Threat Report Roulette: Advanced CTI & Pivoting
Ch33r10 and Jorge Orchilles turn standard threat reports into actionable intelligence, demonstrating advanced TTP extraction, adversary emulation, and hunting pivots.
Summary
Moving Beyond Basic Threat Intelligence Ingestion
Standard CTI workflows often stop at extracting static Indicators of Compromise (IOCs) and feeding them into threat intelligence platforms (TIPs) for basic hash matching.
Deconstructing Adversary TTPs from Threat Reports
Ch33r10 and Jorge Orchilles demonstrate how to analyze newly published threat reports to extract underlying Tactics, Techniques, and Procedures (TTPs).
Pivoting and Adversary Emulation Workflows
The speakers walk through creating custom adversary emulation plans in SCYTHE based on threat reports, allowing blue teams to test defenses against reported adversary behaviors.
Taking Detection Engineering to the Next Level
The authors provide incident responders with structured hunting queries and behavioral detection rules derived directly from adversary tradecraft.
Related talks
Blue Team Village·55 min
Meisam Eslahi
Meisam Eslahi presents advanced threat hunting tradecraft to track stealthy adversaries lurking across enterprise infrastructure.
Blue Team Village·31 min
Project Obsidian
Project Obsidian explains how to extract actionable cyber threat intelligence, TTPs, and indicator clusters from real-time incident investigations.
Blue Team Village·41 min
Project Obsidian
Project Obsidian demonstrates using graph visualization tools to map phishing infrastructure, identify sender anomalies, and correlate multi-stage campaigns.