Course: Threat Intelligence & Attribution Best Practices

Identifying and interpreting threat intelligence is crucial to preventing and mitigating cyber attacks. In this course, you'll explore the various threat intelligence types and how they relate to an organization's threat landscape.

You'll begin by examining the key characteristics and benefits of threat intelligence and how to use it before, during, and after an attack. You'll then name known cyber threat actors and common indicators of compromise. You'll characterize intelligence, data, and information, and the four categories of threat intelligence: strategic, tactical, operational, and technical.

You'll outline the threat intelligence lifecycle and how machine learning and risk modeling relate to threat intelligence. Lastly, you'll recognize threat intelligence use cases and sources, and how to map the threat landscape and benefit from intrusion detection and analysis.

Cyber attribution analysis is used to track, identify, and incriminate perpetrators of cyber attacks or exploits and is a must-know offensive security operations technique. In this course, you'll learn about the fundamental concepts and critical concerns related to attribution.

You'll start by examining the different attribution types and levels before exploring attribution indicators, techniques, best practices, tools, and challenges.

Moving on, you'll gain insight into how to identify and interpret forensic artifacts gathered from various sources, manage evidence, and make attribution judgments and assessments. You'll then study geopolitics, the Intelligence Community, and legal considerations as they relate to cyber threats and attribution. Lastly, you'll look into how malware cyber threat reverse engineering, code sharing analysis, and network behavior analysis lead to attribution.