FOR578: Cyber Threat Intelligence

Overview

Cyber threat intelligence is a rapidly growing field. However, intelligence was a profession long before the word "cyber" entered the lexicon. Understanding the key points regarding intelligence terminology, tradecraft, and impact is vital to understanding and using cyber threat intelligence. This section introduces students to the most important concepts of intelligence, analysis tradecraft, and levels of threat intelligence, as well as the value they can add to organizations. It also focuses on getting your intelligence program off to the right start with planning, direction, and the generation of intelligence requirements. As with all sections, this course section includes immersive hands-on labs to ensure that students have the ability to turn theory into practice.

Exercises

• Using Structured Analytical Techniques
• Enriching and Understanding Limitations
• Strategic Threat Modeling

Topics

• Case Study: MOONLIGHT MAZE
• Understanding Intelligence
• Intelligence Lexicon and Definitions
• Traditional Intelligence Cycle
• Richards Heuer, Jr., Sherman Kent, and Intelligence Tradecraft
• Structured Analytical Techniques
• Case Study: Operation Aurora
• Understanding Cyber Threat Intelligence
• Defining Threats
• Understanding Risk
• Cyber Threat Intelligence and Its Role
• Expectation of Organizations and Analysts
• Diamond Model and Activity Groups
• Four Types of Threat Detection
• Threat Intelligence Consumption
• Sliding Scale of Cybersecurity
• Consuming Intelligence for Different Goals
• Enabling Other Teams with Intelligence
• Positioning the Team to Generate Intelligence
• Building an Intelligence Team
• Positioning the Team in the Organization
• Prerequisites for Intelligence Generation
• Planning and Direction (Developing Requirements)
• Intelligence Requirements
• Priority Intelligence Requirements
• Beginning the Intelligence Lifecycle
• Threat Modeling

Overview

Intrusion analysis is at the heart of threat intelligence. It is a fundamental skillset for any security practitioner who wants to use a more complete approach to addressing security. Three of the most commonly used models for assessing adversary intrusions are the Kill Chain, the Diamond Model, and MITRE ATT&CK. These models serve as a framework and structured scheme for analyzing intrusions and extracting patterns such as adversary behaviors and malicious indicators. In this section students will be walked through and participate in multi-phase intrusions from initial notification of adversary activity to the completion of analysis of the event. The section also highlights the importance of this process in terms of structuring and defining adversary campaigns.

Exercises

• Collecting Indicators from Reconnaissance and Delivery
• Pivoting to Network Data with Indicators
• Pivoting to Memory with Indicators
• Understanding the Actions on Objective in an Intrusion
• Satisfying Priority Intelligence Requirements

Topics

• Primary Collection Source: Intrusion Analysis
• Intrusion Analysis as a Core Skillset
• Methods to Performing Intrusion Analysis
• Intrusion Kill Chain
• MITRE ATT&CK
• Diamond Model
• Kill Chain Courses of Action
• Passively Discovering Activity in Historical Data and Logs
• Detecting Future Threat Actions and Capabilities
• Denying Access to Threats
• Delaying and Degrading Adversary Tactics and Malware
• Kill Chain Deep Dive
• Scenario Introduction
• Notification of Malicious Activity
• Pivoting Off of a Single Indicator to Discover Adversary Activity
• Identifying and Categorizing Malicious Actions
• Using Network and Host-Based Data
• Interacting with Incident Response Teams
• Interacting with Malware Reverse Engineers
• Effectively Leveraging Requests for Information
• Handling Multiple Kill Chains
• Identifying Different Simultaneous Intrusions
• Managing and Constructing Multiple Kill Chains
• Linking Related Intrusions
• Extracting Knowledge from the Intrusions for Long-Term Tracking

Overview

Cyber threat Intelligence analysts must be able to interrogate and fully understand their collection sources. As an example, analysts do not have to be malware reverse engineers, but they must at least understand that work and know what data can be sought. This section continues from the previous one in identifying key collection sources for analysts. The considerable amount of what is commonly referred to as open-source intelligence (OSINT) is also presented. In this section students will learn to seek and exploit information from domains, external datasets, malware, Transport Layer Security/Secure Sockets Layer (TLS/SSL) Certificates, and more. Students will also structure the data to be exploited for purposes of sharing internally and externally.

Exercises

• Aggregating and Pivoting in Excel with Malware Samples
• Open-Source Intelligence and Domain Pivoting in DomainTools
• Maltego Pivoting and Open-Source Intelligence
• Sifting Through Massive Amounts of Open-Source Intelligence in RecordedFuture
• TLS Certificate Pivoting

Topics

• Case Study: HEXANE
• Collection Source: Malware
• Data from Malware Analysis
• Key Data Types to Analyze and Pivot On
• VirusTotal and Malware Parsers
• Identifying Intrusion Patterns and Key Indicators
• Collection Source: Domains
• Domain Deep Dive
• Different Types of Adversary Domains
• Pivoting Off of Information in Domains
• Case Study: GlassRAT
• Collection Source: External Datasets
• Building Repositories from External Datasets
• Open-Source Intelligence Collection Tools and Frameworks
• Collection Source: TLS Certificates
• TLS/SSL Certificates
• Tracking New Malware Samples and C2 with TLS
• Pivoting off of Information in TLS Certificates
• Case Study: Trickbots

Overview

With great data comes great analysis expectations. Now that students are familiar with different sources of intrusions and collection, it is important to apply analytical rigor to how this information is used in order to satisfy intelligence requirements for long-term analysis. Taking a single intrusion and turning it into a group, and tracking the adversary’s campaigns, are critical to staying ahead of adversaries. In this section students will learn how to structure and store their information over the long term using tools such as MISP; how to leverage analytical tools to identify logical fallacies and cognitive biases; how to perform structured analytic techniques in groups such as analysis of competing hypotheses; and how to cluster intrusions into threat groups.

Exercises

• Storing Threat Data in MISP
• Identifying Types of Biases
• Analysis of Competing Hypotheses
• Visual Analysis in Maltego
• The Rule of 2 and Threat Groups

Topics

• Case Study: Human-Operated Ransomware
• Exploitation: Storing and Structuring Data
• Storing Threat Data
• Threat Information Sharing
• MISP as a Storage Platform
• Analysis: Logical Fallacies and Cognitive Biases
• Logical Fallacies
• Cognitive Biases
• Common Cyber Threat Intelligence Informal Fallacies
• Analysis: Exploring Hypotheses
• Analysis of Competing Hypotheses
• Hypotheses Generation
• Understanding and Identifying Knowledge Gaps
• Analysis: Different Types of Analysis
• Visual Analysis
• Data Analysis
• Temporal Analysis
• Case Study: Panama Papers
• Analysis: Clustering Intrusions
• Style Guide
• Names and Clustering Rules
• ACH for Intrusions
• Activity Groups and Diamond Model for Clusters
• Style Guide
• Names and Clustering Rules
• ACH for Intrusions
• Activity Groups and Diamond Model for Clusters

Overview

Intelligence is useless if not disseminated and made useful to the consumer. In this section students will learn about dissemination at the various tactical, operational, and strategic levels. Labs will expose students to creating YARA rules, leveraging STIX/TAXII, building campaign heat maps for tracking adversaries over the long term, and analyzing intelligence reports. Students will also learn about state adversary attribution, including when it can be of value and when it is merely a distraction. We’ll cover state-level attribution from previously identified campaigns, and students will take away a more holistic view of the Cyber Threat Intelligence industry to date. The section will finish with a discussion on consuming threat intelligence and actionable takeaways so that students will be able to make significant changes in their organizations once they complete the course.

Exercises

• Developing IOCs in YARA
• Working with STIX
• Building a Campaign Heatmap
• Analysis of Intelligence Reports
• Building an Attribution Intelligence Model

Topics

• Logical Fallacies and Cognitive Biases
• Identifying and Defeating Bias
• Logical Fallacies and Examples
• Common Cyber Threat Intelligence Informal Fallacies
• Cognitive Biases and Examples
• Dissemination: Tactical
• Understanding the Audience and Consumer
• Threat Data Feeds and Their Limitations
• YARA
• YARA Concepts and Examples
• Dissemination: Operational
• Different Methods of Campaign Correlation
• Understanding Perceived Adversary Intentions
• Leveraging the Diamond Model for Campaign Analysis
• STIX and TAXII
• Government and Partner Collaboration
• Dissemination: Strategic
• Report Writing Pitfalls
• Report Writing Best Practices
• Different Types of Strategic Output
• Case Study: APT10 and Cloud Hopper
• A Specific Intelligence Requirement: Attribution
• Identifying and Remedying New Intelligence Requirements
• Tuning the Collection Management Framework
• Types of Attribution
• Building an Attribution Model
• Conducting Attribution Assessments
• Case Study: Lazarus Group

Overview

The FOR578 capstone focuses on analysis. Students will be placed on teams, given outputs of technical tools and cases, and work to piece together the relevant information from a single intrusion that enables them to unravel a broader campaign. Students will get practical experience satisfying intelligence requirements ranging from helping the incident response team to satisfying state-level attribution goals. This analytical process will put the students' minds to the test instead of placing a heavy emphasis on using technical tools. At the end of the day the teams will present their analyses on the multi-campaign threat they have uncovered.