Adversary Detection Pipelines: Finally Making Your Threat Intel Useful
summary
Builds an operational pipeline that filters the whole internet down to organization-specific threats by correlating email attack data with internal tickets, sharing groups and OSINT, then producing named activity groups, heat maps and prioritized TTPs for red/purple/hunt use. Uses MITRE ATT&CK, the Diamond Model, Pyramid of Pain, Atomic Red Team tests, Joe sandbox and Malware Bazaar; extracts concrete behaviors (example: EXE phishing that steals browser/mail credentials; a YARA rule from 2015 still detects samples) and drives purple exercises via the MITRE ATT&CK Navigator.
AI-written summary · about
chapters (11)
- 0:00Start
- 4:33How Can Cti Provide More Value to the Organization
- 6:48False Flag Operations
- 11:18The Adversary Detection Pipeline
- 14:38Suggested Data Collection Sources
- 23:13The Adversary Detection Pipelines
- 25:00Incorporating the Cti Departmental and Business Initiatives for the Adversary Detection Pipeline
- 29:09Extracting Ttps
- 30:21Privilege Escalation
- 31:36Exfiltration
- 34:53Track Your Progress
related talks
29mThrough the Eyes of the Adversary: How to Build a Threat Intel Program
41mPurple Is the New Red - Providing the Most Value from Offensive Security
31mDon't Boil the Ocean: Using MITRE ATT&CK to Guide Hunting Activity
36mBeing A Better Defender By Channeling Your Worst Adversary:
48mMITRE ATT&CK: The Play at Home Edition
40mAdversary Simulation: Close the Gaps in Your Security Posture
33mDecoding Cyber Threats: A Practical Guide to Using Attack Trees
37mThreats versus Capabilities Building Better Detect and Respond Capabilities