Chapter 23 — Threat intelligence and OSINT: methods I | Bachelor's Threat intelligence and OSINT

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 23 published. Map, example, EX067.

flowchart TD
  N0["Learning outcomes"]
  N1["23.1 Coding reports"]
  N2["Lab — technique frequency"]
  N3["23.2 Reading the result"]
  N4["23.3 Caution"]
  N5["23.4 From frequency to priority"]
  N6["23.5 Recording"]
  N7["23.6 Coding granularity"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX067"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["23.1 Coding reports"]
  N2["Lab — technique frequency"]
  N3["23.2 Reading the result"]
  N4["23.3 Caution"]
  N5["23.4 From frequency to priority"]
  N6["23.5 Recording"]
  N7["23.6 Coding granularity"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX067"]

[Learning outcomes]
    |
    v
[23.1 Coding reports]
    |
    v
[Lab — technique frequency]
    |
    v
[23.2 Reading the result]
    |
    v
[23.3 Caution]
    |
    v
[23.4 From frequency to priority]
    |
    v
[23.5 Recording]
    |
    v
[23.6 Coding granularity]
    |
    v
[Worked example] --> [Exercise EX067]

Learning outcomes

You will (1) code reports to ATT&CK techniques; (2) compute technique frequency; (3) interpret frequency cautiously; (4) turn frequency into defensive priorities.

23.1 Coding reports

Read each report and tag techniques with ATT&CK identifiers, citing the sentence that supports each tag. Avoid tagging from headlines; tag only what the text describes.

Amara keeps the supporting sentence next to each tag in her coding sheet, so a reviewer can check the tag without rereading the whole report. When the text is vague, such as "the attacker gained access", she codes "unknown" rather than guessing a technique. Tags are checked by a second reader on a sample.

Lab — technique frequency

"""Lab 5 (ch 23): rank ATT&CK techniques by frequency across synthetic sector reports."""
from collections import Counter
reports = {
    "R1": ["T1566", "T1204", "T1059"], "R2": ["T1566", "T1078"], "R3": ["T1190", "T1059", "T1486"],
    "R4": ["T1566", "T1204", "T1486"], "R5": ["T1078", "T1021", "T1486"],
}
c = Counter(t for ts in reports.values() for t in ts)
for tid, n in c.most_common():
    print(f"{tid} in {n}/{len(reports)} reports")

Run with python3 lab_freq.py. Verified output:

T1566 in 3/5 reports
T1486 in 3/5 reports
T1204 in 2/5 reports
T1059 in 2/5 reports
T1078 in 2/5 reports
T1190 in 1/5 reports
T1021 in 1/5 reports

23.2 Reading the result

Across five synthetic HSSC reports, Phishing (T1566) and Data Encrypted for Impact (T1486) appear in three each. User Execution (T1204), Command and Scripting Interpreter (T1059) and Valid Accounts (T1078) appear in two. Exploit Public-Facing Application (T1190) and Remote Services (T1021) appear once.

Amara checks the counts against the coding sheet before reporting them. Each count links to the report sentences behind it, so a reader can see how the figure was produced. The figures describe these five reports only and are presented as a summary of the sample, with the period and source stated. Amara includes the table in a short note for the security lead.

23.3 Caution

Five reports is tiny. Frequency reflects what reporters noticed and wrote down, not what happened. A technique appearing once may matter more if HCHT is exposed to it — an unpatched internet-facing system makes T1190 relevant despite its low count.

Amara adds an exposure column to her table, noting for each technique whether HCHT has the systems or weaknesses it targets. That changes the reading: a technique seen once but matching an exposed system moves up, while a frequent one already well controlled moves down. Counts are a starting point for analysis, not its conclusion.

23.4 From frequency to priority

Priority combines frequency, HCHT exposure and control gaps. Phishing is frequent, and HCHT already has training and filtering; remote services appear once, but supplier remote access is poorly monitored. The final priority list might rank remote-service monitoring above more phishing training.

Amara writes the reasoning for each position on the list, so the security lead can disagree with a specific judgment rather than the whole ranking. The list is reviewed after each quarter's reports and after any incident at HCHT, since either may change exposure or reveal a new gap. Changes are recorded with their reason.

23.5 Recording

Keep the coding sheet with report identifiers and supporting sentences so others can verify.

The sheet lists each report by identifier and date, each code with its supporting sentence, and any codes that were discussed and changed. Amara stores it with the analysis and links it from the final report. Another analyst can then recheck any count or apply the same scheme to the next quarter's reports, which makes trends over time comparable. The sheet is versioned in the team's repository.

23.6 Coding granularity

ATT&CK has techniques and sub-techniques. Coding at sub-technique level gives detail but splits small samples into tiny counts; coding at technique level is coarser but more stable. Choose one level for a given study and state it, or counts become incomparable.

Amara codes at technique level for her quarterly counts. Sub-technique detail is kept in the sheet for reference, so a later study with more reports can use it. Amara notes the chosen level in the report's method paragraph, and when comparing with HSSC's own counts, she checks which level they used before drawing any conclusion.

Comparing with internal incidents

Set the sector counts beside HCHT's own incident tags. If internal incidents show valid-account abuse far more often than sector reports, local conditions matter more than the sector average.

Worked example

Amara's first coding tags T1059 in a report that only says "the attacker ran commands". Her supervisor asks for the supporting sentence; it does not specify an interpreter. They keep the tag but note "low specificity" in the sheet.

Synthetic case. The reports are invented.

Errors and limits

Coding is subjective; double-code a sample to check agreement.

Exercises

EX067 — Lab leaders. Which techniques appeared most often in the lab?
Show marking criteria
Rubric: 3 = T1566 and T1486, 3/5 each; 2 = one; 1 = wrong; 0 = none.
EX068 — Low count, high priority. Why might T1190 deserve priority despite appearing once?
Show marking criteria
Rubric: 3 = HCHT exposure (unpatched internet-facing system); 2 = partial; 1 = no; 0 = none.
EX069 — Supporting sentence. Why record the supporting sentence for each tag?
Show marking criteria
Rubric: 3 = verifiability and review of coding; 2 = partial; 1 = formatting; 0 = none.

Synthesis

Code carefully, count honestly, read counts in context and combine them with exposure to set priorities.

Continue studying — chapter 23 of 40

← Chapter 22 (draft) · Course chapter index · Chapter 24 (draft) →