Dynamic Defense: Crafting threat models with real-world Intelligence
summary
Claim: build dynamic, accurate threat models from live data by automating collection, mapping observed indicators to MITRE techniques, and turning those into concrete mitigations and detection rules. Tools actually used: a Python-driven collection pipeline, MITRE ATT&CK plus ML-assisted tools (TRAM, THREAD) and attempted LLMs (found unreliable), and rule-driven logging via auditd + SIEM rules. Cadence is continuous collection with an end-to-end refresh about every 12 months; the prototype pipeline and detection pseudo-rules work in practice.
AI-written summary · about
chapters (11)
- 0:00Intelligence gathering
- 1:04Data collection pipeline
- 2:06Cyber threat actors
- 3:28MITRE ATT&CK tactics
- 5:57Threat actor groups and TTPs
- 7:22Threat-informed defense
- 8:03Business and risk contexts
- 10:09Mitigations and detections
- 12:56Scheduled task abuse
- 15:03Threat-informed methodology
- 16:25Q&A
related talks
34mMITRE Attack Flow: Laying Foundations for Predictive Intelligence
38mAdversary Detection Pipelines: Finally Making Your Threat Intel Useful
37mThreats versus Capabilities Building Better Detect and Respond Capabilities
38mHow I Learned to Stop Worrying and Build a Modern Detection & Response Program
33mDecoding Cyber Threats: A Practical Guide to Using Attack Trees
40mA Primer: Getting Started with MITRE Shield
13mMITRE D3FEND
12mMulti-Layer Defense for Scalable Threat Mitigation