'threat-intelligence' 검색 결과

Build a workflow that extracts and deduplicates threat indicators such as URLs and IP addresses, creates readable reports with links disabled, and prepares standardized STIX 2.1 data for sharing through MISP or TAXII.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Preparing threat reports with links disabled
• Consolidating indicators from multiple sources
• Distributing threat indicators through MISP or TAXII

Set up MISP to collect threat feeds and centrally manage indicators such as suspicious IP addresses and domains. Configure automated synchronization, connect related findings, and export indicators to security monitoring platforms or blocklists.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Centralizing threat indicators from multiple feeds
• Deploying MISP with Docker
• Automating threat feed synchronization

Collect indicators of compromise, technical clues such as suspicious domains and file hashes, from incident evidence. Add context and confidence scores, then prepare them for detection, blocking, and structured sharing with partners.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Extracting threat indicators from incident evidence
• Adding threat context and confidence scores to indicators
• Preparing indicator lists for detection and blocking

Build an OpenCTI pipeline that adds external context to indicators of compromise, such as suspicious IP addresses. Connect intelligence services, relate indicators to known attackers and campaigns, and score confidence to help analysts prioritize investigations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Deploying OpenCTI and configuring enrichment connectors
• Automatically adding context to suspicious IP addresses and domains
• Relating indicators to known attackers and campaigns

Investigate ransomware payment addresses using public blockchain records. Trace transfers, group addresses likely controlled by the same entity, identify links to exchanges or mixing services, and organize findings into a report for incident responders and investigators.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating a payment address found in a ransom note
• Tracing funds after a ransom payment
• Comparing related wallets across ransomware incidents

Analyze threat intelligence stored in MISP, a platform for sharing security threat data. Summarize event counts, indicator types, attacker groups, and trends over time to create a threat landscape report for a chosen period.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Create a threat landscape report for the past 90 days
• Summarize attacker activity and frequently tagged attack techniques
• Track changes in submitted threat indicator types and volumes

Build a Python system that follows DNS history, domain registration records, and certificate information from known suspicious domains or IP addresses. Map related attack infrastructure, identify shared connections, and monitor for newly discovered domains matching known patterns.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Finding related domains from a known suspicious IP
• Mapping attacker command-and-control infrastructure
• Monitoring domains that match known naming patterns

Collect and organize victim postings from ransomware data leak sites through tracking feeds. Analyze group activity over time, compare sector and country patterns, and produce threat reports with risk assessments and defensive recommendations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Track monthly activity across ransomware groups
• Assess ransomware exposure by sector or country
• Identify newly observed ransomware groups

Find lookalike domains with dnstwist and prioritize suspicious results using DNS records, registration age, and website similarity. The skill also covers monitoring for new findings and producing blocklists and reports to support domain takedown requests.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Finding domains that imitate a company or brand
• Investigating suspected phishing domains
• Monitoring for newly discovered lookalike domains

Analyze threat intelligence feeds to extract indicators of compromise, observable clues of possible attacks, and their campaign context. Assess source quality, standardize formats, remove duplicates, and enrich indicators for distribution to security monitoring systems.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing the quality and relevance of threat intelligence feeds
• Standardizing indicators into STIX 2.1
• Removing duplicates and adding attack campaign context

Map threat groups and their attack techniques to MITRE ATT&CK, a catalog of adversary behavior. Generate Navigator visualization files, compare groups, and overlay detection coverage to identify gaps that can guide defensive planning.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Profiling the attack techniques used by a specific threat group
• Comparing techniques across multiple threat groups
• Finding detection gaps against a target adversary

Turn cyber threat intelligence reports into a searchable library of attacker behaviors linked to MITRE ATT&CK techniques. Export structured STIX 2.1 data, a threat information exchange format, and create detection rule templates from documented activity.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Cataloging attacker behaviors from threat intelligence reports
• Organizing attack patterns by tactic, technique, and threat actor
• Creating detection rule templates from documented behaviors

Map attacker behaviors and indicators of compromise, or traces of an intrusion, to MITRE ATT&CK techniques. Build coverage heatmaps, compare threat groups, and identify monitoring gaps to guide detection improvements and threat intelligence reporting.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Mapping attacker behaviors and intrusion traces to ATT&CK techniques
• Visualizing detection coverage with ATT&CK Navigator
• Identifying attack techniques missing from monitoring

Monitor public certificate issuance records to find suspected phishing domains, brand lookalikes, and unauthorized certificates. Use crt.sh for historical searches and Certstream for live alerts, then summarize suspicious findings and detection reasons in a report.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Monitor domains that resemble a company brand
• Investigate certificate issuance history
• Discover subdomains in public certificate records

Map threat groups’ documented attack techniques in MITRE ATT&CK Navigator. Creates visual layers and heatmaps, compares groups, and highlights techniques missing from existing detection coverage to support security reporting and decisions about detection priorities.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Visualizing a threat group's attack techniques
• Comparing techniques shared by multiple threat groups
• Finding gaps in existing detection coverage

Investigate suspicious URLs with URLScan.io by reviewing screenshots, redirects, page content, and network requests. Extract domains, IP addresses, and file hashes as indicators of compromise, then compare findings with threat intelligence sources.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious links in emails
• Checking pages for brand impersonation and credential forms
• Tracing redirects and extracting domains, IPs, and hashes

Research malware families through Malpedia, connecting aliases, associated threat groups, and relationships between malware that loads other malware. Collect YARA rules, patterns used to identify malware, and organize references to support investigations and detection work.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Resolving different vendor names for the same malware
• Mapping malware associated with a threat group
• Documenting chains in which malware loads other malware

Compare evidence from cyber operations to assess which attacker may be responsible. Weigh shared infrastructure, attack methods, malware similarities, timing, and language clues against competing explanations, then report attribution findings with justified confidence levels.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing possible attackers during an incident investigation
• Comparing infrastructure and attack methods across campaigns
• Evaluating conflicting evidence against multiple hypotheses

Investigate suspicious IP addresses, domains, URLs, file hashes, and email artifacts using multiple threat intelligence sources. Assess confidence that each indicator is malicious, check links to known campaigns, and document evidence for blocking, monitoring, or allowing it.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Triaging indicators from phishing emails
• Investigating suspicious IP addresses and URLs in alerts
• Assessing bulk indicators before adding them to blocklists

Delegate threat-intelligence research and updates to AgentSec, then validate the guide and landing mirrors.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

IOC extraction, threat intelligence correlation, MITRE ATT&CK mapping, hunt hypothesis generation, and detection rule creation

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, a

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Operationalizes a threat intelligence report into hunts: extracting IOCs and TTPs, mapping behaviors to ATT&CK and available telemetry, prioritizing durable behavioral indicators over volatile atomic ones, and producing concrete hunt queries. Activates for requests to hunt from a threat report, operationalize CTI, or turn an intel report into detections.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Plan, run, and measure an adversary engagement operation using the MITRE Engage framework so that deployed deception is driven by strategy instead of deployed ad hoc. Covers the Engage Matrix (Prepare, Expose, Affect, Elicit, Understand), the 10-Step Operational Process, mapping engagement Activities to the ATT&CK techniques they expose, and defining measurable Goals and Operational Objectives. Use when a team has honeypots, honeytokens, or canary tokens but no coordinating strategy, when leadership asks "should we engage attackers and how", when building a deception/denial program, when writing an adversary engagement operation plan, or when deciding which deception Activities to deploy against a specific threat actor. Keywords: MITRE Engage, adversary engagement, cyber deception strategy, denial and deception, Engage Matrix, EAC, EGO, Expose Affect Elicit, deception program, honeypot strategy, engagement operation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.