Beginner
Workbook

Overview

One of the most common tasks a CTI analyst performs is investigating a suspicious IP address. An IP can surface in a firewall log, an email header, a phishing URL, or a malware command-and-control beacon. Before blocking or escalating, a good analyst collects context from multiple sources to understand what the IP is, who operates it, and what malicious activity has been linked to it.

In this exercise you will take a single suspicious IP address and pivot through four public intelligence platforms to build a one-page threat profile — exactly as a real SOC analyst would.

Background Concepts

What is OSINT?

Open Source Intelligence (OSINT) is intelligence gathered from publicly available sources: websites, domain registrations, certificate transparency logs, and community threat feeds. In CTI, OSINT is the primary method for investigating external threats without needing access to private or classified data.

What is an ASN?

An Autonomous System Number (ASN) is a unique identifier assigned to a collection of IP addresses managed by a single organisation — an ISP, a company, or a hosting provider. When you see AS14618 (Amazon), the IP is hosted on Amazon's infrastructure. This matters because attackers often use cloud providers or "bulletproof hosters" to mask their true location.

Reputation Scores

Threat intelligence platforms assign reputation scores to IPs based on community reports, automated scanning, and historical behaviour. A high abuse confidence score on AbuseIPDB (e.g. 95%) means the community strongly believes the IP is malicious. These scores are a starting point — always correlate across multiple sources before acting.

Why Pivot?

Pivoting means using one piece of data to discover related data. An IP leads to a domain, the domain leads to other IPs, those IPs lead to malware samples. This chain of discovery lets you map an attacker's full infrastructure rather than just one indicator.

Tools for This Exercise

Target IP

Target IP:  185.220.101.45
  

Step-by-Step Instructions

Step 1 — Geolocate and Identify the Operator (IPinfo)

1. Navigate to ipinfo.io and enter 185.220.101.45 in the search box.

2. Locate and record the following fields:

Step 2 — Check Abuse History (AbuseIPDB)

1. Navigate to abuseipdb.com and enter the IP address.

2. Record the following from the results page:

Step 3 — Check Threat Reputation (VirusTotal)

1. Navigate to virustotal.com and click the Search icon.

2. Enter 185.220.101.45 and press Enter.

3. Work through the DETECTION, DETAILS, and RELATIONS tabs and record:

Step 4 — Examine Exposed Services (Shodan)

1. Navigate to shodan.io. Create a free account if prompted.

2. Enter 185.220.101.45 in the search bar and review the host page.

3. Record:

Deliverable — IP Threat Profile

Fill in this template to produce your completed threat profile. Submit this as your exercise deliverable.

Example Answer

Reflection Questions

• Based on your findings, is this IP likely a residential user, a legitimate business, or a threat actor? What evidence supports your conclusion?
• Why might an attacker choose to host their infrastructure on a cloud provider rather than using their own systems?
• If you found this IP in your company's firewall logs connecting to an internal server, what would your next investigative steps be?
• What is the difference between an indicator that is malicious and one that is suspicious? How does confidence level affect this distinction?

Overview

When a suspicious file is found on a system — quarantined by an antivirus, pulled from an email attachment, or discovered during a forensic investigation — one of the first analyst steps is to compute or obtain its cryptographic hash and look it up in threat intelligence databases.

A file hash is a unique digital fingerprint for a file's contents. Even a single changed byte produces a completely different hash. This means that if a known malware sample's hash is stored in a database, any copy of that file can be instantly identified — even if the filename has been changed or disguised.

Background Concepts

Hash Types: MD5, SHA1, SHA256

What is a Malware Family?

A malware family is a group of variants sharing the same code lineage, behaviour, or origin. "Emotet" is a family — thousands of different Emotet samples have existed over the years, each with a unique hash, but they all share the same core code, infrastructure, and purpose.

Identifying the family is crucial because it immediately tells you: what the malware does, what infrastructure it uses, how it achieves persistence, and which threat actor has historically deployed it.

What is a C2 Domain?

C2 (Command-and-Control) is the server the malware calls home to — receiving instructions from the attacker and sending stolen data back. Identifying C2 infrastructure is critical: (a) you can block those domains/IPs on your firewall, and (b) if you see those domains in DNS logs, it confirms a device is infected.

Static vs Dynamic Analysis

Target Hash

SHA256:
1f2e3d4c5b6a7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e
  

Step-by-Step Instructions

Step 1 — Look Up the Hash on VirusTotal

1. Navigate to virustotal.com, click the search icon, and paste your SHA256 hash.

2. If the hash is known, you will see results with DETECTION, DETAILS, RELATIONS, and COMMUNITY tabs. If unknown, ask your instructor for a working hash.

3. On the DETECTION tab, record:

1. Click the DETAILS tab and record:

1. Click the RELATIONS tab. Record all entries under Contacted Domains, Contacted IPs, and Dropped Files.

Step 2 — Look Up the Hash on MalwareBazaar

1. Navigate to bazaar.abuse.ch. Select "SHA256 hash" from the search dropdown and paste your hash.

2. If known, record:

Step 3 — Analyse Sandbox Behaviour on HybridAnalysis

1. Navigate to hybrid-analysis.com and click the search icon.

2. Select "Hash" as the search type, paste your SHA256, and press Enter.

3. If a sandbox report exists, record:

Step 4 — Research the Malware Family

1. Compare the family name across all three platforms. Do they agree? Record any discrepancies.

2. Search the family name on Google (e.g. "Emotet malware overview"). Find a reputable source (Mandiant, CISA, security vendor blog) and record a 2–3 sentence summary covering:

• What the malware does (infostealer, banking trojan, ransomware dropper, remote access tool)
• The threat actor(s) historically associated with this family
• The primary delivery method

Deliverable — Malware Profile

Reflection Questions

• Why might different antivirus vendors give the same malware different names? What challenges does this inconsistency create for analysts?
• If you found this file's hash in logs from a workstation in your organisation, what immediate steps would you take?
• What is the difference between static analysis and dynamic analysis? When would you rely on each?
• Why is it important to identify C2 infrastructure as quickly as possible after detecting a malware infection?

Overview

Published threat intelligence reports from Mandiant, CrowdStrike, CISA, and MITRE are among the most valuable free resources available to any security team. A single well-written report can contain intelligence that would take an in-house team months to develop independently.

A raw threat report can be 20–100 pages long and dense with technical detail. The skill of a CTI analyst is knowing exactly what to extract, how to structure it, and how to make it actionable. In this exercise, you will practise extracting four key categories of intelligence from a real published report.

Background Concepts

What is a Threat Actor / APT Group?

An Advanced Persistent Threat (APT) group is a sophisticated, usually state-sponsored adversary that conducts long-term, targeted cyber espionage or disruption campaigns. APT groups are given names by the vendors that track them. The same threat actor often has multiple names:

Vendor         Name
Mandiant   →   APT28
CrowdStrike →  Fancy Bear
Microsoft  →   Forest Blizzard
Secureworks →  Iron Twilight
  

What are TTPs?

TTPs (Tactics, Techniques, and Procedures) are the most valuable and durable intelligence a report can contain. While an actor can cheaply change their IPs and domains (IOCs), changing fundamental operating methods is expensive and reveals investigative pressure.

What are IOCs?

IOCs are artefacts that indicate a security breach has occurred. They are the most immediately actionable intelligence — you can block an IP or hash in minutes.

Recommended Reports

Choose one of the following freely available reports. Your instructor may assign a specific one.

Step-by-Step Instructions

Step 1 — Locate and Skim the Report

1. Use the table above to find your assigned report. Download the PDF or open the web version.

2. Skim the executive summary first (usually the first 1–2 pages). This gives you the big picture before the technical detail.

3. Identify the report's structure — most follow this pattern:

• Executive summary
• Threat actor overview
• Campaign timeline
• Technical analysis (TTPs)
• IOC appendix

Step 2 — Extract the Threat Actor Profile

1. From the report's overview section, fill in the threat actor profile below:

Step 3 — Map TTPs to MITRE ATT&CK

1. As you read the technical section, identify specific techniques. For each one:

• Write down the description from the report
• Go to attack.mitre.org and search for the matching technique
• Record the technique ID and name in the table below

Aim for at least 8–10 techniques:

Step 4 — Compile the IOC List

1. Navigate to the IOC appendix (usually at the end of the report, or a separate CSV/STIX file).

2. Classify each IOC by type and fill in the table below. Aim for at least 10 IOCs. Remember to defang all entries:

Deliverable — Intelligence Summary

Reflection Questions

• What is the difference between low-confidence and high-confidence attribution? What evidence would raise your confidence level?
• Why are TTPs considered more valuable than IOCs for long-term defence? Give a specific example from your report.
• You find an IP from this report in your organisation's web proxy logs. What additional context do you need before escalating to incident response?
• What is the TLP (Traffic Light Protocol) marking on your chosen report, and what does it mean for how you can share the information?

Overview

Real-world threat intelligence is not just about analysing individual indicators — it is about processing them at scale. CTI teams ingest thousands of indicators per day from commercial and free threat feeds. Each needs to be classified, enriched, and prioritised before it is useful to the teams defending the network.

In this exercise, you will pull live IOCs from a free public feed, classify each indicator by type, enrich a sample using VirusTotal, and tag them with a threat category. This simulates the first stage of a real IOC ingestion workflow.

Background Concepts

What is a Threat Intelligence Feed?

A threat intelligence feed is a continuous stream of structured data about malicious indicators, updated regularly — sometimes in real time. Feeds come from commercial vendors, open-source community projects, government agencies, or Information Sharing and Analysis Centres (ISACs). They are the raw material that analysts and automated systems use to block threats and detect intrusions.

Feed Quality and the IOC Lifecycle

Not all IOCs in a feed are equally useful. Common quality problems include:

• False positives — legitimate services incorrectly flagged as malicious
• Stale indicators — C2 servers that were taken down months ago but remain in the feed
• Low-confidence submissions — single community reports without corroboration

Every IOC has a lifecycle: Active (currently used), Stale (infrastructure abandoned), and Revoked (previous report was incorrect). Good analysts assess quality before acting.

The Free Abuse.ch Feeds

Step-by-Step Instructions

Step 1 — Access the ThreatFox Feed

1. Navigate to threatfox.abuse.ch and click Browse IOCs in the navigation menu.

2. You will see a live table of recently submitted IOCs. Before collecting your sample, understand each column:

Step 2 — Collect Your Sample of 10 IOCs

1. From the ThreatFox browse page, select 10 recent IOCs. Aim for variety: at least 2 IP addresses, 2 domains, 2 URLs, and 2 hashes.

2. Record each IOC in the table below. Defang all domains and URLs as you record them:

Step 3 — Classify and Tag Each IOC

For each IOC, assign a threat category using the reference table below. Base your classification on the malware family name and any additional context from ThreatFox.

Step 4 — Enrich 5 IOCs with VirusTotal

1. Select 5 IOCs for enrichment — aim for 2 IPs, 2 domains, and 1 hash.

2. For each, navigate to virustotal.com, paste the indicator in the search box (re-fang it first — remove the brackets), and record:

Step 5 — Rate IOC Quality

1. For each of your 10 IOCs, assign a quality rating using the criteria below:

1. For any IOC rated Low, note the reason: stale, low confidence, or uncorroborated.

2. Based on your quality assessment, list which IOCs you would recommend blocking at the firewall, and explain why.

Deliverable — IOC Summary Report

Reflection Questions

• What risks arise from automatically blocking every IOC in a public feed without quality assessment? Can you think of a scenario where this could cause an outage?
• Why does a high confidence score alone not guarantee an IOC is worth acting on? What else matters?
• How would your process differ if you were enriching 10,000 IOCs per day rather than 10? What steps would you automate first?
• A colleague suggests switching to a paid commercial feed. What questions would you ask to evaluate whether it is worth the cost?

Overview

The MITRE ATT&CK framework is the closest thing the cybersecurity industry has to a universal language for adversary behaviour. It is a comprehensive, community-maintained knowledge base of tactics and techniques used by real threat actors, each documented with evidence from actual incidents.

The ATT&CK Navigator is a free, browser-based tool that lets you create visual heat maps of the ATT&CK matrix — highlighting which techniques a threat actor uses, which your organisation can detect, and where the gaps are. In this exercise you will use the Navigator to profile APT28 and assess a mock SOC's detection coverage.

Background Concepts

Structure of the ATT&CK Matrix

The Enterprise ATT&CK Matrix is organised into columns (Tactics) and rows (Techniques). Each cell is a specific Technique within a Tactic.

ATT&CK Tactic Reference

What is the Navigator?

The ATT&CK Navigator is a web application that renders the ATT&CK matrix as an interactive grid. You create layers — each layer colours the matrix to represent something real: which techniques an actor uses, which your SIEM can detect, which your red team tested. Layers are saved as JSON files that can be shared or imported into other tools.

Common uses:

• Threat actor profiling — which techniques does APT28 use?
• Detection coverage mapping — which techniques can our SIEM detect?
• Red team planning — which techniques will we emulate in our next exercise?
• Gap analysis — overlay the first two layers to find where you have no coverage for techniques an adversary uses

Step-by-Step Instructions

Step 1 — Explore the ATT&CK Website

1. Navigate to attack.mitre.org and click Matrices → Enterprise.

2. Take a moment to read the matrix. Notice tactics run across the top (columns) and techniques fill the columns below. Sub-techniques are indicated with a small > symbol.

3. In the search bar, type APT28 and click on the APT28 group page. Record:

Step 2 — Open the ATT&CK Navigator

1. Navigate to mitre-attack.github.io/attack-navigator/.

2. Click Create New Layer → Enterprise ATT&CK. You will see a blank Enterprise matrix.

3. Familiarise yourself with the toolbar. Key controls:

Step 3 — Create the APT28 Threat Actor Layer

1. In the Navigator toolbar, click the search icon (magnifying glass).

2. Type APT28 in the search box. Select APT28 from the Groups section in the dropdown.

3. The Navigator will automatically highlight all techniques attributed to APT28. You should see a significant number of cells activate.

4. Open Colour Setup and choose a strong blue (e.g. #1A5276). This is your threat actor colour.

5. Open Layer Settings and set: Name = "APT28 Techniques", Description = "Techniques attributed to APT28 per MITRE ATT&CK".

6. Count and record:

Step 4 — Identify Your 5 Highest-Priority Techniques

1. Scroll through the APT28 layer and look for technique clusters — areas where multiple adjacent techniques are highlighted within the same tactic.

2. Select the 5 techniques you consider highest priority for detection. Ask yourself:

• Is this technique used in multiple APT28 campaigns?
• Would detecting it early in the attack chain prevent the attack from succeeding?
• Is this technique uncommon in legitimate software — meaning low false-positive rate?

Step 5 — Create a Detection Coverage Layer

1. In the Navigator, click the + button next to the layer tab to add a new layer. Select Enterprise ATT&CK.

2. This layer represents a mock SOC's current detection coverage. Highlight each of the following techniques in green (#1E7A3C):

1. Name this layer: "Mock SOC Detection Coverage".

Step 6 — Perform the Gap Analysis

1. You now have two layers: APT28 Techniques (blue) and Mock SOC Detection Coverage (green). Visually compare them — which APT28 techniques (blue) are not covered by the green layer?

2. These are your coverage gaps — APT28 techniques the mock SOC cannot currently detect. List at least 5:

Step 7 — Write Detection Recommendations

1. For your 3 highest-priority gaps, write a brief detection recommendation. Navigate to each technique's ATT&CK page and read its Detection section for guidance.

Step 8 — Export Your Layers

1. Click the APT28 layer tab, then the download icon (export). Save the JSON file as apt28_layer.json.

2. Do the same for your coverage layer: detection_coverage.json.

Reflection Questions

• Why is it more important to close detection gaps in Initial Access and Execution compared to later tactics like Exfiltration?
• ATT&CK is updated roughly twice per year. What process would you put in place to ensure your coverage layer stays current with each new release?
• A colleague argues you should focus detection engineering on the most commonly used techniques across all threat actors, not just APT28. What are the merits and drawbacks of this approach?
• How would you use the Navigator to communicate detection gaps to a non-technical executive? What format would be most effective?

Platform Directory

Tool Cards

Which Tool to Use When

APT

Advanced Persistent Threat. A sophisticated, long-term, targeted cyberattack — usually attributed to nation-state or organised criminal actors with specific objectives.

ASN

Autonomous System Number. A unique identifier for a collection of IP address ranges managed by a single network operator (an ISP, company, or hosting provider).

ATT&CK

Adversarial Tactics, Techniques, and Common Knowledge. MITRE's open framework cataloguing adversary behaviour observed in real-world incidents. Used as the universal language for describing TTPs.

C2 / C&C

Command and Control. The infrastructure (servers, domains) that malware communicates with to receive instructions from the attacker and send back stolen data.

CTI

Cyber Threat Intelligence. The practice of gathering, processing, analysing, and disseminating information about threats to inform and improve defensive decisions.

CVE

Common Vulnerabilities and Exposures. A standardised identifier for a specific software vulnerability — e.g. CVE-2021-44228 (Log4Shell). Maintained by MITRE.

Defanging

Modifying an IOC so it cannot be accidentally clicked or executed. Replace http:// with hxxp:// and dots in domains with [.]. Always defang before sharing.

Dynamic Analysis

Analysing malware by actually running it in a controlled sandbox environment and observing its behaviour — processes created, network connections, file changes.

EDR

Endpoint Detection and Response. Security software that monitors endpoints (workstations, servers) in real time for malicious activity and provides investigation and response capabilities.

False Positive

A legitimate, benign system or file that is incorrectly flagged as malicious. High false-positive rates in a feed or rule erode analyst trust and create alert fatigue.

Hash

A fixed-length string produced by applying a hash function (MD5, SHA1, SHA256) to a file's contents. Used as a unique fingerprint for malware identification and tracking.

IOC

Indicator of Compromise. An observable artefact — IP address, domain, file hash, URL, registry key — that indicates a system has been or is being compromised.

ISAC

Information Sharing and Analysis Centre. Sector-specific organisations (e.g. FS-ISAC for finance, H-ISAC for healthcare) that facilitate threat intelligence sharing between member organisations.

Kill Chain

A model describing the sequential stages of a cyberattack, from initial reconnaissance through to the final impact. Used to understand where in an attack defences can interrupt the adversary.

Malware Family

A group of malware variants sharing the same code lineage, behaviour, or origin — e.g. Emotet. Individual samples within a family each have unique hashes but share core functionality.

MISP

Malware Information Sharing Platform. An open-source threat intelligence platform for structured IOC storage, correlation, and sharing between organisations.

OSINT

Open Source Intelligence. Intelligence gathered from publicly available sources — websites, domain registrations, certificate logs, social media — without any special or privileged access.

Pivot

Using one piece of intelligence to discover related indicators or infrastructure. For example, an IP leads to a domain, the domain leads to other IPs, those IPs lead to malware samples.

Sandbox

An isolated, controlled environment used to safely execute suspicious files and observe their behaviour without risking the host system or network.

SIEM

Security Information and Event Management. A platform that aggregates and correlates log data from across the environment to detect threats, generate alerts, and support investigations.

Static Analysis

Examining a file's properties — code, strings, imports, structure — without executing it. Complements dynamic analysis for a complete picture of malware behaviour.

STIX

Structured Threat Information Expression. A standardised JSON-based format for representing CTI data — threat actors, TTPs, IOCs, campaigns — enabling automated exchange between tools.

Tactic

In ATT&CK, the high-level objective of an adversary action — the why. Examples: Initial Access, Persistence, Lateral Movement. There are 14 tactics in the Enterprise matrix.

TAXII

Trusted Automated eXchange of Intelligence Information. A protocol for transmitting STIX data between systems and organisations in a standardised, machine-readable format.

Technique

In ATT&CK, the specific method used to achieve a tactic — the how. Identified by a T-number, e.g. T1566 (Phishing). Sub-techniques add further specificity, e.g. T1566.001.

TLP

Traffic Light Protocol. A standardised sharing classification: TLP:RED (no sharing), TLP:AMBER (limited to specific recipients), TLP:GREEN (community), TLP:CLEAR (public).

TTP

Tactics, Techniques, and Procedures. The full description of how a threat actor operates. TTPs are the most durable intelligence — harder for an attacker to change than IOCs.

VPS

Virtual Private Server. A cloud-based server that threat actors commonly use to host malicious infrastructure because they are cheap, anonymous, and can be spun up or shut down rapidly.

YARA

A pattern-matching tool used to write rules that detect specific malware based on unique byte sequences, strings, or structural characteristics. Used in threat hunting and malware classification.