# CTI for Alert Triage (TryHackMe)

Link to the challenge on TryHackMe: [**CTI for Alert Triage**](https://tryhackme.com/why-subscribe?proOnly=true&roomCode=ctiforalerttriage)

## **Introduction**

CTI for Alert Triage shifts gears from SIEM pivoting to something a lot of security writeups skip past: how a single high-severity alert actually gets classified as malicious. Starting from one SIEM detection an Office process spawning wscript.exe, which in turn drops an executable the room walks through correlating that alert against MISP attributes, an OpenCTI intrusion-set report, and EDR telemetry to build confidence that this is a real, active phishing campaign rather than a one-off false positive. The exercise is as much about intel tradecraft as it is technical detection: understanding MISP's category/type distinction, recognizing when a fresh IOC extends a known campaign versus signaling something new, and producing a handoff note that's actually usable by the next analyst in the chain.

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/894543e0-18d8-4936-aead-70b623040c8d.png align="center")

### SIEM Alert - *T1566.001 (Spearphishing Attachment)*

```markdown
[SIEM Rule]
Rule ID          : R-1389
Rule Name        : Office application spawning executable
Severity         : High
Timestamp        : 2026-06-09 14:03:11 UTC
MITRE            : T1566.001 (Spearphishing Attachment)

[Triggering Event]
event_type       : process_creation
process_pid      : 9042
process_name     : onboarding_form.exe
process_hash     : 9c2e77...b14f30
parent_name      : wscript.exe
grandparent_name : winword.exe
user             : CORP\t.obi
host             : PC-EU-204
```

### MISP Event

*   In MISP, each indicator inside an event is stored as an **Attribute**, and every attribute has two key fields that tell you what kind of IOC it is:
    
    *   **Category** – describes the role of the indicator in the attack (e.g., "Network activity", "Payload delivery", "Persistence", "Payload installation")
        
    *   **Type** – describes the technical type of the data itself (e.g., `ip-dst`, `domain`, `md5`, `sha256`, `url`, `filename`)
        
    
    So you determine what kind of IOC you're looking at by checking the attribute's **Type** (the actual indicator format) alongside its **Category** (what stage/role it plays in the attack), rather than just reading the raw value.
    

```markdown
[MISP Event]
Title      : HR-themed phishing campaign - May 2026
TLP        : Amber
Threat     : High
Analysis   : Ongoing
Tags       : admiralty-scale:source-reliability="a"
             internal:source="EMEA CTI Team"
Galaxies   : malware:Cobalt Strike
             mitre-attack-pattern:T1566.001
             mitre-attack-pattern:T1059.005

[MISP Attributes]
Domain     : hr-portal-secure[.]com
Domain     : hr-onboarding-check[.]com
SHA256     : 23fb39...ac0176 (candidate_cv.docx)
SHA256     : 4b8a11...cc9f02 (resignation.docx)
SHA256     : 9c2e77...b14f30 (onboarding_form.exe)

Analyst note:
  HR-focused phishing wave was observed across the region starting
  end of May, 2026. Themed emails from compromised SMTP servers
  deliver macro-enabled DOCX files that download Cobalt Strike C2
  from the HR-themed domains, registered 2-5 days before use.
```

### OPENCTI Campaign Report

```markdown
[OpenCTI Report]
ID               : intrusion-set--49f8b1c0-3d7a-4e25-b96f-8a1c5d2e0734
Name             : UNC-011 delivers Cobalt Strike via MS Office macros
Status           : Active
First observed   : 2026-04-12
Last observed    : 2026-05-28

[Intrusion Set]
Attributed actor : Unknown (UNC-011)
Primary motive   : Financial gain
Victimology      : HR, finance, and recruitment roles

[Knowledge]
Used Malware     : Cobalt Strike
Exploited CVE    : CVE-2026-21509
Exploited CVE    : CVE-2025-21298

[Kill Chain]
  1. Spearphishing attachment (T1566.001)
  2. User enables macro; macro spawns wscript (T1059.005)
  3. Wscript drops second-stage C2 beacon (T1105)
  4. Beacon persists via scheduled tasks (T1053.005)
  5. Hands-on-keyboard activity and pivoting (T1003)

[Suggested Hunts]
  - Thematically-named MS Office files in Downloads / Temp
  - PowerShell or wscript spawned by MS Office applications
  - Creation of suspicious HKCU Run key entries
  - Outbound traffic to the themed DNS domains
```

### EDR Telemetry

```markdown
[Network Telemetry]
Analyzed Process : onboarding_form.exe (9042)
DNS Resolution   : hr-portal-secure[.]com
DNS Resolution   : trust-service-eu[.]com

[Filesystem Telemetry]
Analyzed Process : onboarding_form.exe (9042)
Created File     : C:\Windows\System32\Tasks\WinUpd.xml
```

## Questions

1.  **Which MITRE ATT&CK sub-technique ID is used for the initial access stage of this campaign?** `*T1566.001 (Spearphishing Attachment)*`
    
    1.  The SIEM rule is mapped to T1566.001, and MISP galaxies and the OpenCTI kill chain both list the Spearphishing Attachment.
        
2.  **Looking at the MISP event, how many indicators (IOCs) are tied to the attack campaign?** `*5*`
    
    1.  One IOC you saw in the SIEM alert (onboarding\_form.exe), two DOCX attachments, and two C2 domains you can hunt for. Five indicators total.
        
3.  **According to the OpenCTI report, when was this campaign first observed?** `*April, 2026*`
    
    1.  The "First Observed" field is set to 2026-04-12. The May MISP report is a later instance of activity OpenCTI has tracked since April.
        
4.  **What is the strongest piece of intel supporting a malicious classification for this alert?**`*The indicators match a trusted MISP event and are linked to an active campaign*`
    
    1.  Internal CTI team intel with an active campaign match and a documented TTP chain in OpenCTI outweighs any single behavioral signal.
        
5.  **What indicator observed in SIEM/EDR has NOT been previously mentioned in MISP or OpenCTI?** `*trust-service-eu[.]com*`
    
    1.  Only trust-service-eu\[.\]com is a new indicator. Atomic IOCs are short-lived, so fresh domains can appear with every attack wave.
        

***Intel Handoff Note***

*Date:* ***June 09, 2026***

*Title:* ***New wave of HR-themed phishing***

*Classification:* ***Confirmed Malicious***

*Confidence:* ***High Confidence***

***IOCs***

*Indicators of compromise observed in this investigation*

*   Domain name: hr-portal-secure\[.\]com
    
*   Domain name: trust-service-eu\[.\]com
    
*   File and hash: onboarding\_form.exe
    

***Campaign Context***

*The campaign and MITRE techniques this intel maps to*

*   Observed TTP: T1566.001 (Spearphishing Attachment)
    
*   Link to the MISP event (HR-themed phishing campaign)
    
*   Link to the OpenCTI event (intrusion-set--49f8b1c0...)
    

***Intel Gaps***

*What you do not yet know*

*   Phishing email IOCs, such as subject or sender, aren't yet identified
    
*   Hands-on-keyboard activity not yet identified; PC-EU-204 is pending DFIR
    

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/4e4024ce-37d9-425c-8263-ec7ec5a71f55.png align="center")

## **Conclusion:**

The real value in this room isn't spotting T1566.001; that's the easy part once you've seen the process tree. It's the triage judgment underneath: knowing that a single behavioral signal is far weaker evidence than a match against a trusted, actively-tracked MISP event and OpenCTI kill chain, and knowing how to spot the one indicator (trust-service-eu\[.\]com) that doesn't match existing intel and therefore deserves its own line in the handoff note rather than getting silently folded into the known campaign. That distinction known IOC vs new IOC is exactly what keeps CTI useful over time instead of becoming a static list nobody revisits. The intel handoff note format is worth internalizing too: confirmed IOCs, mapped TTPs, and an explicit "gaps" section are what separate a usable analyst-to-analyst handoff from an alert that just gets closed and forgotten.