Skip to main content

Threat Intelligence & Ethics

info

The content of this Malware Analysis pages is my understanding and notes based on the course Introduction to Malware Analysis by Prof. Ahmed Lekssays.

Threat Intelligence​

Threat Intelligence is evidence-based knowledge about existing or emerging threats. It is categorized into three levels:

  1. Strategic: High-level trends for decision-makers (e.g., "Ransomware attacks on healthcare are increasing").
  2. Tactical: TTPs (Tactics, Techniques, and Procedures). How do they attack?
  3. Operational: IOCs (Indicators of Compromise). Specific IP addresses, file hashes, and domains.

STIX 2.1​

Structured Threat Information Expression (STIX) is a standardized JSON format for sharing threat intel.

  • SDOs (Domain Objects): High-level concepts like Malware, Threat Actor, Attack Pattern.
  • SCOs (Cyber-observable Objects): Technical data like IPv4 Address, File Hash.

MITRE ATT&CK Framework​

A knowledge base of adversary behaviors. It breaks attacks down into:

  • Tactics (Why): The goal (e.g., Initial Access, Persistence).
  • Techniques (How): The method (e.g., Registry Run Keys, Phishing).
  • Procedures: Specific implementation details.

Example Mapping:​

  • Behavior: Malware adds a key to HKLM\...\Run.
  • ATT&CK Technique: T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys).
  • Tactic: Persistence.

Malware analysis operates in a sensitive legal space.

  • Computer Misuse Laws: strict laws govern unauthorized access and system modification.
  • Data Protection: Handling personal data found in malware logs or dropped files requires compliance with laws like GDPR.

Ethical Guidelines​

  • Responsible Disclosure: If a vulnerability is found, notify the affected vendor timely and coordinate the release of information.
  • Public Safety: Prioritize the safety of the public over the prestige of publishing a finding.
  • Research Ethics: Avoid harm and protect the privacy of victims during investigations.