Threat intelligence and indicators of compromise

Why intelligence

You cannot defend against everything equally. Threat intelligence tells you who is likely to attack organisations like yours, how they usually do it, and what traces they leave. Raw data (a list of IP addresses) is not intelligence until someone checks it, adds context and links it to a decision.

Four levels

TTPs means tactics, techniques and procedures: how an attacker behaves. You will map TTPs with MITRE ATT&CK in the next lesson.

The intelligence lifecycle

1. Direction: what do we need to know? (for example "which groups target banks in India?")
2. Collection: gather from sources.
3. Processing: clean, de-duplicate, translate, normalise.
4. Analysis: judge reliability and relevance; turn data into conclusions.
5. Dissemination: give the right output to the right people (a short brief for managers, a block list for the firewall).
6. Feedback: was it useful? Adjust the next cycle.

Indicators of compromise (IOCs)

An indicator of compromise is an observable trace that suggests a system has been attacked: a known malicious IP address, domain, URL, file hash, email sender, file name or registry key. SOCs load IOCs into the SIEM, EDR and firewalls to search past logs and block future activity. An indicator of attack (IOA) describes suspicious behaviour as it happens, such as "Office spawning PowerShell", instead of a fixed value.

The Pyramid of Pain

David Bianco's Pyramid of Pain ranks indicators by how much it hurts the attacker when you detect them. From bottom (easy for them to change) to top (hard):

1. Hash values: change one byte, new hash.
2. IP addresses: easy to change.
3. Domain names: cheap to register new ones.
4. Network and host artifacts: patterns like a specific user-agent or registry key.
5. Tools: they must find or build new tools.
6. TTPs: they must change how they work. Detecting behaviour hurts most.

Sources

• National CERTs: CERT-In advisories and vulnerability notes for India; CISA in the US, including its Known Exploited Vulnerabilities (KEV) catalog.
• Vendor and researcher reports, which often include IOC lists and ATT&CK mappings.
• Sharing communities and ISACs (information sharing and analysis centres) for sectors like finance.
• Open platforms such as MISP (open-source threat sharing software).
• Your own incidents: the most relevant intelligence of all.

Intelligence is shared using standards such as STIX (a format for describing threat information) and TAXII (a protocol for exchanging it). The Traffic Light Protocol (TLP 2.0) marks how widely you may share: TLP:RED (named recipients only), TLP:AMBER and TLP:AMBER+STRICT (limited sharing), TLP:GREEN (community), TLP:CLEAR (public).

Defanging

When analysts write IOCs in reports, emails and tickets, they defang them so nobody clicks by accident and tools do not auto-link them: http becomes hxxp and dots become [.].

url = "http://gst-notice-update.example/login"
print(url.replace("http", "hxxp", 1).replace(".", "[.]"))

Common mistakes

• Blocking IOC lists blindly: shared hosting and cloud IPs may also serve legitimate sites. Check before blocking widely.
• Never expiring old IOCs; IPs get reassigned to innocent users.
• Collecting feeds nobody reads. Start with direction: what do we need to know?
• Breaking TLP marking by forwarding a TLP:AMBER report to a public group.