Incident Prediction · Topic 4 of 4
Threat Intelligence, IoCs, IoAs and Threat Hunting
Learn cyber threat intelligence types, IoCs versus IoAs, how to consume intelligence for proactive defense, and how threat hunting works for CND 312-38.
- 6 min
- The four types are strategic, tactical, operational and technical.
- IoCs are artifacts after compromise, IoAs are behaviors during an attack.
- Technical indicators expire fast, so set an expiry and remove stale ones.
What it is
Cyber threat intelligence (CTI) is evidence based knowledge about adversaries, their methods and their targets, analyzed so that it helps people make decisions. It is different from raw data. A list of bad addresses is data. A report that says who uses them, why and what to do is intelligence.
In network defense, CTI predicts what is coming so controls can be tuned before an attack. Threat hunting goes one step further and searches for attackers already inside.
How it works
Role of CTI in network defense
CTI helps a defender to:
- Know which adversaries and techniques target the organization's sector
- Prioritize patching and controls on what is actually being exploited
- Improve detection rules, blocklists and playbooks
- Speed up incident response by giving context to an alert
- Inform leaders about risk and spending
Types and layers of threat intelligence
Each type serves a different audience, and together they form layers from the boardroom down to the tools.
| Type | Audience | Content | Example |
|---|---|---|---|
| Strategic | Executives and board | High level trends, motives, risk to the business | A report on ransomware groups targeting healthcare |
| Tactical | Security architects and SOC leads | Tactics, techniques and procedures (TTPs) of attackers | How a group gets in and moves |
| Operational | Incident responders and hunters | Details of specific campaigns, timing and intent | A campaign planned against the sector |
| Technical | Analysts and security tools | Machine readable indicators | Hashes, IP addresses, domains, URLs |
Strategic intelligence lasts longest. Technical intelligence goes stale fastest, since attackers change addresses and files quickly.
The intelligence lifecycle turns data into intelligence: direction (set requirements), collection, processing, analysis, dissemination and feedback. Sources include open sources (OSINT), commercial feeds, sharing communities, internal logs and incident data. Sharing formats and tools include STIX and TAXII for exchange, MISP as a sharing platform, and the Traffic Light Protocol (TLP) to label how widely a report may be shared.
Indicators of Compromise (IoC) and Indicators of Attack (IoA)
| Aspect | IoC | IoA |
|---|---|---|
| Question answered | Has a compromise already happened? | Is an attack in progress? |
| Focus | Artifacts left behind | Behavior and intent |
| Examples | Malware file hash, malicious IP or domain, registry key, unusual outbound traffic | Credential dumping, lateral movement, privilege escalation, script run from an office document |
| Timing | Reactive, after the event | Proactive, during the attack |
| Weakness | Attackers change them easily | Needs behavior analytics and tuning |
IoCs are good for quick matching and blocking known threats. IoAs can catch new variants because the behavior often stays the same.
The Pyramid of Pain shows how much it hurts an attacker when you deny them each indicator. From easy to hard: file hashes, IP addresses, domain names, network and host artifacts, tools, and tactics, techniques and procedures (TTPs). Defending against TTPs causes the most pain.
Leveraging and consuming threat intelligence for proactive defense
- Define requirements: what you protect and which threats matter.
- Choose trusted sources and check them for accuracy and relevance.
- Feed the tools: load technical indicators into the SIEM, firewall, proxy, email gateway and EDR as blocks and detections.
- Enrich alerts: add context so analysts decide faster.
- Brief decision makers with strategic reports.
- Set an expiry on indicators, and remove stale ones to avoid false positives.
- Measure and give feedback to improve the sources.
A threat intelligence platform (TIP) collects and de-duplicates feeds and pushes them to tools. Intelligence must be relevant, timely and actionable, otherwise it adds noise. Map adversary behavior to a framework such as MITRE ATT&CK or the Cyber Kill Chain to see which controls cover which stage.
Threat hunting
Threat hunting is the proactive, human led search through networks and endpoints for threats that automatic tools missed. It assumes an intruder may already be inside.
| Approach | Starting point |
|---|---|
| Hypothesis driven | A theory such as "an attacker is using a remote service for lateral movement" |
| Intelligence driven | New IoCs or a report about a campaign |
| Analytics driven | Anomalies found by behavior analysis or machine learning |
The hunt cycle: form a hypothesis, collect and search data (logs, EDR, network records), investigate and confirm, respond or hand over to incident response, and then turn what was learned into a new automated detection.
Common techniques are baselining and looking for outliers, searching for the rarest processes or connections (stack counting), checking persistence locations, and following unusual authentication. Hunters need good data, such as endpoint telemetry, DNS and authentication logs, and a solid baseline.
A hunt that finds nothing still has value: it confirms coverage and may reveal gaps in logging.
A worked example
A feed reports a campaign against regional banks that uses a particular remote tool and creates scheduled tasks for persistence. A hunter forms the hypothesis that the bank may already be affected, queries endpoint data for that tool and for new scheduled tasks created at odd hours, and finds one server with both.
The server is isolated and handed to incident response. The hunter then writes a detection rule for the behavior and adds the technical indicators to the blocklists.
How the exam asks about this
- "Which type of threat intelligence is aimed at executives and covers high level trends?" → Strategic.
- "Which indicator focuses on attacker behavior and intent during an attack?" → An indicator of attack (IoA).
- "Which security activity proactively searches for threats that evaded detection?" → Threat hunting.
What to remember for the exam
- The four types are strategic, tactical, operational and technical.
- IoCs are artifacts after compromise, IoAs are behaviors during an attack.
- Technical indicators expire fast, so set an expiry and remove stale ones.
- STIX and TAXII exchange intelligence, and MITRE ATT&CK describes adversary behavior.
- Hunting is proactive and hypothesis driven, and results feed new detections.
Blindly loading every feed into your blocklists creates false positives and can block legitimate business traffic. Vet and score first.
Common mistakes
Treating raw feeds as intelligence. Without analysis and context, a list of addresses is only data.
Relying on IoCs alone. Attackers rotate them, so behavior based detection is also needed.
Hunting without data. If key logs are missing, a hunter has nothing to search.
Check yourself
What is the difference between an IoC and an IoA?
An IoC is an artifact showing a compromise already happened, while an IoA is behavior showing an attack is in progress.
Which type of threat intelligence goes stale fastest?
Technical intelligence, such as addresses and hashes.
What is the aim of a threat hunt?
To find threats that automated tools missed and to improve future detections.
Topic 4 of 4 in Incident Prediction
Test yourself on Incident Prediction
The full EC-Council 312-38 question bank has 800 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.