Chapter 49: Threat Intelligence Operations¶

Overview¶

Threat intelligence transforms raw adversary data into actionable knowledge that drives detection, response, and strategy. This chapter covers the full intelligence lifecycle, threat actor profiling with the Diamond Model, IOC management, STIX/TAXII standards, TI platforms (MISP, OpenCTI), and the frameworks for evaluating intelligence quality and operationalizing feeds into SIEM detections.

Learning Objectives¶

• Apply the six-phase intelligence lifecycle: direction, collection, processing, analysis, dissemination, feedback
• Profile threat actors using the Diamond Model and correlate campaigns to the Cyber Kill Chain
• Differentiate strategic, operational, and tactical intelligence by audience and format
• Manage IOC lifecycles from creation through enrichment, aging, and retirement
• Operate MISP and OpenCTI for collaborative intelligence sharing
• Implement STIX/TAXII for structured threat data exchange
• Evaluate TI feed quality using the Admiralty Scale and operational metrics

Prerequisites¶

• Chapter 12 (SIEM Engineering and Detection)
• Chapter 18 (Threat Hunting)
• Chapter 37 (AI and Machine Learning Security)
• Familiarity with IOC types (hashes, IPs, domains, YARA rules)

49.1 The Threat Intelligence Lifecycle¶

flowchart LR
    subgraph P1["1. Direction"]
        PIR[PIRs / SIRs / EEIs]
    end
    subgraph P2["2. Collection"]
        SRC[OSINT · ISACs\nCommercial · Internal]
    end
    subgraph P3["3. Processing"]
        NORM[Normalize · Dedup\nEnrich · Tag TLP]
    end
    subgraph P4["4. Analysis"]
        ANA[Diamond Model\nATT&CK Mapping\nCampaign Clustering]
    end
    subgraph P5["5. Dissemination"]
        OUT[Strategic Reports\nOp Briefings\nTactical Feeds]
    end
    subgraph P6["6. Feedback"]
        FB[Metrics · Gaps\nRequirement Refinement]
    end

    P1 --> P2 --> P3 --> P4 --> P5 --> P6
    P6 -.->|Refine| P1

    style P1 fill:#58a6ff22,stroke:#58a6ff
    style P2 fill:#3fb95022,stroke:#3fb950
    style P3 fill:#ffa65722,stroke:#ffa657
    style P4 fill:#ff7b7222,stroke:#ff7b72
    style P5 fill:#d2a8ff22,stroke:#d2a8ff
    style P6 fill:#79c0ff22,stroke:#79c0ff

Intelligence Requirements Framework¶

49.2 Threat Actor Profiling — The Diamond Model¶

The Diamond Model links four features of every intrusion event: Adversary, Capability, Infrastructure, and Victim.

graph TD
    ADV["Adversary\n(VORTEX BEAR)"]
    CAP["Capability\n(FROSTBITE Loader)"]
    INF["Infrastructure\n(185.220.XX.0/24)"]
    VIC["Victim\n(NA Healthcare)"]

    ADV --- CAP
    ADV --- INF
    CAP --- VIC
    INF --- VIC

    style ADV fill:#ff7b7222,stroke:#ff7b72
    style CAP fill:#ffa65722,stroke:#ffa657
    style INF fill:#58a6ff22,stroke:#58a6ff
    style VIC fill:#3fb95022,stroke:#3fb950

Synthetic Threat Actor — VORTEX BEAR¶

Kill Chain Correlation¶

49.3 Strategic vs. Tactical vs. Operational Intelligence¶

49.4 Synthetic APT Campaign Report — Operation FROZEN PULSE¶

Actor: VORTEX BEAR | Period: 2024-10 to 2025-01 | Confidence: B-3 | TLP: AMBER+STRICT

Summary: VORTEX BEAR targeted 14 healthcare organizations via spearphishing (HIPAA audit lure), exploiting CVE-2024-21413 to deliver FROSTBITE loader. Post-exploitation: Cobalt Strike, BloodHound AD enumeration, RDP lateral movement, BLIZZARD ransomware. Average dwell time: 11 days. Ransoms: $2.5M–$8M USD.

ATT&CK Mapping:

Recommendations:

1. Block all listed IOCs at perimeter (firewall, proxy, DNS sinkhole)
2. Deploy YARA rule FROSTBITE_Loader_v2 to EDR
3. Hunt for JA3 e7d705a3286e19ea42f587b344ee6865 in TLS logs
4. Audit Outlook patching for CVE-2024-21413
5. Monitor for BloodHound SharpHound collector process creation

49.5 ISACs by Sector¶

49.6 TI Platforms — MISP and OpenCTI¶

MISP Event Creation — Synthetic Walkthrough¶

# EDUCATIONAL: All indicators are synthetic
from pymisp import PyMISP, MISPEvent

misp = PyMISP('https://misp.internal.example.com', 'API_KEY', ssl=True)

event = MISPEvent()
event.info = "VORTEX BEAR - Operation FROZEN PULSE"
event.threat_level_id = 1  # High
event.analysis = 2         # Completed

event.add_attribute('domain', 'klinik-update.health',
                    comment='FROSTBITE C2', to_ids=True)
event.add_attribute('ip-dst', '185.220.101.47',
                    comment='CS team server', to_ids=True)
event.add_attribute('sha256',
    'a3f7b2c91d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e4f8',
    comment='FROSTBITE loader', to_ids=True)
event.add_attribute('ja3-fingerprint-md5',
    'e7d705a3286e19ea42f587b344ee6865',
    comment='FROSTBITE TLS fingerprint', to_ids=True)

created = misp.add_event(event)
misp.publish(created)

49.7 IOC Management Lifecycle¶

flowchart LR
    C["Create"] --> V["Validate"] --> E["Enrich"] --> D["Deploy"] --> M["Monitor"] --> A["Age"] --> R["Retire"]
    style C fill:#3fb95022,stroke:#3fb950
    style R fill:#8b949e22,stroke:#8b949e

IOC Aging Policy¶

Confidence Scoring — Admiralty Scale¶

49.8 STIX/TAXII Concepts¶

STIX 2.1 — data format for expressing threat intelligence (JSON-based, 18 domain objects). TAXII 2.1 — transport protocol for exchanging STIX objects (HTTP-based collections and channels).

{
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--a3f7b2c9-1d4e-5f6a-7b8c-9d0e1f2a3b4c",
  "name": "FROSTBITE C2 Domain",
  "pattern": "[domain-name:value = 'klinik-update.health']",
  "pattern_type": "stix",
  "valid_from": "2024-09-28T00:00:00.000Z",
  "confidence": 75,
  "kill_chain_phases": [
    {"kill_chain_name": "mitre-attack", "phase_name": "command-and-control"}
  ]
}

49.9 TI → SIEM Correlation Workflow¶

flowchart TD
    subgraph Sources["TI Sources"]
        F1["Commercial\nFeeds"]
        F2["ISAC"]
        F3["Internal\nHunt"]
    end
    subgraph TIP["TI Platform"]
        IN["Ingest →\nDedup →\nEnrich →\nScore"]
    end
    subgraph Det["Detection"]
        SIEM["SIEM"]
        EDR["EDR"]
        FW["Firewall"]
    end
    subgraph Resp["Response"]
        AL["Alert"]
        BL["Block"]
        HU["Hunt"]
    end

    F1 & F2 & F3 --> IN --> SIEM & EDR & FW
    SIEM --> AL & HU
    FW --> BL

    style Sources fill:#3fb95022,stroke:#3fb950
    style TIP fill:#58a6ff22,stroke:#58a6ff
    style Det fill:#ffa65722,stroke:#ffa657
    style Resp fill:#ff7b7222,stroke:#ff7b72

Detection Queries¶

| Domain IOC match against DNS logs |
index=dns sourcetype=dns
| lookup threat_intel_domains domain AS query OUTPUT
    threat_actor, campaign, confidence
| where isnotnull(threat_actor) AND confidence >= 70
| stats count AS matches values(query) AS domains
    values(threat_actor) AS actors BY src_ip
| sort -matches

| IP IOC match against firewall logs |
index=firewall action=allowed
| lookup threat_intel_ips ip AS dest_ip OUTPUT
    threat_actor, ioc_type, confidence
| where isnotnull(threat_actor)
| stats count AS connections sum(bytes_out) AS exfil_bytes
    values(threat_actor) AS actors BY src_ip
| sort -exfil_bytes

let TI_Domains = ThreatIntelligenceIndicator
| where isnotempty(DomainName);
DnsEvents
| where TimeGenerated > ago(24h)
| join kind=inner TI_Domains on $left.Name == $right.DomainName
| where ConfidenceScore >= 70
| summarize Matches=count(), Domains=make_set(Name)
    by ClientIP
| sort by Matches desc

title: TI Feed - Known C2 Domain Resolution
id: f7a3b2c1-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: stable
description: DNS resolution of domains matching known C2 indicators.
logsource:
    category: dns
detection:
    selection:
        query|endswith: ['.health', '.clinic']
        query|contains: ['update', 'compliance']
    condition: selection
level: high

49.10 TI Feed Evaluation and Metrics¶

Key Program Metrics¶

Exam Prep & Certifications¶

Nexus SecOps Benchmark Controls¶

Review Questions¶

Key Terms¶

Admiralty Scale — NATO confidence framework rating Source Reliability (A–F) and Information Credibility (1–6).

Diamond Model — Intrusion analysis framework linking Adversary, Capability, Infrastructure, and Victim.

EEI — Essential Elements of Information; granular data points answering specific intelligence requirements.

ISAC — Information Sharing and Analysis Center; sector-specific collaborative threat intelligence organization.

IOC — Indicator of Compromise; observable artifact (IP, domain, hash) linked to malicious activity.

MISP — Open-source threat intelligence platform for collaborative IOC sharing and event management.

OpenCTI — Open-source TI platform built on native STIX 2.1 with knowledge graph visualization.

PIR — Priority Intelligence Requirement; executive-level question guiding the TI program.

STIX — Structured Threat Information Expression; JSON-based standard for representing cyber threat intelligence.

TAXII — Trusted Automated Exchange of Intelligence Information; HTTP transport protocol for STIX objects.

TLP — Traffic Light Protocol; RED / AMBER / GREEN / CLEAR classification controlling intelligence distribution.