◆CyberHUBBlue Team Level 1

Blue Team Level 1 domain

Threat Intelligence

Threat actors, APTs, intelligence types, indicators, MITRE ATT&CK, OSINT and intelligence reporting.

25 lessons5 sections76 source pages

Open glossary →

01

Introduction to Threat Intelligence

6 lessons

001Section Introduction, Threat IntelligencePDF pages 1-1 002Threat Intelligence ExplainedPDF pages 2-5 005Types of IntelligencePDF pages 5-9 009Why Threat Intelligence Can be UsefulPDF pages 9-12 012The Future of Threat IntelligencePDF pages 12-15 016Further Reading, Threat IntelligencePDF pages 16-17

02

Threat Actors and APTs

5 lessons

017Common Threat AgentsPDF pages 17-21 021MotivationsPDF pages 21-26 026Actor Naming ConventionsPDF pages 26-29 029What Are APTs?PDF pages 29-32 032Tools, Techniques, ProceduresPDF pages 32-37

03

Operational Threat Intelligence

5 lessons

037Indicators of Compromise ExplainedPDF pages 37-39 040MITRE ATT&CK FrameworkPDF pages 40-42 042Lockheed Martin Cyber Kill ChainPDF pages 42-45 045Attribution and its LimitationsPDF pages 45-47 048Pyramid of PainPDF pages 48-51

04

Tactical Threat Intelligence

5 lessons

051Threat Exposure Checks ExplainedPDF pages 51-52 052Watchlists/IOC MonitoringPDF pages 52-53 053Public Exposure Checks ExplainedPDF pages 53-56 056Threat Intelligence PlatformsPDF pages 56-61 061Malware Information Sharing Platform (MISP)PDF pages 61-65

05

Strategic Threat Intelligence

4 lessons

065Intelligence Sharing and PartnershipsPDF pages 65-66 067IOC/TTP Gathering and DistributionPDF pages 67-71 071Traffic Light ProtocolPDF pages 71-74 074Permissible Action ProtocolPDF pages 74-75