Through the Eyes of the Adversary: How to Build a Threat Intel Program
summary
CrowdStrike’s method turns threat intel into three concrete outputs: ingestable indicators for SIEM/EDR, internet monitoring for leaked credentials and payloads, and concise decision-focused reports. Teams automate YARA and SNORT rules, sandbox malware for signatures, and web-scrape surface/deep/dark sources. Notable claims: banking trojans precede ransomware to map lateral movement and domain admin compromise; nation-state espionage often uses human intel, USBs or bribery alongside remote access tools.
AI-written summary · about
chapters (10)
- 0:00Intro
- 5:02All conflicts between ourselves and the adversa visualized as a function of three components
- 9:21Let's dissect that exact information we want to understand about the adversary
- 12:31How do we conduct threat intelligence in each capability areas?
- 14:22What are some of the best practices & common
- 17:10There are generally three different types of thre intelligence stakeholders
- 18:37The Threat Intelligence team should be designe serve the organization's stakeholders
- 20:07Scenario 1: A financially motivated eCrime actor to conduct a ransomware attack
- 23:31Scenario 2: A nation-state actor with intent to a espionage against a pharmaceutical company
- 27:39In summary, we talked about the following
related talks
38mAdversary Detection Pipelines: Finally Making Your Threat Intel Useful
34mKeynote: Multiplying Threat Intelligence
27mStandard Classification: Connecting the Dots: How Threat Intelligence Protect...
34mFormulating An Intelligence-Driven Threat Hunting Methodology
35mThese Aren't the Threats You're Looking For: How Our APT Focus Ruins CTI
42mKeynote: The Expanding Universe of Cyber Threats
27mUnderstanding the Threats to Intelligently Defend
40mAdversary Simulation: Close the Gaps in Your Security Posture