Intelligence-driven hunting: MISP, IOCs and TTPs
You collect threat intelligence, organise it in MISP, search your own data for indicators and attacker behaviours, and turn the results into shareable intelligence.
Level 401 · 12 lessons · 12 practice labs
Lessons
Intelligence
- Types of threat intelligence: strategic, operational, technical
- Sources and reliability: open sources, sharing groups
- Events, attributes and tags in MISP
- Sharing intelligence with STIX and TAXII
- Short task: turn the indicators in a report into a MISP event
From indicators to behaviour
- Indicator sweeps: searching historical data
- Indicator ageing and false positives
- TTP hunting: searching for attacker habits
- Actor profiling: which techniques matter to you
- Short task: search your data for three techniques of a threat group
Capstone
- Writing an intelligence report: to whom, what, with what confidence
- Capstone: hunt a new campaign alert in your organisation and write a shareable report
Practice labs
- Turn the indicators in a report into a MISP event: Add domains, addresses and hashes with the right attribute types and tag the event.
- Tag indicators with confidence and sharing level: Assign tags by source reliability, set the TLP level and limit the sharing group.
- Export an event as STIX and validate its content: Inspect the objects in the exported bundle, complete the missing relationship and test re-import.
- Sweep historical data for an indicator list: Search the last 30 days of records for the given addresses and domains and list the hosts that hit.
- Weed out stale and false-positive indicators: Remove shared-hosting addresses and expired domains from the list and run the sweep again.
- Verify with context whether a hit is a real infection: Validate indicator hits with process, user and later network behaviour and tell the real one of two hits.
- Search your data for three techniques of a fictional group: Turn the techniques in the Gri Baykuş group’s profile into queries and report which one left a trace.
- Recognise an attacker with new indicators by their habits: Link an attacker using new infrastructure to the old campaign through tool order and command patterns.
- Choose and prioritise the techniques that matter to your sector: Compare three actor profiles with the organisation’s assets and rank the first five hunt topics with reasons.
- Write an intelligence note with confidence levels: Summarise the hunt result in a half-page note that makes clear to whom, what and with what confidence you speak.
- Map the techniques in a threat report to ATT&CK IDs: Read a two-page report on a fictional group and tabulate five behaviours with the right technique IDs.
- Rank indicators by how long they stay useful: Classify ten given indicators as hash, address, domain, tool or behaviour and rank them from hardest to easiest for an attacker to change.
About this course
You collect threat intelligence, organise it in MISP, search your own data for indicators and attacker behaviours, and turn the results into shareable intelligence.
What you will learn
- Intelligence
- From indicators to behaviour
- Capstone
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.