Threat Intelligence & Threat Hunting

CTI: processed, analyzed information about threats that enables decisions

Three levels:
1. STRATEGIC (C-suite, board)
   - Nation-state threats to your industry
   - Geopolitical risk assessment
   - Long-term investment decisions
   - Example: "APT41 (China) targets pharmaceutical IP"

2. OPERATIONAL (security management)
   - Specific campaigns targeting your sector
   - Actor TTPs, motivations, targeting
   - Example: "APT41 using spear phishing with COVID research lures"

3. TACTICAL (SOC analysts)
   - IOCs: IPs, domains, hashes, YARA rules, Snort rules
   - Immediately actionable in security tools
   - Example: specific C2 IPs, malware hashes to block/alert on

Understanding who attacks you helps prioritize defenses

Threat actor categories:
- Nation-state: APT groups (APT28=Russia, APT41=China, Lazarus=NKOR)
  Motivation: espionage, sabotage, financial (NKOR)
  Capability: high, custom malware, 0-days, years of persistence

- Cybercriminals: ransomware groups (Cl0p, BlackCat, LockBit)
  Motivation: financial
  Capability: medium-high, ransomware-as-a-service

- Hacktivists: Anonymous, Killnet
  Motivation: ideology
  Capability: low-medium, mostly DDoS and defacement

- Insider threats: employees, contractors
  Motivation: financial gain, revenge, espionage
  Capability: high (internal access)

Known APT Group resources:
- MITRE ATT&CK Groups: attack.mitre.org/groups/
- Mandiant APT profiles: mandiant.com
- CrowdStrike Adversary Intelligence: crowdstrike.com/adversary-intelligence

4 core features of every intrusion:

         Adversary
            |
   Capability --[event]-- Infrastructure
            |
          Victim

Adversary: who conducted the attack
Capability: tools, TTPs used (malware, exploits)
Infrastructure: C2 IPs, domains, compromised hosts
Victim: targeted organization, person, data

Meta-features: timestamp, phase, result, direction

Usage:
- Group attacks: same adversary uses same infra across campaigns
- Attribution: unique capability (custom malware) links multiple incidents
- Defense: disrupt infrastructure = prevent all their campaigns

7-stage attack model:
1. Reconnaissance   — OSINT, scanning, target research
2. Weaponization    — create malware + exploit delivery mechanism
3. Delivery         — email, web, USB delivery to target
4. Exploitation     — triggering the vulnerability
5. Installation     — establishing persistence
6. Command & Control— C2 callback, attacker controls host
7. Actions          — objectives: data theft, ransomware, espionage

Defenders can interrupt at ANY stage
Earlier interruption = less damage

vs. MITRE ATT&CK:
Kill Chain: high-level stages (simpler, easier to explain)
ATT&CK: detailed techniques under each tactic (more actionable for hunters)

# MISP: open-source threat intelligence sharing platform
# Used by: CERTs, ISACs, enterprises, government agencies
# https://www.misp-project.org/

# Key concepts:
Event: collection of IOCs about a specific incident/campaign
Attribute: individual IOC (IP, domain, hash, URL, email)
Tag: classification (TLP:RED, APT28, ransomware)
Galaxy: structured threat actor/malware knowledge base
Correlation: automatic linking of events sharing attributes

# TLP (Traffic Light Protocol) for sharing:
TLP:WHITE   — public, can be shared freely
TLP:GREEN   — community sharing only
TLP:AMBER   — organization only, limited distribution
TLP:RED     — restricted to named recipients only

# Consuming MISP via API:
pip3 install pymisp
from pymisp import PyMISP
misp = PyMISP('https://misp.org/', 'API_KEY', False)
events = misp.search(value='185.220.101.5', type_attribute='ip-dst')
for e in events:
    print(e['Event']['info'], e['Event']['date'])

# MISP Feeds (free threat intel):
# OTX: AlienVault Open Threat Exchange
# Abuse.ch: URLHaus, MalwareBazaar feeds
# Emerging Threats: IP/domain blocklists

STIX 2.1 (Structured Threat Information Expression):
JSON-based standard for sharing threat intel

STIX Domain Objects (SDOs):
- Threat Actor
- Campaign
- Attack Pattern (ATT&CK technique)
- Malware
- Tool
- Indicator (pattern + valid_from + valid_until)
- Observed Data
- Vulnerability
- Course of Action (remediation)

Example STIX Indicator:
{
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--12345...",
  "name": "Malicious IP C2",
  "pattern": "[ipv4-addr:value = '185.220.101.5']",
  "pattern_type": "stix",
  "valid_from": "2024-01-01T00:00:00Z",
  "indicator_types": ["malicious-activity"]
}

TAXII (Trusted Automated eXchange of Intelligence Information):
REST protocol for serving STIX over HTTP/S

# Access TAXII feed:
pip3 install taxii2-client
from taxii2client.v21 import Server
server = Server('https://cti-taxii.mitre.org/', user='guest', password='')
for col in server.api_roots[0].collections:
    print(col.title)

Threat hunting: proactively searching for hidden threats
BEFORE an alert fires

Hunter mindset:
- Assume breach (attacker is already inside)
- SOC alerts catch known threats
- Hunters find UNKNOWN threats

Threat Hunting Loop:
1. CREATE HYPOTHESIS
   Based on: ATT&CK techniques, threat intel, new CVEs
   Example: "APT28 is using Kerberoasting (T1558.003) — is this in our environment?"

2. INVESTIGATE
   Query data sources to test hypothesis
   SIEM: look for Event ID 4769 spikes
   EDR: process execution patterns
   Network: beaconing detection

3. UNCOVER FINDINGS
   True positive: attacker found
   False positive: benign activity
   New hypothesis: discovered something unexpected

4. INFORM & ENRICH
   Share findings: new IOCs to SIEM, block lists
   Improve detections: write new SIEM rules from findings

Hunting for beaconing (C2 check-in):
SELECT dest_ip, COUNT(*) as connections, STDDEV(time_gap) as jitter
FROM netflow
WHERE src_ip IN (internal_ranges)
GROUP BY dest_ip
HAVING connections > 100 AND jitter < 5
ORDER BY jitter ASC
-- Low jitter + high frequency = likely beaconing

Hunting for PowerShell encoded commands:
index=windows EventCode=4688
| search CommandLine="*-enc*" OR CommandLine="*-encoded*" OR CommandLine="*-e *"
| stats count by ComputerName, CommandLine
| sort -count

Hunting for lateral movement:
index=windows EventCode=4624 LogonType=3
| stats dc(TargetUserName) as unique_users by IpAddress
| where unique_users > 5
-- One IP authenticating as many different users = suspicious

Hunting Kerberoasting:
index=windows EventCode=4769
| stats count by TargetUserName
| where count > 10 AND TargetUserName!="krbtgt"
-- Service accounts with many TGS requests = Kerberoasting