike any other technical training you have ever experienced. It focuses on structured analysis in order to establish a solid foundation for any security skillset and to amplify existing skills. The course will help practitioners from across the security spectrum:

  • Develop analysis skills to better comprehend, synthesize, and leverage complex scenarios
  • Identify and create intelligence requirements through practices such as threat modeling
  • Understand and develop skills in tactical, operational, and strategic-level threat intelligence
  • Generate threat intelligence to detect, respond to, and defeat focused and targeted threats
  • Learn the different sources to collect adversary data and how to exploit and pivot off of those data
  • Validate information received externally to minimize the costs of bad intelligence
  • Create Indicators of Compromise (IOCs) in formats such as YARA and STIX/TAXII
  • Understand and exploit adversary tactics, techniques, and procedures, and leverage frameworks such as the Kill Chain, Diamond Model, and MITRE ATT&CK
  • Establish structured analytical techniques to be successful in any security role

It is common for security practitioners to call themselves analysts. But how many of us have taken structured analysis training instead of simply attending technical training? Both are important, but very rarely do analysts focus on training on analytical ways of thinking. This course exposes analysts to new mindsets, methodologies, and techniques to complement their existing knowledge and help them establish new best practices for their security teams. Proper analysis skills are key to the complex world that defenders are exposed to on a daily basis.

The analysis of an adversary's intent, opportunity, and capability to do harm is known as cyber threat intelligence. Intelligence is not a data feed, nor is it something that comes from a tool. Intelligence is actionable information that addresses an organization's key knowledge gaps, pain points, or requirements. This collection, classification, and exploitation of knowledge about adversaries gives defenders an upper hand against adversaries and forces defenders to learn and evolve with each subsequent intrusion they face.

Cyber threat intelligence thus represents a force multiplier for organizations looking to establish or update their response and detection programs to deal with increasingly sophisticated threats. Malware is an adversary's tool, but the real threat is the human one, and cyber threat intelligence focuses on countering those flexible and persistent human threats with empowered and trained human defenders.

Knowledge about the adversary is core to all security teams. The red team needs to understand adversaries' methods in order to emulate their tradecraft. The Security Operations Center needs to know how to prioritize intrusions and quickly deal with those that need immediate attention. The incident response team needs actionable information on how to quickly scope and respond to targeted intrusions. The vulnerability management group needs to understand which vulnerabilities matter most for prioritization and the risk that each one presents. The threat hunting team needs to understand adversary behaviors to search out new threats.

In other words, cyber threat intelligence informs all security practices that deal with adversaries. FOR578: Cyber Threat Intelligence will equip you, your security team, and your organization with the level of tactical, operational, and strategic cyber threat intelligence skills and tradecraft required to better understand the evolving threat landscape and accurately and effectively counter those threats.

Business Takeaways:

  • Understand the everchanging cyber threat landscape and what it means for your organization
  • Practice analytic techniques to inform key business leaders on how to most effectively defend themselves and the organization against targeted threats
  • Identify cost-effective ways of leveraging open-source and community threat intelligence tools, along with familiarity with some of the most impactful commercial tools available.
  • Effectively communicate threat intelligence at tactical, operational, and strategic levels
  • Become a force multiplier for other core business functions, including security operations, incident response, and business operations.

Syllabus (36 CPEs)

Download PDF
  • Overview

    Cyber threat intelligence is a rapidly growing field. However, intelligence was a profession long before the word "cyber" entered the lexicon. Understanding the key points regarding intelligence terminology, tradecraft, and impact is vital to understanding and using cyber threat intelligence. This section introduces students to the most important concepts of intelligence, analysis tradecraft, and levels of threat intelligence, as well as the value they can add to organizations. It also focuses on getting your intelligence program off to the right start with planning, direction, and the generation of intelligence requirements. As with all sections, this course section includes immersive hands-on labs to ensure that students have the ability to turn theory into practice.

    • Using Structured Analytical Techniques
    • Enriching and Understanding Limitations
    • Strategic Threat Modeling

    • Case Study: MOONLIGHT MAZE
    • Understanding Intelligence
      • Intelligence Lexicon and Definitions
      • Traditional Intelligence Cycle
      • Richards Heuer, Jr., Sherman Kent, and Intelligence Tradecraft
      • Structured Analytical Techniques
    • Case Study: Operation Aurora
    • Understanding Cyber Threat Intelligence
      • Defining Threats
      • Understanding Risk
      • Cyber Threat Intelligence and Its Role
      • Expectation of Organizations and Analysts
      • Diamond Model and Activity Groups
      • Four Types of Threat Detection
    • Threat Intelligence Consumption
      • Sliding Scale of Cybersecurity
      • Consuming Intelligence for Different Goals
      • Enabling Other Teams with Intelligence
    • Positioning the Team to Generate Intelligence
      • Building an Intelligence Team
      • Positioning the Team in the Organization
      • Prerequisites for Intelligence Generation
    • Planning and Direction (Developing Requirements)
      • Intelligence Requirements
      • Priority Intelligence Requirements
      • Beginning the Intelligence Lifecycle
      • Threat Modeling

  • Overview

    Intrusion analysis is at the heart of threat intelligence. It is a fundamental skillset for any security practitioner who wants to use a more complete approach to addressing security. Three of the most commonly used models for assessing adversary intrusions are the Kill Chain, the Diamond Model, and MITRE ATT&CK. These models serve as a framework and structured scheme for analyzing intrusions and extracting patterns such as adversary behaviors and malicious indicators. In this section students will be walked through and participate in multi-phase intrusions from initial notification of adversary activity to the completion of analysis of the event. The section also highlights the importance of this process in terms of structuring and defining adversary campaigns.

    • Collecting Indicators from Reconnaissance and Delivery
    • Pivoting to Network Data with Indicators
    • Pivoting to Memory with Indicators
    • Understanding the Actions on Objective in an Intrusion
    • Satisfying Priority Intelligence Requirements

    • Primary Collection Source: Intrusion Analysis
      • Intrusion Analysis as a Core Skillset
      • Methods to Performing Intrusion Analysis
      • Intrusion Kill Chain
      • MITRE ATT&CK
      • Diamond Model
    • Kill Chain Courses of Action
      • Passively Discovering Activity in Historical Data and Logs
      • Detecting Future Threat Actions and Capabilities
      • Denying Access to Threats
      • Delaying and Degrading Adversary Tactics and Malware
    • Kill Chain Deep Dive
      • Scenario Introduction
      • Notification of Malicious Activity
      • Pivoting Off of a Single Indicator to Discover Adversary Activity
      • Identifying and Categorizing Malicious Actions
      • Using Network and Host-Based Data
      • Interacting with Incident Response Teams
      • Interacting with Malware Reverse Engineers
      • Effectively Leveraging Requests for Information
    • Handling Multiple Kill Chains
      • Identifying Different Simultaneous Intrusions
      • Managing and Constructing Multiple Kill Chains
      • Linking Related Intrusions
      • Extracting Knowledge from the Intrusions for Long-Term Tracking

  • Overview

    Cyber threat Intelligence analysts must be able to interrogate and fully understand their collection sources. As an example, analysts do not have to be malware reverse engineers, but they must at least understand that work and know what data can be sought. This section continues from the previous one in identifying key collection sources for analysts. The considerable amount of what is commonly referred to as open-source intelligence (OSINT) is also presented. In this section students will learn to seek and exploit information from domains, external datasets, malware, Transport Layer Security/Secure Sockets Layer (TLS/SSL) Certificates, and more. Students will also structure the data to be exploited for purposes of sharing internally and externally.

    • Aggregating and Pivoting in Excel with Malware Samples
    • Open-Source Intelligence and Domain Pivoting in DomainTools
    • Maltego Pivoting and Open-Source Intelligence
    • Sifting Through Massive Amounts of Open-Source Intelligence in RecordedFuture
    • TLS Certificate Pivoting

    • Case Study: HEXANE
    • Collection Source: Malware
        • Data from Malware Analysis
        • Key Data Types to Analyze and Pivot On
        • VirusTotal and Malware Parsers
        • Identifying Intrusion Patterns and Key Indicators
    • Collection Source: Domains
      • Domain Deep Dive
      • Different Types of Adversary Domains
      • Pivoting Off of Information in Domains
    • Case Study: GlassRAT
    • Collection Source: External Datasets
        • Building Repositories from External Datasets
        • Open-Source Intelligence Collection Tools and Frameworks
    • Collection Source: TLS Certificates
      • TLS/SSL Certificates
      • Tracking New Malware Samples and C2 with TLS
      • Pivoting off of Information in TLS Certificates
    • Case Study: Trickbots

  • Overview

    With great data comes great analysis expectations. Now that students are familiar with different sources of intrusions and collection, it is important to apply analytical rigor to how this information is used in order to satisfy intelligence requirements for long-term analysis. Taking a single intrusion and turning it into a group, and tracking the adversary’s campaigns, are critical to staying ahead of adversaries. In this section students will learn how to structure and store their information over the long term using tools such as MISP; how to leverage analytical tools to identify logical fallacies and cognitive biases; how to perform structured analytic techniques in groups such as analysis of competing hypotheses; and how to cluster intrusions into threat groups.

    • Storing Threat Data in MISP
    • Identifying Types of Biases
    • Analysis of Competing Hypotheses
    • Visual Analysis in Maltego
    • The Rule of 2 and Threat Groups

    • Case Study: Human-Operated Ransomware
    • Exploitation: Storing and Structuring Data
      • Storing Threat Data
      • Threat Information Sharing
      • MISP as a Storage Platform
    • Analysis: Logical Fallacies and Cognitive Biases
      • Logical Fallacies
      • Cognitive Biases
      • Common Cyber Threat Intelligence Informal Fallacies
    • Analysis: Exploring Hypotheses
      • Analysis of Competing Hypotheses
      • Hypotheses Generation
      • Understanding and Identifying Knowledge Gaps
    • Analysis: Different Types of Analysis
      • Visual Analysis
      • Data Analysis
      • Temporal Analysis
      • Case Study: Panama Papers
      • Analysis: Clustering Intrusions
      • Style Guide
      • Names and Clustering Rules
    • ACH for Intrusions
    • Activity Groups and Diamond Model for Clusters
      • Style Guide
      • Names and Clustering Rules
      • ACH for Intrusions
      • Activity Groups and Diamond Model for Clusters

  • Overview

    Intelligence is useless if not disseminated and made useful to the consumer. In this section students will learn about dissemination at the various tactical, operational, and strategic levels. Labs will expose students to creating YARA rules, leveraging STIX/TAXII, building campaign heat maps for tracking adversaries over the long term, and analyzing intelligence reports. Students will also learn about state adversary attribution, including when it can be of value and when it is merely a distraction. We’ll cover state-level attribution from previously identified campaigns, and students will take away a more holistic view of the Cyber Threat Intelligence industry to date. The section will finish with a discussion on consuming threat intelligence and actionable takeaways so that students will be able to make significant changes in their organizations once they complete the course.

    • Developing IOCs in YARA
    • Working with STIX
    • Building a Campaign Heatmap
    • Analysis of Intelligence Reports
    • Building an Attribution Intelligence Model

    • Logical Fallacies and Cognitive Biases
      • Identifying and Defeating Bias
      • Logical Fallacies and Examples
      • Common Cyber Threat Intelligence Informal Fallacies
      • Cognitive Biases and Examples
    • Dissemination: Tactical
      • Understanding the Audience and Consumer
      • Threat Data Feeds and Their Limitations
      • YARA
      • YARA Concepts and Examples
    • Dissemination: Operational
      • Different Methods of Campaign Correlation
      • Understanding Perceived Adversary Intentions
      • Leveraging the Diamond Model for Campaign Analysis
      • STIX and TAXII
      • Government and Partner Collaboration
    • Dissemination: Strategic
      • Report Writing Pitfalls
      • Report Writing Best Practices
      • Different Types of Strategic Output
    • Case Study: APT10 and Cloud Hopper
    • A Specific Intelligence Requirement: Attribution
      • Identifying and Remedying New Intelligence Requirements
      • Tuning the Collection Management Framework
      • Types of Attribution
      • Building an Attribution Model
      • Conducting Attribution Assessments
    • Case Study: Lazarus Group

  • Overview

    The FOR578 capstone focuses on analysis. Students will be placed on teams, given outputs of technical tools and cases, and work to piece together the relevant information from a single intrusion that enables them to unravel a broader campaign. Students will get practical experience satisfying intelligence requirements ranging from helping the incident response team to satisfying state-level attribution goals. This analytical process will put the students' minds to the test instead of placing a heavy emphasis on using technical tools. At the end of the day the teams will present their analyses on the multi-campaign threat they have uncovered.

GIAC Cyber Threat Intelligence

The GIAC Cyber Threat Intelligence (GCTI) certification validates practitioners have demonstrated requisite fundamental strategic, operational, and tactical cyber threat intelligence knowledge and skills.

  • Strategic, operational, and tactical cyber threat intelligence application & fundamentals
  • Open source intelligence and campaigns
  • Intelligence applications and intrusion analysis
  • Analysis of intelligence, attribution, collecting and storing data sets
  • Kill chain, diamond model, and courses of action matrix
  • Malware as a collection source, pivoting, and sharing intelligence
More Certification Details


FOR578 is a good course for anyone who has had security training or prior experience in the field. Students should be comfortable with using the command line in Linux for a few labs (though a walkthrough is provided) and be familiar with security terminology.

Some of the courses that lead in to FOR578:

Students who have not taken any of the above courses but have real-world experience or have attended other security training, such as any other SANS class, will be comfortable in the course. New students and veterans will be exposed to new concepts given the unique style of the class focused on analysis training.

Laptop Requirements

Important! Bring your own system configured according to these instructions.

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will not be able to fully participate in hands-on exercises in your course. Therefore, please arrive with a system meeting all of the specified requirements.

Back up your system before class. Better yet, use a system without any sensitive/critical data. SANS is not responsible for your system or data.

  • CPU: 64-bit Intel i5/i7 (8th generation or newer), or AMD equivalent. A x64 bit, 2.0+ GHz or newer processor is mandatory for this class.
  • CRITICAL: Apple Silicon devices cannot perform the necessary virtualization and therefore cannot in any way be used for this course.
  • BIOS settings must be set to enable virtualization technology, such as "Intel-VTx" or "AMD-V" extensions. Be absolutely certain you can access your BIOS if it is password protected, in case changes are necessary.
  • 16GB of RAM or more is required.
  • 100GB of free storage space or more is required.
  • At least one available USB 3.0 Type-A port. A Type-C to Type-A adapter may be necessary for newer laptops. Some endpoint protection software prevents the use of USB devices, so test your system with a USB drive before class.
  • Wireless networking (802.11 standard) is required. There is no wired Internet access in the classroom.
  • Your host operating system must be the latest version of Windows 10, Windows 11, or macOS 10.15.x or newer.
  • Fully update your host operating system prior to the class to ensure you have the right drivers and patches installed.
  • Linux hosts are not supported in the classroom due to their numerous variations. If you choose to use Linux as your host, you are solely responsible for configuring it to work with the course materials and/or VMs.
  • Local Administrator Access is required. (Yes, this is absolutely required. Don't let your IT team tell you otherwise.) If your company will not permit this access for the duration of the course, then you should make arrangements to bring a different laptop.
  • You should ensure that antivirus or endpoint protection software is disabled, fully removed, or that you have the administrative privileges to do so. Many of our courses require full administrative access to the operating system and these products can prevent you from accomplishing the labs.
  • Any filtering of egress traffic may prevent accomplishing the labs in your course. Firewalls should be disabled or you must have the administrative privileges to disable it.
  • Microsoft Office (any version) installed on your host. Note that you can download Office Trial Software online (free for 30 days).
  • Download and install VMware Workstation Pro 16.2.X+ or VMware Player 16.2.X+ (for Windows 10 hosts), VMware Workstation Pro 17.0.0+ or VMware Player 17.0.0+ (for Windows 11 hosts), or VMWare Fusion Pro 12.2+ or VMware Fusion Player 11.5+ (for macOS hosts) prior to class beginning. If you do not own a licensed copy of VMware Workstation Pro or VMware Fusion Pro, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial at their website. Also note that VMware Workstation Player offers fewer features than VMware Workstation Pro. For those with Windows host systems, Workstation Pro is recommended for a more seamless student experience.
  • On Windows hosts, VMware products might not coexist with the Hyper-V hypervisor. For the best experience, ensure VMware can boot a virtual machine. This may require disabling Hyper-V. Instructions for disabling Hyper-V, Device Guard, and Credential Guard are contained in the setup documentation that accompanies your course materials.
  • Download and install 7-Zip (for Windows Hosts) or Keka (for macOS hosts). These tools are also included in your downloaded course materials.

Your course media is delivered via download. The media files for class can be large. Many are in the 40-50GB range, with some over 100GB. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as soon as you get the link. You will need your course media immediately on the first day of class. Do not wait until the night before class to start downloading these files.

Your course materials include a "Setup Instructions" document that details important steps you must take before you travel to a live class event or start an online class. It may take 30 minutes or more to complete these instructions.

Your class uses an electronic workbook for its lab instructions. In this new environment, a second monitor and/or a tablet device can be useful for keeping class materials visible while you are working on your course's labs.

If you have additional questions about the laptop specifications, please contact support.

Author Statement

The author team of Mike Cloppert, Chris Sperry, and Robert M. Lee originally developed FOR578: Cyber Threat Intelligence with the understanding that the community was in need of a single concise collection of tradecraft. Cloppert and Sperry initiated the development of the course with the understanding that their schedules would not permit them to be able to constantly teach it. However, it was through their thought leadership that the class has become what it is today. Their influence on the development of the course remains relevant today, and SANS thanks them for their leadership.

"When considering the value of threat intelligence, most individuals and organizations ask themselves three questions: What is threat intelligence? When am I ready for it? How do I use it? This class answers these questions and more at a critical point in the development of the field of threat intelligence in the wider community. The course will empower analysts of any technical background to think more critically and be prepared to face persistent and focused threats."

- Robert M. Lee

"Threat intelligence is a powerful tool in the hands of a trained analyst. It can provide insight to all levels of a security program, from security analysts responding to tactical threats against the network to executives reporting strategic-level threats to the Board of Directors. This course will give students an understanding of the role of threat intelligence in security operations and how it can be leveraged as a game-changing resource to combat an increasingly sophisticated adversary."

- Rebekah Brown

"This has been one of the most interesting and exciting courses I've taken as a student-turned-professional of cyber security. Rob M. Lee does a fantastic job of getting one prepared for the role of a CTI analyst, and having recently read the book "Sandworm," I'm geeking out really hard knowing that he's the one teaching this course. I enjoy the fact that not only does he provide insight into the world of CTI, but he provides case studies to identify both the pitfalls and big victories of threat analysis. I could not be more excited to continue this course." - James H, US State Gov


This course is terrific! Class discussion and relevant case studies are extremely helpful for better understanding the content.
Larci Robertson
Cyber Threat Intelligence is an entire discipline, not just a feed. This course will propel you along the path to understanding this rapidly maturing field of study.
Bertha Marasky
Threat intelligence analysis has been an art for too long, now it can finally become a science at SANS. Mike Cloppert and Robert M. Lee are the industry 'greybeards' who have seen it all. They are the thought leaders who should be shaping practitioners for years to come.
Rich Barger

    Register for FOR578

    Learn about Group Pricing

    Prices below exclude applicable taxes and shipping costs. If applicable, these will be shown on the last page of checkout.