All of the threats: Intelligence, modelling and hunting through an ATT&CKers lens - Tim Wadhwa-Brown

Tim Wadhwa-Brown, Principal Consultant at NCC Group, delivers a comprehensive presentation on operationalizing cyber threat intelligence (CTI), threat modeling, and threat hunting through the lens of the MITRE ATT&CK framework [00:00]. Wadhwa-Brown addresses the practical challenge of translating abstract intelligence feeds and threat actor profiles into actionable defensive detections and red team emulation plans [09:20].

The talk examines how to structure threat models iteratively, analyzing adversary motivation, capability, and opportunity to anticipate specific tactics, techniques, and procedures (TTPs) [09:20]. Wadhwa-Brown demonstrates how NCC Group links STIX/TAXII threat feeds into internal vulnerability knowledge bases, enabling automated mapping between known vulnerabilities and ATT&CK matrix techniques [19:05]. He evaluates the applicability of ATT&CK to cloud environments, walking through AWS-specific attack paths and mapping IAM privilege escalations, metadata service abuses, and serverless exploitation vectors [29:03].

Wadhwa-Brown critically assesses gaps in current threat classification models, highlighting overlooked persistence mechanisms and enterprise UNIX/Linux attack paths that lack standardized ATT&CK coverage [39:55]. He concludes with methodologies for building hypothesis-driven threat hunting queries that search host and network telemetry for subtle adversarial behaviors rather than static IOCs [50:54].

(AI summary — Gemini Flash)