Threat Intelligence — Explain threat intelligence concepts...

SECTION 1

Historical Context & Motivation

The discipline of threat intelligence grew out of a fundamental asymmetry in information security: defenders had to protect every possible entry point, while attackers needed only one exploitable weakness. Early security efforts in the 1990s relied on signature-based antivirus tools and perimeter firewalls — purely reactive measures that could only identify threats already cataloged in vendor databases. As adversaries evolved beyond opportunistic script-kiddies into organized criminal syndicates and state-sponsored groups, the security community recognized that defenders needed a systematic way to study attacker behavior, share intelligence across organizations, and proactively anticipate the next move in an ongoing digital chess match.

1986

Clifford Stoll & The Cuckoo's Egg

Astronomer Clifford Stoll tracked a 75-cent accounting discrepancy to a KGB-backed hacker, pioneering the idea of tracing adversary activity through observable artifacts — an early precursor to modern IOC analysis.

2004

US-CERT and Early Sharing Frameworks

The United States Computer Emergency Readiness Team formalized government-industry information sharing, establishing that coordinated intelligence dissemination could reduce mean time to detect threats across entire sectors.

2011

Lockheed Martin's Cyber Kill Chain

Lockheed Martin published the Cyber Kill Chain framework, decomposing intrusions into sequential phases — from reconnaissance to actions on objectives — and demonstrating that understanding adversary TTPs could enable proactive defense.

2013

MITRE ATT&CK Inception

MITRE began developing ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge), a knowledge base cataloging real-world adversary behaviors observed in enterprise intrusions, rapidly becoming the lingua franca for TTP documentation.

2017

STIX/TAXII 2.0 Standardization

OASIS ratified STIX 2.0 and TAXII 2.0 as open standards for representing and exchanging threat intelligence in machine-readable formats, enabling automated intelligence sharing at global scale.

The central question that threat intelligence addresses is deceptively simple: Who is attacking us, how are they doing it, and what can we do about it before they succeed? Answering this question requires moving beyond raw data — firewall logs, malware samples, vulnerability scans — toward contextualized, actionable knowledge about adversary capabilities, infrastructure, and operational patterns. The concepts of Indicators of Compromise (IOCs) and Tactics, Techniques, and Procedures (TTPs) form the twin pillars of this discipline, representing two complementary lenses through which security teams can understand and respond to threats.

SECTION 2

Core Principles & Definitions

Threat intelligence is the evidence-based knowledge — including context, mechanisms, indicators, implications, and actionable advice — about an existing or emerging menace to assets. It is not merely a feed of IP addresses or file hashes; rather, it is the product of a structured analytical process that transforms raw data into knowledge that decision-makers can act upon. The discipline rests on several foundational principles that distinguish it from generic security monitoring.

Indicators of Compromise (IOCs)

Observable forensic artifacts — such as IP addresses, domain names, file hashes, or registry keys — that signal a system has been compromised or is under active attack. IOCs are atomic, machine-readable, and readily consumed by SIEMs and endpoint detection tools.

Tactics, Techniques & Procedures (TTPs)

A hierarchical description of adversary behavior. Tactics describe the 'why' (adversary goals), techniques describe the 'how' (methods to achieve the goal), and procedures describe the specific implementation details observed in real incidents.

The Intelligence Lifecycle

A cyclical process comprising six phases: Direction (defining requirements), Collection (gathering raw data), Processing (normalization), Analysis (interpretation), Dissemination (sharing), and Feedback (refining the process).

The Pyramid of Pain

David Bianco's model ranking indicator types by the cost to the adversary when defenders detect and block them. Hash values sit at the base (trivial for attackers to change), while TTPs occupy the apex — denying an adversary their behavioral patterns forces them to fundamentally retool their operations.

Intelligence Levels

Threat intelligence operates at three levels: strategic (high-level trends for executives), operational (campaign-level details for security managers), and tactical (technical indicators for SOC analysts and automated tools).

✦ KEY TAKEAWAY

Think of IOCs and TTPs like solving a crime. IOCs are the fingerprints, shell casings, and tire tracks left at a crime scene — they tell you someone was there. TTPs, on the other hand, are the criminal's modus operandi: the way they case the target, pick the lock, disable the alarm, and exfiltrate valuables. A burglar can wear new gloves to avoid leaving fingerprints (changing IOCs), but fundamentally altering their methodology is far harder and costlier. This is why TTP-level intelligence sits at the top of the Pyramid of Pain — it imposes maximum cost on adversaries.

SECTION 3

The Pyramid of Pain — A Visual Framework

The Pyramid of Pain, introduced by security researcher David Bianco in 2013, provides a powerful mental model for evaluating the relative value of different indicator types. The pyramid arranges indicators from the base (easiest for attackers to change) to the apex (hardest to change), and simultaneously from least useful to most useful for defenders. Understanding this hierarchy is critical for security operations teams allocating their analytical resources, because investing heavily in hash-value matching yields far less defensive leverage than understanding adversary TTPs.

The Pyramid of Pain shows six levels of threat indicators arranged by the cost imposed on adversaries when defenders detect and block them. Hash values at the base are trivially changed (recompile malware, get a new hash), while TTPs at the apex represent deeply ingrained adversary tradecraft that is expensive to abandon.

The diagram illustrates a key strategic insight: if your security operations center (SOC) only consumes hash-based IOC feeds, an adversary can evade detection simply by recompiling their payload — a process that takes seconds and produces a completely new SHA-256 hash. Conversely, if your detection capabilities are tuned to recognize behavioral patterns — such as an adversary's use of a specific lateral movement technique followed by a particular data-staging procedure — the attacker must fundamentally redesign their operation to evade detection. This is why modern threat intelligence programs invest heavily in TTP cataloging using frameworks like MITRE ATT&CK.

SECTION 4

The Intelligence Lifecycle & Processing Pipeline

Threat intelligence is not a product you simply purchase — it is the output of a rigorous analytical process. The Intelligence Lifecycle (sometimes called the Intelligence Cycle) is a six-phase feedback loop adapted from military intelligence doctrine. Each phase feeds into the next, and the feedback phase ensures that subsequent iterations produce intelligence that is increasingly relevant and actionable for the consuming organization.

The six-phase Intelligence Lifecycle forms a continuous loop. Direction defines intelligence requirements; Collection gathers raw data from sources; Processing normalizes and deduplicates; Analysis interprets meaning; Dissemination delivers to stakeholders; and Feedback refines future requirements.

Phase Breakdown

Direction: Stakeholders define priority intelligence requirements (PIRs). For example, a financial institution might specify: 'What banking trojan campaigns are targeting our sector, and what TTPs do they employ?'
Collection: Analysts gather raw data from open-source intelligence (OSINT), commercial feeds, dark web monitoring, honeypots, internal telemetry, ISACs, and government advisories.
Processing: Raw data is normalized into structured formats (e.g., STIX objects), deduplicated, enriched with metadata such as geolocation or WHOIS data, and assigned confidence scores.
Analysis: Analysts apply structured techniques — competing hypotheses, diamond model analysis, kill chain mapping — to transform processed data into contextualized intelligence.
Dissemination: Intelligence products are delivered in appropriate formats: machine-readable IOC feeds for automated tools, written reports for operations teams, and executive briefings for strategic decision-makers.
Feedback: Consumers evaluate the relevance, timeliness, and accuracy of the intelligence, which feeds back into the direction phase to refine future requirements.

💡 Data vs. Information vs. Intelligence

A common misconception is conflating data with intelligence. Data is a raw IP address in a log. Information is knowing that IP is associated with a known C2 server. Intelligence is understanding that the C2 server belongs to APT28, which is currently targeting your sector using spear-phishing with a specific lure document, and your organization has not yet deployed mitigations for their preferred initial access technique.

SECTION 5

IOCs and TTPs — A Detailed Classification

Indicators of Compromise (IOCs) — Types and Examples

IOCs are the forensic evidence of intrusion — the digital breadcrumbs that adversaries leave behind. They are categorized by the network layer or host layer at which they are observable. The critical caveat is that IOCs are inherently ephemeral: a sophisticated adversary can rotate IP addresses, register new domains, and recompile binaries to generate entirely new hash values in minutes. Despite this limitation, IOCs remain essential for real-time detection and triage, serving as the initial trigger for deeper investigation.

IOC categories ranked by adversary change cost (ascending)

IOC Category	Examples	Detection Mechanism	Adversary Change Cost
Hash Values	`SHA-256`, `MD5`, `SHA-1` of malware binaries	AV engines, EDR file scanning	Trivial — recompile or add a NOP
IP Addresses	C2 server IPs, scanning source IPs	Firewall rules, IDS/IPS, SIEM correlation	Low — use VPS/cloud, rotate IPs
Domain Names	Phishing domains, DGA-generated domains	DNS sinkholing, proxy logs, threat feeds	Moderate — registration costs time/money
Network Artifacts	URI patterns, User-Agent strings, JA3 hashes	Deep packet inspection, proxy analysis	Moderate — requires retooling C2 protocols
Host Artifacts	Registry keys, mutexes, file paths, scheduled tasks	EDR behavioral rules, forensic analysis	Moderate — requires code changes

Tactics, Techniques & Procedures (TTPs) — The MITRE ATT&CK Lens

While IOCs answer what happened, TTPs answer how and why. The MITRE ATT&CK framework provides the most widely adopted taxonomy for organizing TTPs. ATT&CK defines 14 tactical categories (e.g., Initial Access, Execution, Persistence, Lateral Movement, Exfiltration) and hundreds of specific techniques and sub-techniques under each. A tactic represents the adversary's objective at a given stage — for instance, "gain initial access to the target network." A technique is a general method for achieving that objective — such as spear-phishing with an attachment (T1566.001). A procedure is the specific, granular implementation observed in the wild — for example, APT29 sending a COVID-themed Word document with a macro that invokes PowerShell to download a Cobalt Strike beacon.

TTP hierarchy from abstract (Tactic) to concrete (Procedure)

Layer	Abstraction Level	Example	MITRE ATT&CK ID
Tactic	Adversary goal (the 'why')	Initial Access	`TA0001`
Technique	General method (the 'how')	Phishing: Spearphishing Attachment	`T1566.001`
Procedure	Specific implementation (the 'what exactly')	APT29 sends macro-enabled .docx themed as a COVID update, executing PowerShell to download a Cobalt Strike beacon	Mapped to T1566.001 → T1059.001 → T1071.001

SECTION 6

Worked Example — Analyzing an Incident with IOCs and TTPs

Consider a realistic scenario: your organization's SOC receives an alert from the SIEM indicating that an internal workstation has communicated with a known malicious domain. Walk through how a threat intelligence analyst would decompose this event into IOCs and TTPs, and then leverage threat intelligence to understand the broader campaign.

Incident: Suspicious Outbound DNS Query to Known C2 Domain

Step 1 — Identify Observable IOCsThe SOC alert contains several atomic indicators. The workstation at IP 10.0.5.42 resolved the domain update-service[.]xyz which resolved to 185.220.101.33. Endpoint telemetry reveals that a process with hash a3f5b...c9d2e (SHA-256) spawned the network connection. These four data points — the internal IP, the domain, the external IP, and the file hash — constitute our initial IOCs.

IOCs identified: 1 domain, 1 external IP, 1 file hash, 1 internal IP

Step 2 — Enrich IOCs with Threat IntelligenceQuery the domain and IP against commercial threat intelligence platforms (e.g., VirusTotal, Recorded Future) and ISAC feeds. The domain update-service[.]xyz is flagged in multiple feeds as a Cobalt Strike C2 domain associated with the threat group FIN7. The hash matches a known FIN7 loader dropper. The STIX report includes a confidence score of 85 (high) and was last updated 48 hours ago.

Attribution: FIN7 campaign (high confidence). Malware family: Cobalt Strike beacon via custom loader.

Step 3 — Map to ATT&CK TTPsUsing the enrichment data and forensic analysis of the infected host, map the observed behavior to MITRE ATT&CK. The initial vector was a spear-phishing email with an attachment (T1566.001 — Initial Access). The attachment executed a macro that invoked PowerShell (T1059.001 — Execution). The PowerShell script downloaded the loader, which established persistence via a scheduled task (T1053.005 — Persistence). The Cobalt Strike beacon communicated over HTTPS to the C2 domain (T1071.001 — Command and Control).

ATT&CK mapping: T1566.001 → T1059.001 → T1053.005 → T1071.001

Step 4 — Derive Actionable IntelligenceCross-reference the identified TTPs with FIN7's known playbook in ATT&CK. Their typical next steps include credential dumping (T1003), lateral movement via RDP (T1021.001), and data exfiltration over the C2 channel (T1041). Proactively hunt for evidence of these downstream techniques across all endpoints. Issue detection rules for the anticipated TTPs before the adversary progresses.

Proactive detections deployed for T1003, T1021.001, and T1041. Threat hunt initiated across 2,400 endpoints.

Step 5 — Share and Feed BackPackage the new IOCs (any novel IPs, domains, hashes discovered during the hunt) and TTP mappings into a STIX 2.1 bundle. Share with your sector ISAC via TAXII. Document lessons learned: the phishing email bypassed the email gateway because it used a legitimate cloud-hosted attachment link, suggesting a gap in URL sandboxing capabilities. Feed this finding back into the Direction phase to refine detection requirements for cloud-hosted payload delivery.

Intelligence shared via ISAC. Email gateway policy updated. Intelligence lifecycle completes one iteration.

SECTION 7

Strengths and Limitations of IOC-Based vs. TTP-Based Intelligence

IOCs and TTPs are not competing approaches — they are complementary layers of a comprehensive threat intelligence program. However, understanding their respective strengths and limitations is essential for allocating resources effectively and designing detection architectures that balance speed with resilience.

Comparative analysis of IOC-based vs. TTP-based intelligence approaches

Dimension	IOC-Based Intelligence	TTP-Based Intelligence
Detection Speed	Very fast — automated feed ingestion enables near-real-time blocking	Slower — requires behavioral analytics, correlation engines, and tuned detection rules
Shelf Life	Short — hash IOCs may become stale in hours; IP/domain IOCs in days to weeks	Long — adversary behavioral patterns persist for months or years
False Positive Rate	Low for hashes; moderate for IPs (shared hosting, CDNs)	Higher — legitimate admin activity may resemble adversary TTPs
Evasion Resistance	Low — trivially evaded by changing indicators	High — changing behavior is operationally expensive for adversaries
Automation	Highly automatable (STIX/TAXII, SIEM integrations)	Partially automatable — requires human analysis for context and tuning
Resource Requirements	Moderate — primarily engineering effort for feed integration	High — requires skilled analysts, threat hunting programs, and behavioral detection platforms

✦ KEY TAKEAWAY

A mature threat intelligence program operates at multiple levels simultaneously, much like a hospital's diagnostic approach. IOC feeds function like vital-sign monitors — they provide rapid, automated alerts when known bad indicators appear (elevated temperature, abnormal blood pressure). TTP analysis functions like a specialist's differential diagnosis — it looks at the pattern of symptoms, the patient's history, and the disease's known progression to identify the underlying condition and predict what comes next. You need both: the monitor for speed, and the specialist for depth.

SECTION 8

Connection to Advanced Frameworks and Emerging Trends

The foundational concepts of IOCs and TTPs connect to several advanced frameworks and emerging practices that represent the frontier of threat intelligence. As you progress in security operations, understanding these extensions becomes increasingly important for designing resilient detection architectures and contributing to the collective defense of the cybersecurity community.

From foundational concepts to advanced threat intelligence practices

Foundational Concept	Advanced Extension	Key Insight
IOC feeds (manual integration)	STIX/TAXII automated sharing	Machine-readable intelligence in standardized JSON (STIX 2.1) exchanged via RESTful APIs (TAXII) enables automated consumption and dissemination across organizational boundaries at machine speed.
MITRE ATT&CK TTP mapping	MITRE D3FEND & ENGAGE	D3FEND maps defensive countermeasures to ATT&CK techniques, creating a bidirectional attack-defense knowledge graph. ENGAGE provides an adversary engagement framework for deception and denial operations.
Pyramid of Pain (static model)	Diamond Model of Intrusion Analysis	Formalizes relationships between adversary, capability, infrastructure, and victim as a four-vertex graph, enabling richer attribution and campaign-level analysis beyond individual indicators.
Manual TTP analysis	ML-driven behavioral detection	Machine learning models trained on process telemetry can detect adversary TTPs at scale — for example, identifying anomalous process trees that match known lateral movement patterns without relying on static signatures.
Organization-specific intelligence	Collective intelligence (ISACs, CTI platforms)	Sector-specific ISACs and platforms like MISP enable community-driven intelligence pooling, where one organization's detection becomes every participant's prevention — a network effect that multiplies defensive value.

Looking forward, the convergence of threat intelligence with Security Orchestration, Automation, and Response (SOAR) platforms is accelerating the transition from intelligence-informed detection to intelligence-driven automated response. In these architectures, a TTP-mapped detection rule can trigger an automated playbook that isolates the affected endpoint, enriches the alert with threat intelligence context, initiates a threat hunt across the fleet, and notifies the relevant ISAC — all within seconds of the initial detection. Understanding the IOC and TTP foundations presented in this lesson is the prerequisite for designing and operating these sophisticated automated defense systems.

SECTION 9

Practice Problems

PROBLEM 1 — CONCEPTUAL

Explain why TTPs sit at the apex of the Pyramid of Pain while hash values sit at the base. In your answer, discuss what 'cost to the adversary' means in this context and provide one concrete example illustrating each extreme.

PROBLEM 2 — BASIC CALCULATION

A threat intelligence feed provides 10,000 IOCs (IP addresses) daily. Your analysts determine that the feed has a 92% true positive rate and a mean IOC shelf life of 72 hours. If your SIEM retains IOCs for 30 days, approximately how many stale (expired) IOCs would accumulate in the SIEM after 30 days, and what percentage of the total stored IOCs would be stale?

PROBLEM 3 — INTERMEDIATE

During an incident response, your team identifies the following artifacts on a compromised host: (a) a scheduled task named 'WindowsUpdate' executing a PowerShell script from C:\ProgramData\update.ps1 every 4 hours, (b) DNS queries to cdn-static[.]net over HTTPS, (c) the PowerShell script's SHA-256 hash 7a4f8e...b2c1d3. Classify each artifact as an IOC, identify its type, and map the overall adversary behavior to at least three MITRE ATT&CK techniques.

PROBLEM 4 — APPLIED

You are the threat intelligence lead at a mid-sized financial services firm. The FS-ISAC (Financial Services ISAC) shares a STIX 2.1 report describing a new campaign by FIN8 targeting payment processing systems. The report includes 45 IOCs (IPs, domains, hashes) and maps the campaign to six ATT&CK techniques. Design a response plan that addresses both the tactical (IOC) and strategic (TTP) dimensions of this intelligence. Specify at least five concrete actions, explaining which layer of intelligence each action leverages.

PROBLEM 5 — CRITICAL THINKING

A colleague argues that with the rise of machine learning-based behavioral detection, IOC-based threat intelligence is becoming obsolete and organizations should stop investing in IOC feeds entirely. Critically evaluate this position, considering both technical and organizational factors. Under what conditions, if any, might purely TTP-based detection be sufficient? What are the risks of abandoning IOC feeds?

SUMMARY

Lesson Summary

Threat intelligence transforms raw security data into actionable knowledge through the Intelligence Lifecycle — a six-phase process of direction, collection, processing, analysis, dissemination, and feedback. At its core, the discipline revolves around two complementary concepts: Indicators of Compromise (IOCs), which are observable forensic artifacts like file hashes, IP addresses, and domain names that signal malicious activity; and Tactics, Techniques, and Procedures (TTPs), which describe adversary behavior at increasing levels of specificity — from strategic objectives (tactics) through general methods (techniques) to specific implementations (procedures).

The Pyramid of Pain provides the key strategic insight: IOCs at the base of the pyramid (hashes, IPs) are trivially changed by adversaries, while TTPs at the apex impose maximum cost when detected and blocked. The MITRE ATT&CK framework serves as the industry-standard taxonomy for cataloging TTPs. Threat intelligence operates at three levels — strategic (executive trends), operational (campaign details), and tactical (machine-readable indicators) — and is shared via standards like STIX/TAXII. A mature security program leverages both IOC feeds for rapid automated detection and TTP analysis for resilient, behavior-based defense.