Threat Intelligence: TTPs, feeds & threat modeling

Threat Intelligence is the structured collection, analysis, and operationalization of data about adversaries, their TTPs, infrastructure, and motivations. It covers feeds containing IOCs such as malicious IPs, domains, file hashes, and YARA rules, but extends far beyond raw indicators. Threat modeling frameworks like MITRE ATT&CK map adversary behaviors to specific techniques and sub-techniques, enabling defenders to anticipate attack paths rather than simply react to known signatures. CTI operates at three levels: strategic intelligence informs executive risk decisions, operational intelligence supports incident response, and tactical intelligence feeds detection pipelines directly. Accurate attribution requires correlating infrastructure overlaps, tooling similarities, victimology patterns, and intrusion timestamps. The quality of intelligence depends heavily on source diversity, timeliness, and context enrichment. Consuming a raw IOC feed without contextualizing it against your own environment produces alert fatigue rather than actionable detections. Structured data formats such as STIX and TAXII enable machine-readable sharing between organizations and platforms, accelerating collective defense across sectors.

On the Blue Team side, operationalizing Threat Intelligence means integrating IOC feeds directly into SIEM and EDR platforms for automated correlation. In a SIEM like Splunk or Microsoft Sentinel, threat intel lookups match observed network flows, DNS queries, and process hashes against known malicious indicators in near real time. Windows Event ID 4688 captures process creation with command-line arguments, allowing analysts to match execution patterns against known adversary TTPs from MITRE ATT&CK. Sysmon Event ID 3 logs network connections per process, enabling correlation with C2 infrastructure IOCs. DNS query logs enriched with passive DNS data help identify domain generation algorithm patterns or newly registered domains associated with active campaigns. Threat intelligence platforms such as OpenCTI, MISP, or Recorded Future centralize indicator management, track confidence scores, and maintain adversary profiles over time. Effective detection also requires TTP-based detection rules rather than purely IOC-driven ones, since indicators rotate frequently while techniques persist. Sigma rules and behavioral analytics aligned to ATT&CK techniques provide detection coverage that survives IOC expiry.

From a Red Team perspective, understanding Threat Intelligence collection methods allows operators to degrade or deceive the defender's intel pipeline. Techniques include fast-flux DNS rotation to outpace IOC blocklists, using infrastructure categorized as benign such as cloud providers or CDN exit nodes, and staging payloads on legitimate platforms to avoid domain reputation hits. Red Teams also leverage threat intelligence offensively by studying public reports on APT tooling to emulate realistic adversary profiles during assumed breach exercises. OSINT tools like Maltego, Shodan, or VirusTotal Graph reconstruct attacker infrastructure and reveal pivot points. On the defensive hardening side, organizations should enforce automated IOC ingestion with TTL-based expiry to avoid false positives from stale indicators. Threat intel sharing through ISACs and platforms like MISP strengthens collective visibility. Confidence scoring and source tagging prevent low-fidelity indicators from polluting production detection rules. Running regular purple team exercises validates whether existing CTI actually translates into working detections, closing the gap between intelligence collection and measurable defensive coverage.