8. Threat Intelligence

Lesson#98 of 107 in project Theory
  • IP addresses
  • domains
  • URLs
  • hashes
  • malware families
  • attacker infrastructure

And understand:

  • IOC
  • IOA
  • TTP
  • threat actor
  • campaign
  • malware family

Useful platforms/concepts:

  • VirusTotal
  • AbuseIPDB
  • WHOIS
  • DNS intelligence
  • URL analysis
  • malware repositories
  • MITRE ATT&CK

The key lesson:

An IOC is a clue, not automatically proof of compromise.

Previous
Next