A practitioner's guide to the intelligence lifecycle, the frameworks analysts rely on, and the tactics, techniques and procedures used by everyone from financially motivated crime syndicates to state-sponsored APTs.
Threat intelligence is not a data feed; it is a process that turns raw information into decisions. The classic lifecycle, borrowed from national intelligence practice, is a continuous loop. Each pass is anchored to a stakeholder's question and ends with feedback that sharpens the next question.
| Phase | SOC reality | Common failure |
|---|---|---|
| Direction | Priority Intelligence Requirements (PIRs) agreed with CISO, IR, risk, fraud | "Collect everything" with no questions |
| Collection | Telemetry, IR cases, ISACs, vendor reporting, OSINT, dark-web sources | Over-reliance on free IOC feeds |
| Processing | Normalise to STIX 2.1, de-duplicate, enrich, score confidence in a TIP | Unscored indicators pushed straight to blocklists |
| Analysis | Map to ATT&CK, cluster with Diamond Model, assess relevance and likelihood | Reporting "what" without "so what" |
| Dissemination | Detections for SOC, briefs for executives, hunts for threat hunters; TLP marked | One report format for every audience |
| Feedback | Detection hit-rates, hunt outcomes, stakeholder surveys | No measurement, so no improvement |
The same adversary activity produces different products for different consumers. Shelf-life increases as you move up the stack, and so does business impact.
Who targets our sector, why, and how this changes risk appetite, investment and M&A or geographic expansion decisions.
Details of specific campaigns: timing, targeting, infrastructure, likely next steps. Drives readiness and surge planning.
Adversary behaviours mapped to ATT&CK, converted into detection logic, hunt hypotheses and control tests.
Machine-readable indicators for blocking and enrichment. Useful, cheap, and quickly obsolete.
David Bianco's Pyramid of Pain captures the core argument: the higher up the pyramid you detect and deny, the more it costs the adversary to adapt. Hash values change with one byte; TTPs are rooted in tooling, skills and tradecraft that take months to rebuild.
Bottom · Trivial Re-compile a binary, rent a new VPS: the IOC is dead in minutes.
Middle · Annoying Artefacts like named pipes, user-agents or registry keys force retooling.
Top · Tough Detecting behaviour such as LSASS access or Kerberoasting forces the adversary to learn new tradecraft.
Tie security spend to the adversaries and techniques most likely to hit you, rather than to vendor hype cycles.
Feed threat likelihood into FAIR-style models, so risk registers reflect real adversary capability and intent.
Assess the threat landscape before entering a new market, acquiring a company or onboarding a critical supplier.
Monitor suppliers' exposure and breach history; anticipate attacks on MSPs and software vendors.
Support DORA threat-led penetration testing (TLPT), TIBER-EU / CBEST scenarios and NIS2 risk management.
Geopolitical events (elections, conflicts, sanctions) predict hacktivist and state activity spikes weeks ahead.
| Dimension | IOC-feed model | Intelligence-led model |
|---|---|---|
| Unit of work | Indicator | Adversary behaviour & intent |
| Shelf-life | Hours to days | Months to years |
| False positives | High (shared hosting, CDNs) | Lower, context-rich |
| Defends against | Yesterday's campaign | Next campaign by the same actor |
| Metric | Indicators ingested | Technique coverage, MTTD, decisions influenced |
Intelligence-led defence means letting knowledge of real adversaries determine what you detect, hunt, test and fix. The engine is a loop between CTI, detection engineering, threat hunting, red/purple teaming and incident response.
e.g. "Which ransomware affiliates are targeting UK financial services, and how do they gain initial access?" Keep 5–15, review quarterly.
Profile the 5–10 actors most relevant by sector, geography and tech stack. List their techniques in ATT&CK.
Overlay prioritised techniques against current detections in ATT&CK Navigator. Gaps become your backlog.
Write behaviour-based rules (Sigma, KQL, SPL) as code, version controlled and unit-tested with emulation data.
"If APT29 were here, we would see anomalous OAuth app consent." Hunt, document, convert findings into detections.
Emulate adversaries with Atomic Red Team, CALDERA or commercial BAS tools. Measure detection and response.
Track technique coverage %, mean time to detect, PIRs answered and decisions influenced. Report in business terms.
A TIP (MISP, OpenCTI or commercial), STIX/TAXII sharing, ISAC membership, TLP 2.0 discipline and analyst training in structured analytic techniques.
Use estimative language consistently (e.g. "likely" = 55–80%), separate source reliability from information credibility (Admiralty Code A1–F6), and apply structured techniques such as Analysis of Competing Hypotheses to manage bias, especially in attribution.
Published in 2011, the Kill Chain models an intrusion as seven sequential phases. Its key defensive insight: an adversary must succeed at every phase, while a defender needs to break the chain only once, and the earlier the better.
Select a phase or play the animation.
| Phase | Detect | Deny | Disrupt | Degrade / Deceive |
|---|---|---|---|---|
| Recon | Web analytics, honeytokens | Reduce exposed info | — | Fake employee personas |
| Delivery | Email gateway, proxy | Attachment blocking | Sandboxing | Email quarantine |
| Exploitation | EDR, HIDS | Patching | Exploit protection | — |
| Installation | EDR, Sysmon | App allow-listing | Least privilege | — |
| C2 | NDR, DNS analytics | Egress filtering | DNS sinkhole | Tarpit |
| Actions | DLP, UEBA | Segmentation | Isolation | Honeypots, canary data |
ATT&CK is a globally accessible knowledge base of adversary behaviour built from real-world observations. The Enterprise matrix organises behaviour into 14 tactics (the adversary's "why"), each containing techniques and sub-techniques (the "how"), linked to procedure examples, groups, software, mitigations and data sources.
Score detections per technique; prioritise gaps for the actors in your threat model.
"T1003.001" means the same to a vendor, an ISAC and your SOC: LSASS memory credential dumping.
MITRE CTID adversary emulation plans and ATT&CK Evaluations turn reporting into repeatable tests.
Link techniques to controls such as M1032 MFA or M1026 Privileged Account Management.
Show which telemetry you need (process creation, logon sessions) before you can detect a technique.
D3FEND for countermeasures; ATT&CK for ICS and Mobile; ATLAS for attacks on AI systems.
Caltagirone, Pendergast and Betz (2013) proposed that every intrusion event consists of four core features connected as a diamond: an adversary uses a capability over infrastructure against a victim. Its power lies in pivoting: knowing one vertex helps you discover the others.
Adversary Operator and customer, e.g. a ransomware affiliate and the RaaS operator.
Capability Malware, exploits, tradecraft: Cobalt Strike, a ToolShell exploit, help-desk vishing.
Infrastructure Domains, IPs, VPS, compromised routers, cloud tenants, email accounts.
Victim Organisation, people, assets, email addresses.
Meta-features Timestamp, phase, result, direction, methodology, resources.
A phishing email hits the finance team (victim). The attachment drops a loader (capability) that beacons to a domain (infrastructure). Passive DNS and certificate pivots reveal 40 sibling domains with the same registrar pattern, previously reported against other banks, associated with a known cluster (adversary). Linked events form activity threads; similar threads form activity groups, the basis of actor tracking.
These models are complementary lenses, not competitors. A mature CTI function uses all three, and increasingly the Unified Kill Chain, which merges Kill Chain and ATT&CK into 18 phases.
| Cyber Kill Chain | MITRE ATT&CK | Diamond Model | |
|---|---|---|---|
| Question answered | Where in the intrusion are we? | Exactly how did they do it? | Who, against whom, using what? |
| Granularity | 7 coarse phases | 14 tactics, 200+ techniques, 400+ sub-techniques | Single events → activity groups |
| Best for | Executive narrative, control placement | Detection engineering, coverage, emulation | Clustering, attribution, pivoting |
| Weakness | Linear, malware-centric | Can become a box-ticking exercise | Needs disciplined data capture |
Adversaries differ in motivation, resources and patience, but their tradecraft increasingly converges: criminals buy nation-state-grade tooling, and states use criminal infrastructure and ransomware as cover.
Valid accounts (T1078), MFA fatigue (T1621) and token theft dominate initial access across crime and state actors.
PowerShell, WMI, RMM tools and native binaries reduce the value of hash-based IOCs to near zero.
VPNs, firewalls and file-transfer appliances (T1190) are favoured by both ransomware crews and APTs.
Initial access brokers, RaaS developers, affiliates and negotiators operate as a supply chain.
Ransomware breakout can take hours; espionage actors may remain for years. Detection strategy must handle both.
Shared tooling and false flags (e.g. Olympic Destroyer) demand ACH and confidence statements.
| Days | Action | Output |
|---|---|---|
| 0–30 | Interview stakeholders; draft PIRs; inventory telemetry | PIR register, data-source map |
| 30–60 | Profile top 5 actors; build ATT&CK Navigator layers; score coverage | Threat model, gap heatmap |
| 60–90 | Ship 10 behaviour detections for top gaps; run first emulation; brief the board | Detections, test report, strategic brief |