Outline

Investigate threat actors' motivations and capabilities. • Utilize fundamental Open-Source Intelligence (OSINT) techniques. • Operate OSINT tools such as WHOIS, Shodan, Maltego, and Google Dorks. • Perform hands-on data gathering from public intelligence sources.

Outline

Identify diverse threat intelligence sources, including open-source feeds, dark web monitoring, and internal SIEM/EDR logs. • Implement effective passive and active data collection techniques. • Address legal and ethical considerations in intelligence gathering. • Structure and normalize threat data using formats like STIX/TAXII, JSON, and CSV.

Outline

Apply advanced threat analysis techniques, including pattern recognition and correlation. • Identify Tactics, Techniques, and Procedures (TTPs) of adversaries. • Conduct static and dynamic malware analysis using sandboxing tools like Hybrid Analysis and ANY.RUN. • Understand the complexities and challenges of threat attribution.

Outline

Facilitate threat intelligence sharing through ISACs and established standards like STIX/TAXII and OpenIOC. • Integrate CTI feeds into Security Information and Event Management (SIEM) systems (e.g., Splunk, IBM QRadar). • Automate threat detection and response using Security Orchestration, Automation, and Response (SOAR) platforms. • Configure a SIEM in a lab activity to ingest threat feeds and generate alerts.

Outline

Develop and apply YARA rules for custom threat detection. • Investigate emerging trends in CTI, including AI/ML applications and cloud environment intelligence. • Participate in a final capstone project involving a simulated cyber incident scenario. • Collect relevant intelligence, analyze attack TTPs, and produce a threat report during the capstone.