This course will teach you how to produce threat intelligence. Identifying and tracking attack campaigns, as well as infiltrating and monitoring adversary infrastructure, are all part of this.

"You can't protect against what you can't see and understand."

Cyber threat intelligence (CTI) is the practice of understanding and combating cyber threats. It can involve gathering information about current and potential attacks, analyzing that information to identify patterns and trends, and sharing that information with other organizations in order to improve their security posture.

CTI is critical to the successful planning and implementation of national defense operations. The massive influx of data and the ever-changing nature of cyber threats requires timely and accurate intelligence to protect our nation's networks and critical infrastructure.

The goal of CTI is to identify the perpetrator of a cyberattack and to prevent them from attacking again. In order to achieve this goal, CTI relies on the use of sophisticated tools and techniques. These tools and techniques allow CTI experts to infiltrate the infrastructure of cyber attackers and to monitor their activities. This information can then be used to identify the victims of a cyberattack and to help protect them from future attacks.

MCSI's MTIA cyber intelligence course is designed to teach the most advanced methods of safeguarding nations against cybercrime and nation-state adversaries. The course was designed by seasoned professionals with deep experience in the field of cyber intelligence.

The MCSI Threat Intelligence certification will equip you with the skillset necessary to carry out the following tasks:

• Understand an organization's exposure to cyber attacks and which threat actors may target it
• Baseline enterprise assets and extract tactical and technical intelligence at scale
• Identify malware infrastructure and track attack campaigns
• Discover new threat actors and malware samples that could target organizations you defend
• Safely probe, infiltrate and monitor adversary campaigns
• Use Structured Analytics Techniques to attribute cyber attacks
• Produce threat intelligence products such as reports, briefings and IOCs

Cyber threat intelligence analysts are some of the most in-demand professionals in the world of cybersecurity. They are essential for identifying, understanding, and mitigating cyber threats. Because of the high level of expertise and experience required for this role, cyber threat intelligence analysts can expect to earn a competitive salary.

MCSI is one of the most respected and trusted names in cyber security education and training. Our certifications teach critical skills, knowledge and abilities needed to advance a career in cyber security. Our courses are comprehensive and up-to-date, and our instructors are experienced professionals who are dedicated to helping students learn. MCSI provides the real-world skills and knowledge you need to protect any organization from cyber threats.

• How to produce your own threat intelligence to support defensive cyber operations

  This course teaches you technical skills to produce your own threat intelligence. There are a few benefits to producing your own threat intelligence:

  • You can tailor the intelligence to your specific environment and needs.
  • You can develop a better understanding of how various threats work, and how to defend against them.
  • You can build relationships with other organizations who are also producing their own intelligence, so that you can share information and collaborate on defense.
  • You can develop "custom signatures" for your security devices which will help you more accurately identify targeted cyber attacks against the organizations you defend.

  Binary classification

  Binary classification is a technique used in malware analysis to determine whether a given sample is likely to be malware or not. It works by comparing the features of a sample against a database of known malware samples, and classifying the sample as either malware or not malware based on how similar it is to the known malware samples. Binary classification can be used to quickly and accurately determine whether a new sample is likely to be malware, which can help analysts to focus their efforts on more serious threats.

  Writing YARA rules

  One of the most important aspects of conducting cyber threat intelligence is being able to identify and track malicious files and activity. This is where YARA rules come in.

  YARA is a tool that allows you to create rules for identifying malware. These rules can be used to scan files and folders for evidence of malicious activity. YARA can also be used to create signatures for malware that can be used in detection and prevention systems.

  By writing YARA rules, you can improve your ability to detect and track malicious software.

  Data Science with Python Pandas

  Threat intelligence systems use data science techniques to analyze information from a variety of sources in order to identify malicious actors and prevent attacks. Python Pandas is a powerful data analysis toolkit that can be used for data science in threat intelligence. Pandas can be used to read and write data in a variety of formats, including csv, json, and excel. Pandas also provides a wide range of methods that you can use to get the information you need from your data.

  Memory forensics

  Memory forensics is the process of extracting forensic information from memory images. This information can then be used to create threat intelligence. This can include identifying malware infections, tracking users' activities, and identifying compromised systems.

  Malware Analysis

  Malware analysis is the process of examining software code or executables to identify malicious intent or actions. By understanding how malware works, security professionals can create threat intelligence that can help protect their networks and systems from attack. Threat intelligence can include information on specific threats, such as the malware families and variants involved, their methods of operation, and the potential impact on an organization. It can also include broader information on attackers, such as their tactics, techniques, and procedures (TTPs).

• How to perform situational awareness assessments to identify an organization's current threat landscape

  Situational awareness is a key component of cyber threat intelligence. It allows organizations to understand their current environment and identify potential threats. By understanding the threats that are targeting their organization, they can better defend against them.

  Mapping Internet-facing assets

  Mapping your internet-facing assets is a critical step in building your cyber threat intelligence program. By understanding the assets that are exposed to the internet, you can more effectively identify and respond to cyber threats. Mapping your assets can help you answer important questions, such as:

  • Which assets are most at risk?
  • What are the most common attack vectors?
  • What are the most vulnerable parts of the network?
  • What is the potential impact of a cyber attack?

  Detecting phishing and spear-phishing campaigns

  Phishing and spear-phishing are two of the most common attacks used by cybercriminals. A phishing attack is an email or message that is sent to a user with the intention of getting them to click on a malicious link or open an infected file. A spear-phishing attack is a more targeted version of a phishing attack, where the email is sent to a specific individual or group of individuals.

  Detecting phishing and spear-phishing campaigns is important because it allows organizations to identify and protect their high-value employees and customers targeted by advanced threats.

  Detecting typo squatting

  Domain squatting is the act of registering a domain name with the intent of selling it to a legitimate party or using it for another malicious purpose. Typosquatting is a type of domain squatting that involves registering a domain name that is similar to a popular website in the hopes of confusing or luring visitors to the illegitimate site.

  Detection of typo squatting is an important part of CTI because it can help organizations identify malicious domains and IP addresses.

  Detecting information leaks

  Information leaks are a huge problem when it comes to cyber threat intelligence. If critical data is leaked, it can give hackers the information they need to launch an attack. This is why it is so important to detect any leaks as early as possible so that they can be fixed before they cause any damage.

  Leaks can happen in a number of ways, including through email, chat programs, and social media.

  Monitoring developers and system administrators

  Monitoring developers and system administrators is important in cyber threat intelligence because they are often the ones who are targeted by attackers. They can be targeted through phishing emails or malicious websites that exploit vulnerabilities in their systems. By monitoring their activity, we can detect these attacks and protect our networks from them.

• How to perform enterprise investigations to identify threat actors that have breached the network

  When it comes to protecting your business from online threats, performing regular enterprise investigations is essential. By identifying and tracking down threat actors, you can reduce your risk of data breaches and other malware attacks. Additionally, investigating threats can help you better understand how cyber criminals are targeting your industry and what steps you need to take to stay ahead of them.

  Capturing and indexing forensics artefacts

  Forensics artefacts can play a critical role in cyber threat intelligence, providing insight into the tactics, techniques and procedures (TTPs) of attackers. By capturing and indexing these artefacts, organisations can improve their ability to detect and respond to threats.

  Forensics artefacts can include malicious files, email messages, network traffic and registry keys. By capturing and indexing these artefacts, organisations can build a database of TTPs that can be used to identify attacks and improve their defences.

  Baselining the enterprise network

  Baselining the enterprise network is a critical step in cyber threat intelligence. By creating a baseline of normal network activity, you can more easily identify any abnormalities that may be caused by a cyber attack. This can help you to quickly respond to any potential threats and protect your organization's data.

  Performing memory forensics at scale

  Memory forensics is much faster than traditional forensic methods. This is because the process of extracting data from a live system's memory is much faster than extracting data from a hard drive or other storage device.

  Memory forensics can provide a more complete view of the system than traditional forensic methods.

  By identifying and analyzing patterns in memory, analysts can quickly detect malicious activity and preventative action can be taken to stop potential attacks. Additionally, by scanning a large number of systems for threats, analysts can build a more complete picture of the types of threats faced by an organization and develop better defenses.

  Using Python Pandas to analyse large datasets

  Python Pandas is a popular library used for data analysis and scientific computing. It provides data structures and operations for working with labelled or relational data. Pandas can be used to analyse large datasets for cyber threat intelligence. The library can be used to filter and clean up data, explore and visualize data, and model and predict outcomes. Pandas is well suited for working with big data sets at incredible speed.

• Use pivot analysis to identify, map and track adversary attack campaigns and infrastructure

  Pivot analysis is a technique used in threat intelligence to identify connections between seemingly unrelated data sets. This can be used to identify malicious actors or malware families that may not be identifiable through other methods. Pivot analysis can also be used to identify new threats that may not have been previously identified.

  Identifying adversary infrastructure

  When it comes to cyber threat intelligence, one of the most important aspects is being able to identify adversary infrastructure. If you can't track and monitor the activities of your adversaries, you won't be able to defend against their attacks. By identifying adversary infrastructure, you can develop a better understanding of their tactics, techniques, and procedures (TTPs). This allows you to create more effective countermeasures and protect your organization from these threats.

  Identifying malware source code

  Malware source code is one of the most important aspects of cyber threat intelligence. By identifying the source code of malware, analysts can better understand how the malware works, who created it, and where it is being used. This information can help organizations defend against and respond to attacks. Identifying the source code of malware is not always easy, but it is essential for understanding the full extent of a cyber threat.

  Tracking attack campaigns

  The importance of tracking attack campaigns in cyber threat intelligence cannot be overemphasized. By tracking attack campaigns, organizations can gain a better understanding of the tactics, techniques, and procedures (TTPs) being used by cyber adversaries. This information can then be used to improve security posture and protect against future attacks.

  Hunting for malware developers

  There are a few important reasons why it is important to identify malware developers in cyber threat intelligence. One reason is that it helps to understand the motivation behind the malware. For example, if a particular piece of malware is being used for cyberespionage, it would be helpful to know who developed the malware so that you can narrow down your search for the culprits.

  Another reason is that it can help you to develop countermeasures against the malware. If you know who created the malware, you can study their methods and develop defenses against them in the future.

• How to use open-source intelligence techniques to augment your threat intelligence production

  Open-source intelligence (OSINT) is data that is available to the public and can be used to supplement your organization's threat intelligence. This data can come from a variety of sources, including social media, public websites, and government data sets.

  Using OSINT techniques can help you to better understand your threat landscape and identify potential threats that may not be included in your organization's threat intelligence. Additionally, using open-source data can help you to identify malicious actors and their techniques.

  Identifying newly deployed malware infrastructure

  When investigating a security incident, it is important to identify any newly deployed malware infrastructure. This is the infrastructure that the attackers use to launch their attacks. Tracking adversary infrastructure can help to determine the scope of the attack and which systems may have been impacted.

  Passively monitoring adversary groups

  One of the most important aspects of threat intelligence is being able to monitor adversary groups. This allows organizations to track the activities of these groups, understand their tactics and techniques, and potentially detect them before they are able to launch an attack.

  Passively monitoring adversary groups can help organizations improve their defenses by giving them early warning of potential attacks. It can also help them to understand the capabilities of these groups, which can help them to better defend against attacks.

  Extracting IOCs from publicly available sources

  One of the most important aspects of intelligence-gathering is the ability to automate tasks whenever possible. Automating the extraction of Indicators of Compromise (IOCs) from publicly-available sources is one such task. Automating this process allows security teams to more quickly and easily collect data on potential threats. Additionally, automation allows for the regular updating of IOCs as new threats are identified.

• How to plan and execute offensive countermeasures operations, including hacking back

  There is no one-size-fits-all answer when it comes to offensive countermeasures operations, such as hacking back. Depending on the specific situation and threat, a variety of tactics and techniques may be necessary to successfully achieve the desired outcome. However, some basics that are generally applicable include reconnaissance and mapping of the target environment, identification of potential entry points and vulnerabilities, as well as deployment of appropriate tools and techniques to exploit those vulnerabilities.

  Once the attack is launched, it is important to maintain consistent monitoring and analysis of the target environment to ensure that the threat is neutralized and that no further damage is done. In some cases, it may also be necessary to take further defensive measures to protect the organization's systems and data.

  The bottom line is that effective offensive countermeasures require a high level of sophistication and expertise, and should be undertaken only after a careful risk analysis has been conducted.

  Safely probing adversary infrastructure

  One of the main goals of any cyber offensive countermeasure (COCM) is to safely probe adversary infrastructure in order to understand their activity, identify any valuable assets, and understand their attack surface. It is also important to identify any potential vulnerabilities that could be exploited in order to achieve this goal. This course teaches techniques to perform scans in way that cannot be attributed back to a OCM team.

  Identifying vulnerabilities in control panels

  Cyber threat actors write malware with the goal of establishing a foothold in the target environment. Once they have achieved this, they need to be able to control the malware in order to achieve their goals. This is where malware control panels come into play. These panels provide a web-based interface that allows the attacker to control the malware, issue commands, and gather information.

  However, these panels can also be hacked by offensive countermeasures teams. This allows the team to take over the malware, stop it from doing damage, and even use it to track down the attacker.

  Building and using a secure operating environment

  Building and using a secure operating environment is crucial in developing reliable cyber offensive countermeasures. Without a stable and secure system, any actions taken against potential cyber threats could be easily compromised, rendering the entire effort useless.

  Building and deploying honeypots

  A honeypot is a computer system that is configured to act as a decoy to lure cyber attackers. Once the attacker is attracted to the honeypot, their activities can be monitored and analyzed. This information can then be used to improve the security of the organization's real systems.

  Building and deploying honeypots is an important part of cyber offensive countermeasures. By setting up honeypots, we can learn about the tactics and techniques used by attackers, as well as the tools and malware they use.

• How to attribute cyber attacks and malware to criminal groups or nation-state actors

  Attack attribution is the process of identifying the source of a cyber attack. This is important for several reasons. First, it allows organizations to identify and protect against potential attacks from the same source. Second, it helps law enforcement agencies identify and apprehend the perpetrators of cyber attacks. Finally, it allows victims of cyber attacks to seek justice and compensation.

  Attribution is not always easy, and there are several factors that can complicate the process.

  Using the Cyber Attribution Model

  The CAM has two closely interacting parts: Cyber Attack Investigation and Cyber Threat Actor Profiling.

  The Cyber Attack Investigation part is focused on professional and organized cyber attacks, such as espionage or APT campaigns. The goal is to help national cyber security centres identify and investigate these attacks.

  The Cyber Threat Actor Profiling is focused on identifying the actors behind these attacks. By understanding who is behind the attacks, security professionals can better protect their networks and systems from future attacks.

  Click here for more information

  Identifying code reuse

  Code reuse is a valuable technique for cyber attribution because it can help analysts identify the perpetrators of a cyberattack. By identifying code that has been reused in multiple attacks, analysts can build a profile of the attacker and determine their motives and methods. This information can then be used to track the attacker and prevent future attacks.

  Writing high-fidelity YARA rules

  One key part of attribution is being able to write high-quality YARA rules. YARA is a tool that allows analysts to identify and group malware samples based on certain characteristics. By creating YARA rules that are specific to your organization's malware, you can improve your chances of correctly attributing a cyber-attack.

• How to write reports, disseminate intelligence and integration 3rd party feeds into your infrastructure

  Professionally documenting IOCs

  One key skill in producing cyber threat intelligence is by having a good understanding of what IOCs (indicators of compromise) are, and being able to document them in a way that is both professional and easy to understand.

  Developing a taxonomy

  One of the most important aspects of developing and using a taxonomy when documenting IOCs for cyber threat intelligence is that it can help to ensure that all collected IOCs are accurately and efficiently categorized. This can help to improve the overall quality and effectiveness of the threat intelligence. Additionally, a taxonomy can also help to improve the speed and accuracy of malware analysis.

  Preparing and drafting briefings

  When it comes to cyber threat intelligence, briefings are one of the most important things a CTI team can produce. They provide a high-level overview of the threats an organization is facing, as well as the corresponding mitigations and recommended actions. However, briefings aren't just for internal use—they can also be shared with clients and partners to keep them up-to-date on the latest threats and how they may impact their business.

  Employing Structured Analytics Techniques

  Structured analytics techniques (SATs) and critical thinking are important tools in cyber threat intelligence.SATs help analysts overcome these sources of error by forcing them to consider all possible explanations for evidence, and to systematically test their hypotheses. By doing so, analysts are able to reduce the effects of bias, and arrive at more accurate conclusions. Critical thinking is the process of thinking logically and rationally to identify the strengths and weaknesses of an argument or proposition.

  When used together, structured analytics and critical thinking can help analysts to better understand the data they are working with and to develop better insights into potential cyber threats.

Student Testimonial