What is Operational Threat Intelligence?

<p><em>This is the third blog in a series titled, "What is Threat Intelligence?". Continue with the series at the bottom of this page.</em></p><p>In our previous blog we discussed the benefits and applications of strategic threat intelligence, which provides insight into attackers and their motivations. This kind of intelligence is nontechnical and “big picture,” providing people with a general understanding of the threat. To mount a successful defense though organizations require more than just answers on which enemies they’re facing - they also need to know their adversaries’ capabilities. Enter operational threat intelligence. Operational threat intelligence provides context for security events and incidents such that defenders can:</p><ul><li>Expose potential risks</li><li>Gain insight into actor methodologies</li><li>Pursue previously undiscovered malicious activity</li><li>Perform faster and more thorough investigations into malicious activity</li></ul><p>This kind of intelligence is most frequently uncovered by forensic investigators and incident responders, and typically includes the following types of items:</p><ul><li>Tools for particular threat groups (utilities, backdoor families, common infrastructure)</li><li>TTPs for particular threat groups (staging directories, file naming conventions, ports, protocols, favorite file types)</li><li>Emerging TTPs (new persistence methods, exploits, phishing schemes)</li></ul><p>Consider the following from an incident response perspective: If you are responding to an intrusion event, you may wonder how a particular actor performs privilege escalation, lateral movement or data theft. If you are hunting for undiscovered malicious activity, you might want to start your hunt by looking for a specific actor behavior. Whatever your scenario, you need to answer the question “How do you search for this actor within your environment?”</p><h3>Example Operational Intelligence for APT29</h3><ul><li>Preferred Infection Vector: spearphishing with self-extracting RAR</li><li>First Stage Malware Families: COZYCAR, SWIFTKICK, TADPOLE</li><li>Second Stage Malware Families: SEADADDY, MINIDIONIS, SPIKERUSH</li><li>Persistence Techniques<ul><li>Scheduled Tasks for most backdoors</li><li>WMI by manual installation for backdoors that do not have persistence built in</li><li>Legitimate file replacement of Windows Error Reporting file (wermgr.exe)</li></ul></li><li>Use of TOR for C2</li><li>Use of Google Docs for C2</li><li>Use of Google Cloud Apps for C2 forwarding (as a proxy)</li><li>Use of HTTP POST requests over 443 for C2</li><li>Use of backdoors configured for ports 1, 80, 443, 3389 for C2</li><li>Use of PowerShell scripts</li><li>Use of Py2Exe to modify and recompile backdoors with variance in C2 protocols and C2 infrastructure</li></ul><h3>Example Operational Intelligence for the Education Sector</h3><ul><li>Common attack vectors are spear phishing, watering holes and SQL injection</li><li>Spearphishing university professors who specialize in incorporating new technology into classrooms</li><li>Spearphishing to recruiters and people involved in hiring processes</li><li>Common attacks are spear phishing and SQL injection (SQLi)</li><li>Common malware families: PISCES, SOGU, LOGJAM, COBALT, COATHOOK, POISONIVY, NJRAT, NETWIRE</li><li>Common pentesting families: Meterpreter, PowerShell Empire, Metasploit Framework</li><li>Use of Dropbox for C2</li><li>Use of HTTPS and custom TCP protocols for C2</li><li>Use of .ru, .su TLDs for C2 domains</li><li>Use of yandex.ru and bk.ru for email addresses</li><li>Theft of databases containing student names, administrative credentials, billing information, social security numbers and other PII.</li></ul><h3>Using Operational Intelligence</h3><p>Operational intelligence is knowledge gained from examining details from known attacks (also known as tactical intelligence - more on that next time). An analyst can build a solid picture of actor methodology by piecing together tactical indicators and artifacts, and derive into operational intelligence. This can help to:</p><ul><li>Enrich security events and alerts for known-bad atomic IOCs, equipping security personnel with the context they need to make better security decisions</li><li>Enhance incident response plans and mitigation techniques for future attacks and incidents</li><li>Implement and bolster a proactive discovery program (“hunting program”) to identify suspicious files and activity that has bypassed traditional security technologies</li><li>Extract useful redteaming techniques based on attacker methods in the wild</li><li>Perform actor-based and malware family-based analytics for high risk threats to your company, industry, geography or nation</li><li>Develop detection methodologies that are not dependent on IOCs, ensuring broader coverage of threats in a more timely fashion</li></ul><p>Check out the other blogs in our series for a deeper look into the types of threat intelligence and how they are used. </p><p><a href="https://www.anomali.com/blog/what-is-threat-intelligence">What is Threat Intelligence? </a><br/> <a href="https://www.anomali.com/blog/what-is-strategic-threat-intelligence">What is Strategic Threat Intelligence?</a><br/> <a href="https://www.anomali.com/blog/what-is-operational-threat-intelligence">What is Operational Threat Intelligence? </a><br/> <a href="https://www.anomali.com/blog/what-is-tactical-threat-intelligence">What is Tactical Threat Intelligence?<i> </i></a></p>