Threat Intelligence

By now, you’ve been through a number of different phases in your journey toward a better security posture. In the last chapter, you learned about the importance of a good detection system, and now it’s time to move to the next level. The use of threat intelligence to better know the adversary and gain insights into the current threats is a valuable tool for the Blue Team. Although threat intelligence is a domain that has been gaining traction over the last few years, the use of intelligence to learn how the enemy is operating is an old concept. Bringing intelligence to the field of cybersecurity was a natural transition, mainly because, now, the threat landscape is so broad and the adversaries vary widely, from state-sponsored actors to cybercriminals extorting money from their victims.

In this chapter, we are going to cover the following topics:

• Introduction to threat intelligence
• Open-source tools for threat intelligence
...

Introduction to threat intelligence

It was clear in the last chapter that having a strong detection system is imperative for your organization’s security posture. One way to improve this system would be to reduce the noise and number of false positives that are detected. One of the main challenges that you face when you have many alerts and logs to review is that you end up randomly prioritizing – and in some cases, even ignoring – future alerts because you believe it is not worth reviewing them. According to Microsoft’s Lean on the Machine report, an average large organization has to look through 17,000 malware alerts each week, taking on average 99 days for an organization to discover a security breach.

Alert triage usually happens at the Network Operations Center (NOC) level or Security Operations Center (SOC), and delays to triage can lead to a domino effect. This is because if triage fails at this level, the operation will also fail, and in this...

Open-source tools for threat intelligence

As mentioned earlier, DHS partners with the intelligence community to enhance its own intelligence, and this is pretty much standard in this field. Collaboration and information sharing are the foundations of the intelligence community. There are many open-source threat intelligence tools out there that can be used. Some are commercial tools (paid), and some are free. You can start consuming threat intelligence by consuming TI feeds. OPSWAT MetaDefender Cloud TI feeds have a variety of options that range from free to paid versions, and they can be delivered in four different formats: JSON, CSV, RSS, and Bro.

For more information about MetaDefender Cloud TI feeds, visit https://www.metadefender.com/threat-intelligence-feeds.

Another option for quick verification is the website https://fraudguard.io. You can perform a quick IP validation to obtain threat intel from that location. In the example that follows, the IP 220.227.71.226 was...

Microsoft threat intelligence

For organizations that are using Microsoft products, whether on-premises or in the cloud, they consume threat intelligence as part of the product itself. That’s because, nowadays, many Microsoft products and services take advantage of shared threat intelligence, and with this, they can offer context, relevance, and priority management to help people take action.

Microsoft consumes threat intelligence through different channels, such as:

• The Microsoft Threat Intelligence Center, which aggregates data from:
  • Honeypots, malicious IP addresses, botnets, and malware detonation feeds
  • Third-party sources (threat intelligence feeds)
  • Human-based observation and intelligence collection
• Intelligence coming from consumption of their service
• Intelligence feeds generated by Microsoft and third parties

Microsoft integrates the result of this threat intelligence into its products...

Summary

In this chapter, you learned about the importance of threat intelligence and how it can be used to gain more information about current threat actors and their techniques and, in some circumstances, predict their next step. You learned how to leverage threat intelligence from the open source community based on some free tools, as well as commercial ones.

You learned how to use the MITRE ATT&CK framework and the MITRE ATT&CK Navigator to understand adversaries’ behavior and how they are leveraging different techniques and subtechniques for their operations.

Next, you learned how Microsoft integrates threat intelligence as part of its products and services, and how to use Microsoft Sentinel not only to consume threat intelligence, but also to visualize potentially compromised features of your environment based on the threat intel acquired, compared to your own data.

In the next chapter, we will continue talking about defense strategies, but this time...

References

• Microsoft Lean on the Machine Report: http://download.microsoft.com/download/3/4/0/3409C40C-2E1C-4A55-BD5B-51F5E1164E20/Microsoft_Lean_on_the_Machine_EN_US.pdf
• Wanna Decryptor (WNCRY) Ransomware Explained: https://blog.rapid7.com/2017/05/12/wanna-decryptor-wncry-ransomwareexplained/
• A Technical Analysis of WannaCry Ransomware: https://logrhythm.com/blog/a-technical-analysis-of-wannacry-ransomware/
• New ransomware, old techniques: Petya adds worm capabilities: https://blogs.technet.microsoft.com/mmpc/2017/06/27/new-ransomware-oldtechniques-petya-adds-worm-capabilities/
• MITRE ATT&CK https://attack.mitre.org/

Join our community on Discord

Join our community’s Discord space for discussions with the author and other readers:

https://packt.link/SecNet