CompTIA Security+ Preparation · lesson 35 of 45 · 25 min
Threat Intelligence Fundamentals
Threat intelligence — evidence-based knowledge about threats, including context, mechanisms, indicators, implications, and actionable advice. Helps organizations make informed security decisions.
Intelligence types:
Strategic — high-level, for executives. Trends, threat actor motivations, geopolitical context. “Nation-state actors are targeting critical infrastructure.”
Tactical — TTPs (tactics, techniques, procedures) of threat actors. For security architects and engineers. “APT29 uses spear-phishing with malicious Office documents.”
Operational — specific details about planned or ongoing attacks. For incident responders. “A campaign targeting financial institutions is active this week.”
Technical — specific IoCs: IP addresses, domains, file hashes, URLs. For security operations. Directly actionable in SIEM and firewall rules.
Intelligence lifecycle: Direction → Collection → Processing → Analysis → Dissemination → Feedback.
MITRE ATT&CK Framework
MITRE ATT&CK — Adversarial Tactics, Techniques, and Common Knowledge. A globally accessible knowledge base of real-world adversary behavior.
ATT&CK Matrix structure: Tactics (columns) → Techniques (rows) → Sub-techniques. 14 tactics in the Enterprise matrix: Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact.
Use cases: threat modeling, detection engineering (map detections to techniques), red team planning, gap analysis (which techniques are you not detecting?), incident investigation.
MITRE D3FEND — companion framework mapping defensive techniques to ATT&CK offensive techniques.
Threat actor groups — ATT&CK tracks named threat groups (APT28/Fancy Bear, APT29/Cozy Bear, Lazarus Group) with their known TTPs, tools, and targets.
ATT&CK in Practice
Security teams use ATT&CK to ask: “Which techniques is this threat actor known to use? Do we have detections for those techniques?” This gap analysis drives detection engineering priorities.
Key Terms
Key Terms
Knowledge Check — 10 Questions
Security+ — Threat Intelligence & MITRE ATT&CK
Technical threat intelligence includes:
- Threat actor motivations
- Specific IoCs: IP addresses, domains, file hashes
- Geopolitical context
- Attack trend reports
- Answer: Specific IoCs: IP addresses, domains, file hashes
Technical intelligence is the most actionable — directly used in SIEM rules, firewall blocklists, and EDR signatures. Strategic threat intelligence is primarily used by:
- SOC analysts
- Incident responders
- Executives and security leadership
- Firewall administrators
- Answer: Executives and security leadership
Strategic intelligence provides high-level context — threat trends, actor motivations, business risk — for executive decision-making. MITRE ATT&CK organizes adversary behavior into:
- CVEs and CVSS scores
- Tactics, Techniques, and Sub-techniques
- Malware families
- Network protocols
- Answer: Tactics, Techniques, and Sub-techniques
ATT&CK: Tactics = the goal, Techniques = how to achieve it, Sub-techniques = specific implementations.
The ATT&CK Enterprise matrix has how many tactics?
- 7
- 10
- 14
- 20
Answer: 14
The ATT&CK Enterprise matrix has 14 tactics: from Reconnaissance through Impact, covering the full attack lifecycle.
APT29 (Cozy Bear) is associated with:
- Criminal ransomware operations
- Russian nation-state espionage
- North Korean financial theft
- Iranian infrastructure attacks
- Answer: Russian nation-state espionage
APT29 (Cozy Bear) is attributed to Russian intelligence (SVR) — known for sophisticated espionage campaigns against governments and think tanks. A gap analysis using ATT&CK asks: Which CVEs are unpatched? Which adversary techniques are we not detecting? Which users have too many privileges? Which systems are unpatched? Answer: Which adversary techniques are we not detecting? ATT&CK gap analysis maps your current detections to the technique matrix — gaps show where you have blind spots. The intelligence lifecycle begins with:
- Collection
- Analysis
- Direction (defining requirements)
- Dissemination
- Answer: Direction (defining requirements)
Direction = defining what intelligence is needed and why. Without clear requirements, collection and analysis lack focus. MITRE D3FEND maps:
- Offensive techniques to CVEs
- Defensive techniques to ATT&CK offensive techniques
- Threat actors to their tools
- Vulnerabilities to patches
- Answer: Defensive techniques to ATT&CK offensive techniques
D3FEND is the defensive companion to ATT&CK — it maps countermeasures to the offensive techniques they mitigate.
Operational threat intelligence provides specific details about planned or ongoing attacks.
- True
- False
Answer: True
Operational intelligence is time-sensitive and specific — “a campaign targeting your sector is active this week” — used by incident responders.
Tactical threat intelligence describes:
- Specific IoCs
- TTPs — how threat actors operate
- Business risk trends
- Geopolitical context
- Answer: TTPs — how threat actors operate
Tactical intelligence describes adversary TTPs — used by security architects to design defenses against specific attack patterns.
Previous lesson: Log analysis and SIEM: correlation rules, dashboards, alerting, threat hunting
Back to CompTIA Security+ Preparation
Next lesson: Security automation: SOAR, playbooks, scripting for security operations