part-4
Intelligence Resources
Threat intelligence is most useful when it adds context to an observation. A reputation result is not a verdict: infrastructure changes ownership, shared services host legitimate and malicious activity, and an indicator can outlive the campaign that created it.
A practical lookup sequence
- Start with internal evidence: first and last seen, affected identities and assets, process ancestry, DNS, proxy, authentication, and file activity.
- Form a question. For example: Was this address associated with scanning at the time of the event?
- Where possible, use sources with distinct collection methods. Several services may repackage the same underlying feed.
- Separate provider facts from your inference. “Flagged by 12 vendors at the time of lookup” is evidence; “therefore compromised” is a conclusion.
- Retain time context. Registration, routing, DNS, certificates, reputation, and hosting can all change.
- Save the query, timestamp, source, relevant result, confidence, and caveat in the case.
Infrastructure and reputation
| Resource | Useful for | Caveat |
|---|---|---|
| VirusTotal | Cross-provider enrichment for domains, IP addresses, URLs, and files | Vendor counts are neither prevalence nor proof; review relationships and observation dates |
| GreyNoise | Context for widespread internet scanning and opportunistic activity | Sensor coverage is incomplete; classifications do not determine the intent of your event |
| AbuseIPDB | Community reports associated with public IP addresses | Report quality and age vary; addresses can change owner |
| Censys Search | Internet-facing services, certificates, and historical exposure | Describes observations in time, not current owner intent |
| Shodan | Exposed services, banners, products, and historical observations | Banners can be stale, misleading, proxied, or shared |
| urlscan.io | Page behaviour, redirects, requests, screenshots, and infrastructure | A scan can disclose a private or token-bearing URL |
| Mnemonic Passive DNS | Historical DNS relationships | Absence reflects collection coverage, not proof that a relationship never existed |
| RIPEstat | ASN, routing, prefix, and registration context | Network registration does not identify a workload operator |
| ICANN Lookup | RDAP-backed domain registration data | Privacy services and redaction limit attribution |
| crt.sh | Certificate Transparency searches and certificate pivots | Certificate presence does not prove a host is active or controlled by the named subject |
Malware, URLs, and indicators
| Resource | Useful for | Caveat |
|---|---|---|
| MalwareBazaar | Malware samples, hashes, tags, and family context | Community and vendor labels require validation |
| URLhaus | URLs observed distributing malware | Coverage reflects submissions and collection, not all malicious URLs |
| ThreatFox | Community indicators associated with malware | Review confidence, age, and the relationship claimed |
| VirusTotal | Hash lookup, relationships, and behaviour summaries | Do not upload sensitive samples to public analysis |
| ANY.RUN | Interactive behavioural analysis | Public tasks may expose samples and artefacts |
| Joe Sandbox | Static and dynamic analysis across several platforms | Results depend on configuration, execution path, and sandbox visibility |
Vulnerability exploitation context
| Resource | Useful for | Caveat |
|---|---|---|
| CISA Known Exploited Vulnerabilities | Vulnerabilities with evidence of exploitation in the wild | Inclusion supports prioritisation; absence does not mean no exploitation |
| FIRST EPSS | Daily probability that a published CVE will be exploited in the wild in the next 30 days | A model score is not evidence that your asset was targeted or compromised |
| NVD | CVE, CPE, CVSS, references, and enrichment | CVSS measures severity, not local exposure or exploitation likelihood |
Research, sharing, and intelligence management
| Resource | Useful for |
|---|---|
| MITRE ATT&CK | Shared vocabulary for behaviours, software, groups, mitigations, and data sources |
| CISA Cybersecurity Advisories | Authoritative advisories and defensive guidance |
| Microsoft Threat Intelligence | Campaign reporting with Microsoft telemetry context |
| Google Threat Intelligence Group | Campaign, malware, vulnerability, and actor research |
| Palo Alto Networks Unit 42 | Incident and campaign research |
| The Shadowserver Foundation | Exposure and infection reporting for network owners |
| MISP | Structured sharing and correlation within a controlled community |
| OpenCTI | Modelling and managing intelligence in a knowledge graph |
Useful pivot types
| Pivot | What it may connect | Common trap |
|---|---|---|
| Passive DNS | Domain, address, and time | Treating absence as proof |
| Certificate Transparency | Names, certificates, and issuance | Assuming issuance proves deployment or control |
| RDAP and routing | Registrant, ASN, prefix, and dates | Attributing a hosted workload to the network owner |
| File relationships | Hash, signer, filename, archive, and behaviour | Trusting family labels without validating the sample |
| URL relationships | Redirects, path, referrer, and retrieved resources | Triggering retrieval or disclosing tokens during lookup |
| Campaign reporting | Behaviour, infrastructure, malware, and time | Forcing weak similarities into actor attribution |
What to record in a case
| Field | Example |
|---|---|
| Indicator | 203.0.113.24 |
| Lookup time | 2026-07-23 08:42 UTC |
| Internal context | First seen contacting one workstation after a document opened |
| External context | Two differently sourced datasets associated the address with scanning that week |
| Confidence | Moderate |
| Caveat | Shared hosting; no payload or operator attribution |
| Next pivot | DNS history, certificate reuse, process and file activity |
Revision
| Revised Date | Comment |
|---|---|
| 2024-10-27 | Added page |
| 2026-07-23 | Reworked as a disclosure-aware, investigation-focused resource guide |