Cyber Threat Intelligence (CTI) for SOC Analysts

---

Cyber Threat Intelligence (CTI) is evidence-based knowledge about adversaries, including their indicators, tactics, motivations, and actionable advice against them.

• Seeks to answer 3 essential questions:
  1. Who, or what, is on the other end of this alert indicator?
  2. What was their behavior in the past?
  3. How does my organization respond, and what should I do about it right now?
• Analyst uses CTI to enrich alert artifacts to determine if an alert is malicious

First-Line Triage Indicators

Indicator	Example	First Resources	Associated IOA or TTP Examples
IPv4 / IPv6	45.155.205.3	• WHOIS (ASN, allocation date) · VirusTotal Relations· Shodan banner scan	IOA: Repeated SSH failures TTP: T1110.003Password Guessing
Domain / FQDN	malicious-updates[.]net	• WHOIS age · RiskIQ or SecurityTrails passive-DNS · urlscan.io	IOA: surge of DNS queries to a 24-hour-old domain
URL	hxxp://malicious-updates[.]net/login	• URLhaus reputation · urlscan.io behaviour graph · Any.Run dynamic run (network off)	IOA: Browser POST to /gateway.php with payload
File hash	e99a18c428cb38d5…	• VirusTotal static & dynamic · Hybrid-Analysis · MalShare corpus	TTP: T1055 Process Injection into regsvr32.exe
E-mail address	billing@evil-corp.com	• MXToolbox header analysis • Have I Been Pwned	IOA: SPF failure plus recent domain registration
Local artefact	HKCU\Software\Run\updater.exe	• Sigma rules · EDR prevalence query · Vendor knowledge bas	TTP: T1060.001 Registry Run Keys

Sources of CTI

• four broad sources:
  • Internal telemetry: 
    • SIEM logs, EDR detections, phishing-mailbox submissions provide the highest immediate relevance
  • Commercial services: 
    • Vendor premium feeds, paid sandboxes, and closed-source analytics
    • provide high fidelity, but may have export and sharing limits based on licensing
  • Open-source intelligence (OSINT): 
    • AbuseIPDB, URLhaus, public blogs with IOCs, and academic research
    • Before applying, information from these sources will need to be cross-confirmed
  • Communities & ISACs:
    • Sector-specific lists marked with labels and rich context (e.g., FS-ISAC)

Threat Intel Classification

• Strategic intel
  • High-level intelligence that looks into the organization’s threat landscape and maps out the risk areas based on trends, patterns and emerging threats that may impact business decisions
  • e.g., an annual ransomware trends report predicting a shift to data-wiping extortion in healthcare
• Tactical intel
  • Assessments of adversaries’ behaviors through analysis of tactics, techniques, and procedures (TTPs)
  • can be in the form of Advisory notes, such as detailing new T1059.005 (Visual Basic) abuse in malspam
• Operational intel
  • Campaign-specific details about the motives and intent to perform an attack
  • useful for understanding the critical assets available in the organization (people, processes, and technologies) that may be targeted
• Technical intel
  • Atomic indicators and artifacts such as IPs and hashes related to an attack

Traffic Light Protocol (TLP)

The Traffic Light Protocol is a four-colour labelling scheme defined by FIRST.org that governs how widely intel may be shared.

TLP label	Sharing boundary	Typical SOC L1 behaviour
TLP: CLEAR	No restriction	Post to the internal wiki or platform.
TLP: GREEN	Share with peer community but not publicly	Upload to MISP/Slack workspace restricted to partner SOCs.
TLP: AMBER	Organisation-wide, external sharing only with need-to-know clients	Keep within the company CTI platform; reference, do not copy, in tickets.
TLP: RED	Named recipients only	Store in an encrypted note; do not post to the ticketing system without clearance.

CTI Lifecycle

1. Planning and Direction
2. Collection
3. Processing
4. Analysis
5. Dissemination
6. Feedback