Threat intelligence for detection engineering in practice
This section contains two examples demonstrating how we can use OSINT from different types of sources to develop a detection. The first will take a blog post published by a reputable vendor and turn the free-from text into detection criteria. The second example walks through leveraging VirusTotal, an online sandbox, to take a static indicator and obtain contextual information for more robust detection.
Example – leveraging threat intel blog posts for detection engineering
In this example, we will take a blog post about an attack campaign and see how we can use it to develop a detection. We performed an exercise in Chapter 6 similar to this but focused on indicators. Now, we are going to look at all levels of the Pyramid of Pain in an attempt to create more robust detections. For this exercise, we will use a report from Trend Micro about a threat actor delivering a backdoor via a watering hole attack: https://www...