CTI FOR HUNTING BEHAVIOUR

From Reactive IOC Feeds to Adversary Centric Threat Intelligence

The Problem With Chasing Indicators

The uncomfortable truth about most threat intelligence programs, or at least one of them, is that they generate data faster than anyone can act upon. A SIEM fires an alert on a malicious IP, the analyst blocks it, the adversary rotates to a new one in les than 40 seconds. The SIEM fires again!

The Gartner definition of CTI is worth restating precisely because it is so routinely ignored in practice. Intelligence is not data, it is processed, contextualised, actionable knowledge. A feed of 70,000 IP addresses is not intelligence, knowing that 3 of those IPs are actively operated by a nation-state actor targeting your sector’s supply chain, using a specific C2 beacon pattern, now that’s intelligence.

David Bianco frames this through the Pyramid of Pain, a model that every security practitioner knows but too few operationalise. At the base there’s the hash values and IP addresses. Easy for defenders to block, and easier for adversaries to rotate. At the apex at the top, we have the TTPs, a change in a hash value is a 30 second delay. A change in a TTP you have to retrain your team, rewrite your tooling, rebuild your operational workflow, that is where pain actually lives, for both the good and bad folks.

What Cyber Threat Intelligence Means in Practice

CTI operates at three levels, depends on who you ask. We have Strategic CTI that answers the who and why , it informs leadership about which nation-state actors or cyber-criminal groups have the intent and capability to target the organisation. Operational CTI answers how, it maps specific campaigns, infrastructure patterns, and the modus operandi. Tactical CTI answers what, the concrete indicators that feed SIEM rules, EDR policies, and firewall blocklists.

The failure mode that kills most programs is conflating tactical CTI with the entire discipline. Tactical CTI is the exhaust of good operational and strategic work. Consumed in isolation, without the behavioural context that explains why those indicators matters degrades rapidly its value. Domains expires, IPs are rotated, Hashes get recompiled. The adversary’s intent and methods, their ‘modus operandi’ remain constant across years of campaigns.

Threat assessment requires all three components simultaneously: intent, capability, and opportunity. Remove any one and you no longer have a threat, you might have a risk scenario maybe. There is a major difference between a well-resourced APT that has targeted your sector for years, and a ransomware affiliate who stumbled onto your VPN because you left a port open.

The Intelligence Cycle

The intelligence cycle is 6 phases: Direction & Planning, Collection, Processing & Enrichment, Analysis, Dissemination, and Feedback.

Direction and planning, is the most skipped step and the most consequential. Without Priority Intelligence Requirements (PIRs), collection becomes pointless, enrichment becomes more noise processing, and analysis produces answers to questions nobody even asked.

A well-formed PIR looks like this, what initial access techniques is APT Group X currently deploying against financial services organisations in the Asia-Pacific region, and what detection data would confirm their presence in our environment?

That question constrains collection to relevant sources, focuses enrichment on confirming or denying observable behaviours, and produces analysis that a threat hunter can immediately operationalise. Without it, the TIP accumulates indicators and the SOC accumulates alerts, and nothing is accomplished.

The feedback loop closes the cycle, when a hunt surfaces new adversary infrastructure or techniques, that finding goes back into the intelligence process and upgrades the entire program’s picture of the threat. Skip feedback and each hunt is a one-off expenditure rather than a compounding investment. Our main objective here or at least should be, is turning successful CTI activities and manual queries into newly codified automated detection rules for your SIEM and EDR platform, here is where CTI meets detection engineering.

Hunting Behaviour: The Hypothesis Driven Model

Threat hunting is not running queries, running queries is what you do only after you have a hypothesis. The hypothesis is the critical artifact of the specific verifiable behaviour based claim that we structure the entire hunt on.

Consider this threat actor activities as our example here. APT29 exploited CVE-2023–23397 to execute code through malicious Outlook calendar invitations, establishing persistence via scheduled tasks. The observable behavioural trace here is clear, Outlook spawning schtasks.exe. If APT29 is present in this environment, we might or should observe outlook.exe as a parent process of schtasks.exe or powershell.exe within the period of interest.

This hypothesis maps directly to two ATT&CK techniques: T1204.002 (User Execution : Malicious File) for initial access, and T1053.005 (Scheduled Task) for persistence. The hunt query is a structured expression of that mapping against endpoint telemetry. If it validates, the finding is escalated to the IR team to be actioned immediately.

The final and most important step is detection engineering as we mentioned, converting the validated manual hunt into an automated rule. YARA for file-based detection of malware families through invariant strings and import hashes. Sigma for host-based behavioural detection across SIEM platforms. Snort and Suricata for network-layer detection of C2 patterns, JA3 fingerprints, and DNS tunnelling signatures. The manual hunt is temporary while the automated detection it produces is permanent.

Enrichment and Analytic Pivoting

Raw indicators become intelligence through enrichment, the process is iterative and investigative. Start with a suspicious domain. Pivot through passive DNS to find the IP it resolved to lets say last month for example. Pivot through Censys ‘sidenote one of my favourite tools’, to find other services running on that IP. Pivot through SSL certificate transparency logs to find other domains sharing the same certificate. Pivot through ASN metadata to find hosting preferences. What began as a single domain becomes a cluster of related infrastructure, a campaign signature that persists even as individual indicators IOCs are rotated.

The Diamond Model provides the conceptual structure for this work. Every intrusion event has 4 vertices: Adversary, Infrastructure, Capability, and Victim. An investigation populates these vertices from whatever initial facts are known and pivots across edges to infer the unknowns. A malware hash (capability) reveals a C2 domain (infrastructure). The C2 domain reveals other victims (victim). The combination of infrastructure and capability, cross-referenced against OSINT and threat actor profiles, attributes the activity to a known group (adversary).

MITRE ATT&CK supplies the standardised vocabulary that makes the capability vertex precise. An analyst does not label a vertex ‘malware’, they map the observed behaviours to specific techniques and sub-techniques, building a structured profile that enables comparison across campaigns and attribution across time.

Practical PowerShell for Actors Indicator Collection

The gap between understanding and operationalising CTI is where most programs lose momentum. The following script closes this gap or at least attempts to. It queries the MITRE ATT&CK STIX repository, extracts techniques associated with a named threat actor, maps them to observable process and network behaviours, and outputs a structured JSON report ready for SIEM ingestion or TIP import. **No commercial tooling required.**

https://github.com/RisingCyber/CTI-ATTACKCollector

What the Script Produces

Running the script against Lazarus Group emits a structured JSON report containing every mapped ATT&CK technique, the kill-chain phase, observable data sources, MITRE detection guidance, and a pre-formed hunt hypothesis statement for each technique. That hypothesis statement is the bridge between intelligence and hunt query, it names the actor, the technique ID, and the data sources that would contain confirming evidence. Feed the JSON into a TIP, a SIEM, or a spreadsheet. The output is immediately actionable.

The JSON output schema is compatible with another tool I’ve created **Phoenix CTI Forge’s**. Drop the file into the Forge’s import panel for interactive hypothesis triage and detection rule generation.

What Changes When You Hunt Behaviour

The shift from indicator-reactive to behaviour-driven threat hunting is not a tooling decision, it is a conceptual one, tools are secondary. Its the questions that drive collection, the hypotheses that structure hunts, and the detection engineering discipline that converts findings into durable rules. All these together are the capabilities that determine whether a CTI program actually reduces risks or merely produces activity metrics. The Pyramid of Pain is a heuristic, but it points at something tangible and real. Blocking an IP takes two minutes and costs the adversary nothing. Detecting and disrupting TTPs forces the adversary to change how they operate entirely. That is expensive and time consuming for them, and it is the only form of defensive advantage that compounds over time.

Without data, you’re just another person with an opinion. -W. Deming