security +

use hacking to accompish political or philosophical goal

behavioral

-generally have the most resources

advanced persistent threats ; use advanced techniques and persisten (sometimes over years)

TAXII (Trusted Automated eXchange of Indicator Information) is a protocol used in cybersecurity to exchange threat intelligence data over a network in a secure, automated, and standardized way. It is often used in conjunction with STIX (Structured Threat Information eXpression), where TAXII serves as the transport mechanism for delivering STIX-formatted data.

TAXII helps organizations share information about cyber threats, such as indicators of compromise (IOCs), attack patterns, or vulnerability details, across different tools, platforms, or organizations. By using TAXII, organizations can collaborate and stay updated on emerging threats, making it easier to detect and respond to cyberattacks.

when employees use tech services that havent been authorized by their company

interference with an organization’s IT supply chain; includes hardware, software and service providers

open source intelligence; source of threat intelligence that is gathered from publically available sources; ie. search engine research, DNS lookups, and WHOIS queries

is it: timely, accurate, relevant?

Internet request for comments ; contain the detailed technical specifications for Internet protocols

Tactics, techniques, and procedures.

STIX stands for Structured Threat Information eXpression. It is a standardized language for representing and sharing threat intelligence. STIX is used to describe various aspects of cyber threats, such as attack patterns, malware, vulnerabilities, and threat actors, in a structured format that can be easily shared and processed by different systems.

STIX helps organizations improve their defenses by facilitating the sharing of threat data and enhancing collaboration across the cybersecurity community. It is widely used in conjunction with other frameworks like TAXII (Trusted Automated eXchange of Indicator Information), which helps transport the threat intelligence between systems.

nation-state actor

ISACs (Information Sharing and Analysis Centers) are non-profit organizations that facilitate the sharing of cybersecurity information and threat intelligence among organizations within a specific sector or industry. Their primary purpose is to improve collective security by enabling companies and institutions to exchange insights about potential threats, vulnerabilities, and incidents.

Each ISAC focuses on a particular industry, such as finance, healthcare, energy, or transportation, and provides members with access to real-time alerts, best practices, and analysis of cybersecurity risks. By collaborating through ISACs, organizations can better prepare for, defend against, and respond to cyber threats.

Definition:  malware demanding ransom
Special/Common Attributes:
• Encryption of files that are held for ransom
Common Mode of Transport:
• Phishing campaigns 
◦ Phishing emails or links in the email
◦ Can also include Remote desktop protocol, vulnerable services, front-facing apps
Indicators of Compromise (IOCs):
• Command and Control (C&C) traffic and/or contact to known malicious IP addresses
• Use of legit tools in abnormal ways to retain control of the compromised system
• Lateral movement processes that seek to attack or gain info about other systems or devices inside the same trust boundaries
• Encryption of files
• Notices to end users of the encryption process with demands for ransom
• Data exfiltration behaviors, including large file transfers
Mitigation Techniques:
• Effective backup system that stores files in a separate location that will not be impacted if the system or device it backs up is infected and encrypted by ransomware 

Definition:  disguised as legitimate software
Special/Common Attributes:
• Disguised as legit software
• Think: apps from the app store
Common Mode of Transport:
• Apps from the app store
Indicators of Compromise (IOCs):
• Signatures for the specific malware applications or downloadable files
• Command control system hostnames and IP addresses
• Folders or files created on target devices
Mitigation Techniques:
• Not downloading sus apps
• Controlling the software and apps that users can acquire
• anti-malware, EDR, and other tools that can recognize trojan behavior and stop it

Definition:  self-installing malware
Special/Common Attributes:
Common Mode of Transport:
• Attacks on vulnerableservices
• USB drives
Indicators of Compromise (IOCs):
• Known malicious files
• Downloads of additional components from remote systems
• Command control contact to remote systems
• Malicious behaviors using system commands for injection and other activities, including use of cmd.exe, msiexec.exe and others
• hands-on keyboard attacker activity
Mitigation Techniques:
• Network-level controls focused on preventing infection traffic
• Firewalls, IPS devices, network segmentation, and similar controls
• Patching and configuring services to limit attack surfaces

➤

one of the 1st vulnerability scanners on the market

Maintain a test environment contain copies of the same systems, running on production network and running scans against those test systems first. If the scans detect problems in the test environment, administrators may correct the underlying causes on both test and production networks before running scans on the production network.

read-only; only retrieve info from scan