Threat Intelligence Guide

Threat Intelligence is processed information about adversaries and their TTPs, used to make better defense decisions. It works at three levels:

• Strategic: board-level briefings about threat actor motives, geopolitical context and long-term trends. Output: written reports.
• Operational: campaign reports tied to specific threat groups (e.g. "Kimsuky targeting US think tanks Q2 2026"). Output: TTP narratives, victimology, infrastructure clusters.
• Tactical: concrete indicators (URLs, IPs, hashes) that can be ingested into a SIEM, firewall or EDR. Output: machine-readable feeds.

• More than blocklists: adds who, why and when.
• Adds attribution (which group) and motive (money, spying, activism).
• URLs rotate fastest, so mature teams also detect TTPs.

An indicator of compromise (IOC) is an artefact that suggests malicious activity. The four main types:

Every IOC moves through four stages from collection to retirement:

• Collection: sourced from sandboxes, honeypots, partner feeds, OSINT or analyst observation.
• Enrichment: WHOIS, passive DNS, reputation scores, sandbox detonations, MITRE ATT&CK technique tagging.
• Action: blocking, alerting or monitoring; routed to SIEM, firewall, EDR, MISP or SOAR.
• Expiration: aged out by per-type TTL. URLs after a few days, IPs after weeks, hashes effectively never.

Without per-type TTL, a rule built on a 6-month-old URL list alerts on legitimate traffic.

Per-type detail: see the 5 IOC type hubs.

No feed is best. Most mature SOCs use both OSINT and commercial intelligence.

• OSINT drives automated blocks at scale.
• Commercial intel drives incident response and attribution.

• MITRE ATT&CK is MITRE's catalogue of attacker behaviour.
• 14 tactics (the why) and 200+ techniques (the how).
• Reports and detections cite IDs like T1059 and T1071.

The 14 ATT&CK Enterprise tactics, in execution order:

• Reconnaissance
• Resource Development
• Initial Access
• Execution
• Persistence
• Privilege Escalation
• Defense Evasion
• Credential Access
• Discovery
• Lateral Movement
• Collection
• Command and Control
• Exfiltration
• Impact

Reference: attack.mitre.org · Threat group catalogue · Enterprise technique matrix.

• Source: ~95 Twitter/X security researchers, scraped via RSS every 15 minutes.
• Output: CSV, JSON, RSS, MISP events and an MCP server, in windows of today / week / month / year. See /feeds.
• Access: No authentication, no rate limit for normal use.
• Strengths: high recall, real-time signal, tagged with malware family and category for easy filtering.
• Limitations: lower precision than analyst-curated feeds; cross-reference VirusTotal, urlscan.io or your sandbox before automated blocking.
• Best fit: high-volume signal feed, complementary to commercial intelligence; primary feed for resource-constrained teams; teaching dataset for blue-team training.

Integration recipes for MISP, OpenCTI, Splunk, KQL and IntelOwl on the Threat Hunting page.

• Blocking on IPs alone. Shared hosting reuses IPs. Add a second signal.
• Ignoring TTL. Expire URLs in hours, IPs in days, domains in weeks.
• Treating an IOC as a verdict. It is a lead. Check VirusTotal first.
• One feed only. Every feed has blind spots. Stack two or three.

APT (Advanced Persistent Threat)

A well-resourced adversary that maintains long-term access to a target environment. Often nation-state aligned. Tracked by aliases that vary by vendor.

IOC (Indicator of Compromise)

An observable artefact (URL, domain, IP, file hash) that suggests malicious activity in an environment.

C2 / C&C (Command-and-Control)

The infrastructure adversaries use to control compromised hosts. Common protocols: HTTPS, DNS, custom encrypted channels.

TTP (Tactic, Technique, Procedure)

The behaviour layer above IOCs. Harder for adversaries to change than infrastructure. Captured in MITRE ATT&CK.

OSINT (Open-Source Intelligence)

Intelligence sourced from publicly available information: blogs, social media, forums, leaked databases.

SOCMINT (Social Media Intelligence)

A subset of OSINT focused on social platforms (X/Twitter, LinkedIn, Telegram). TweetFeed is a SOCMINT-driven IOC feed.

MITRE

A US not-for-profit corporation that maintains the ATT&CK adversary behaviour knowledge base and the CWE software-weakness catalogue, among other public-good projects.