CTI for Security Operations: From Malware Analysis to Intelligence-Driven Defense

Aim

Course Objectives

Syllabus

Module 1: Fundamentals of CTI and Threat Actors
Objective: Understand the fundamentals of CTI, its lifecycle, and its role in cybersecurity.
Topics Covered:

1. Introduction to Cyber Threat Intelligence (CTI)
   • Definition and importance
   • Types of intelligence: Strategic, Operational, Tactical, Technical
2. Threat Intelligence Lifecycle
   • Stages from direction to dissemination
3. Threat Actors and Motivations
   • Nation-states, cybercriminals, hacktivists, insider threats
   • Common attack vectors: phishing, malware, ransomware, APTs
4. Open-Source Intelligence (OSINT) Basics
   • Tools: WHOIS, Shodan, Maltego, Google Dorks
   • Hands-on: Gathering threat data from public sources

Lab Activity:

• Use OSINT tools to investigate a simulated threat actor.

Module 2: Collection and Processing of Threat Data
Objective: Learn how to collect and process threat data for analysis.
Topics Covered:

1. Threat Intelligence Sources
   • Open-source: Feeds, forums, paste sites
   • Closed-source: Commercial feeds, dark web monitoring
   • Internal sources: SIEM, logs, EDR
2. Data Collection Techniques
   • Passive vs. active collection
   • Legal and ethical considerations
3. Processing & Normalization
   • Structuring data: STIX/TAXII, JSON, CSV
   • Tools: MISP, ThreatConnect, Recorded Future
4. Indicators of Compromise (IOCs)
   • IPs, domains, hashes, behavioral patterns

Lab Activity:

• Use MISP to ingest and analyze IOCs from a threat feed.

Module 3: Threat Analysis and Attribution
Objective: Develop skills in analyzing threats and attributing attacks.
Topics Covered:

1. Threat Analysis Techniques
   • Pattern recognition, anomaly detection, correlation
   • Tactics, Techniques, Procedures (TTPs)
2. Malware Analysis for CTI
   • Static vs. dynamic analysis
   • Tools: Sandboxing with Hybrid Analysis, ANY.RUN
3. Threat Attribution
   • Challenges in attribution
   • Case studies: APT29, Lazarus Group, others
4. Threat Intelligence Reports
   • Writing actionable intelligence
   • Report structure: Executive Summary, Technical Details, Recommendations

Lab Activity:

• Analyze a malware sample and draft a threat report.

Module 4: Operational Integration and Capstone Project
Objective: Learn how to share intelligence and integrate CTI into security operations.
Topics Covered:

1. Threat Intelligence Sharing
   • ISACs (Information Sharing and Analysis Centers)
   • Standards: STIX/TAXII, OpenIOC
2. Integrating CTI into Security Operations
   • SIEM integration (Splunk, IBM QRadar)
   • Automating threat detection with SOAR platforms
3. Threat Hunting with CTI
   • Proactive methodologies
   • Using YARA rules for detection
4. Emerging Trends in CTI
   • AI/ML applications in CTI
   • Threat intelligence for cloud environments
5. Final Exercise (Capstone Project)
   • Simulated cyber incident scenario:
     • Collect relevant threat intelligence
     • Analyze the attack using TTPs
     • Produce a threat intelligence report
     • Recommend defensive actions

Lab Activity:

• Configure a SIEM to ingest threat feeds and generate alerts.

Who Should Enrol?

Course Outcomes