Cyber Threat Intelligence: Intro to Cyber Threat Intel (TryHackMe)

Search for a command to run...

No comments yet. Be the first to comment.
Link to the challenge on TryHackMe: Modern Web Stacks Introduction During a time-boxed engagement, the first tester to identify Apache/2.4.49 in a Server: header already knows the exact CVE before the

Link to the challenge/walkthrough on TryHackMe: Broken Authentication Introduction Authentication is the process by which a web application verifies the identity of the user making a request. It typic

Link to the HealthGPT AI security CTF challenge on TryHackMe. Meet HealthGPT, a well-meaning virtual assistant used by a busy healthcare team. It helps clinicians look up procedures, draft notes, and

Link to the section of the AI Odyssey CTF on TryHackMe: Token City. It covers challenges like: ML Sec: The Loan Arranger | AI Sec + DFIR: Rogue Commit | AI Sec + Web App Sec: Sealed Substation | Agent

Link to the Privilege Escalation Challenge on TryHackMe: Linux Privilege Escalation: Automation Introduction By now, you should have an understanding of basic privilege escalation techniques and how t

In this article, I will write an Intro to Cyber Threat Intel write-up: The Basics that covers Introduction, Cyber Threat Intelligence, CTI Lifecycle, and CTI Standards & Frameworks.
What does CTI stand for? Cyber Threat Intelligence
IP addresses, Hashes and other threat artefacts would be found under which Threat Intelligence classification? Technical Intel
At which phase of the CTI lifecycle is data converted into usable formats through sorting, organising, correlation and presentation? Processing
During which phase do security analysts get the chance to define the questions to investigate incidents? Direction
What sharing models are supported by TAXII? Collection and Channel
When an adversary has obtained access to a network and is extracting data, what phase of the kill chain are they on? Actions on Objectives
What was the source email address? vipivillain@badbank.com

What was the name of the file downloaded? flbpfuh.exe

After building the threat profile, what message do you receive? THM{NOW_I_CAN_CTI}

Threat Actor Extraction IP Address: 91.185.23.222
Threat Actor Email Address: vipivillain@badbank.com
Malware Tool: flbpfuh.exe
User Victim Logged Account: Administrator
Victim Email Recipient: John Doe

Thank you for reading my article. Please leave any questions or comments on improving my learning journey and the THM challenges.