EclecticIQ
nav-solutions

Learn how EclecticIQ can help you address your specific challenges – by team and by need – and improve your overall security posture.

Solutions overview

Our Ecosystem

An ecosystem supporting our customers' intelligence-led proactive cybersecurity needs with collaborative partner programs delivering world-class joint solutions. 

Partner Program

Partner with EclecticIQ to bring valuable and innovative security solutions and services to end users. Open to all partner types, including technology developers, service providers, resellers, and community.

Our Partnerships

We partner with the world's premier technology and solution providers to support all phases of your cybersecurity needs. Explore all our partners' solutions and offerings to build and extend your cyber defense ecosystem.

EclecticIQ Resources

We are committed to increasing the knowledge and capabilities of the cybersecurity community through our research & analysis efforts and open source projects.

Browse Resources

Learn more about our technology, solutions and services, and stay updated on the cyber threat landscape with our research reports, webinars and other information.

Open Source Projects

We are proud to be an active member in the open source community and to help develop and advance progress of security technology. Learn more about contributions or go directly to our GitHub page.

nav-solutions

Learn how EclecticIQ can help you address your specific challenges – by team and by need – and improve your overall security posture.

Solutions overview

Our Ecosystem

An ecosystem supporting our customers' intelligence-led proactive cybersecurity needs with collaborative partner programs delivering world-class joint solutions. 

Partner Program

Partner with EclecticIQ to bring valuable and innovative security solutions and services to end users. Open to all partner types, including technology developers, service providers, resellers, and community.

Our Partnerships

We partner with the world's premier technology and solution providers to support all phases of your cybersecurity needs. Explore all our partners' solutions and offerings to build and extend your cyber defense ecosystem.

EclecticIQ Resources

We are committed to increasing the knowledge and capabilities of the cybersecurity community through our research & analysis efforts and open source projects.

Browse Resources

Learn more about our technology, solutions and services, and stay updated on the cyber threat landscape with our research reports, webinars and other information.

Open Source Projects

We are proud to be an active member in the open source community and to help develop and advance progress of security technology. Learn more about contributions or go directly to our GitHub page.

nav-solutions

Learn how EclecticIQ can help you address your specific challenges – by team and by need – and improve your overall security posture.

Solutions overview

Our Ecosystem

An ecosystem supporting our customers' intelligence-led proactive cybersecurity needs with collaborative partner programs delivering world-class joint solutions. 

Partner Program

Partner with EclecticIQ to bring valuable and innovative security solutions and services to end users. Open to all partner types, including technology developers, service providers, resellers, and community.

Our Partnerships

We partner with the world's premier technology and solution providers to support all phases of your cybersecurity needs. Explore all our partners' solutions and offerings to build and extend your cyber defense ecosystem.

EclecticIQ Resources

We are committed to increasing the knowledge and capabilities of the cybersecurity community through our research & analysis efforts and open source projects.

Browse Resources

Learn more about our technology, solutions and services, and stay updated on the cyber threat landscape with our research reports, webinars and other information.

Open Source Projects

We are proud to be an active member in the open source community and to help develop and advance progress of security technology. Learn more about contributions or go directly to our GitHub page.

nav-solutions

Learn how EclecticIQ can help you address your specific challenges – by team and by need – and improve your overall security posture.

Solutions overview

Our Ecosystem

An ecosystem supporting our customers' intelligence-led proactive cybersecurity needs with collaborative partner programs delivering world-class joint solutions. 

Partner Program

Partner with EclecticIQ to bring valuable and innovative security solutions and services to end users. Open to all partner types, including technology developers, service providers, resellers, and community.

Our Partnerships

We partner with the world's premier technology and solution providers to support all phases of your cybersecurity needs. Explore all our partners' solutions and offerings to build and extend your cyber defense ecosystem.

EclecticIQ Resources

We are committed to increasing the knowledge and capabilities of the cybersecurity community through our research & analysis efforts and open source projects.

Browse Resources

Learn more about our technology, solutions and services, and stay updated on the cyber threat landscape with our research reports, webinars and other information.

Open Source Projects

We are proud to be an active member in the open source community and to help develop and advance progress of security technology. Learn more about contributions or go directly to our GitHub page.

Shifting from What to How with TTPs

Driven mainly by a defense-in-depth mentality, most organizations protect the network by blocking adversaries at the network edge. This means that the security operations center (SOC) must continually update its firewall blocklists to stop adversaries in their tracks. Blocklists rely on a continual flow of low-level indicators of compromise (IOC). Of course, Zero Trust security is shifting this model to a never-trust-always-verify model, but most day-to-day security operations revolve around blocklists.  

Does this sound familiar? Like a perpetual game of cat-and-mouse, these blocklists attempt to stop adversaries, hopefully before they've breached your network. It's not working. Your SOC analysts are undoubtedly overloaded and ineffective because they are suffering from alert fatigue driven by IOCs.  

Even if your SOC could continually process the firehose of IOCs, blocklists built from those IOCs will miss all but the most basic of attacks. Even then, the attacks may have already caused significant damage before detection. There are three drawbacks with blocklists based on IOCs: 

  1. They represent IOCs that are easy to alter (e.g., hashes, domains, IP addresses), meaning there is a minimal cost for the adversary to pivot and invalidate the firewall rule. 
  2. IOCs tend to arise during the later phases of the kill chain. In other words, by the time your CTI team delivers an IOC, the adversary may already be three moves ahead (e.g., lateral movement, escalated privileges).  
  3. IOCs are unreliable. Adversaries circumvent blocklists by ensuring that any IOCs they generate do not trigger malware or hash signatures. They may even inject false IOCs to throw off your CTI analysts. 

blog 5 small

It's time to shift from what to how 

To address these challenges, your organization must shift the way it produces and processes threat information. Specifically, you must move from focusing on "what" is happening to "how" the attack is happening. This is not a trivial task.  

By tracking IOCs, your SOC team rarely sees an attack as it happens. Instead, they're almost always in reaction mode, focusing on what has already occurred. By including the tactics, techniques, and procedures (TTPs) behind the attack, your SOC gains essential context that helps to better define what happened. It also helps determine what might be going on right now and what might happen in the future. 

To illustrate, your SOC staff may see an IP address and port indicator that could be a command-and-control (C2) channel (the "what"). Or it might be a false indicator. Because of this uncertainty, the team lacks sufficient information to decide whether to block the address. Understanding that an attacker habitually uses protocol tunneling as a C2 technique (the "how") provides directional information that leads your SOC to capture network flows. These network flows can then provide the evidence necessary to confidently block the port. 

Determining the "how" of an attack requires you to look beyond IOCs to TTPs. By describing an attacker's behavior, methods, and patterns, TTPs provide a comprehensive intelligence picture with greater context. This picture still includes IOCs, but it also contains observables and MITRE ATT&CK® taxonomy to help different teams understand attacks at strategic and operational levels. 

Shifting from "what" to "how" is an intelligent move because threat actors tend to execute attacks in repetitive ways. They often rely on attack patterns that are historically effective against a particular victim or set of victims. Knowing what's effective for the attacker helps position you to block their next move. 

Where's the pain

It is harder for an adversary to change tactics and techniques when you zoom in on how they execute the attack.  

The best model illustrating how to make life harder for attackers is David Bianco's "Pyramid of Pain." As shown in Figure 1, the indicators on the lower end of the pyramid (e.g., hashes, IP addresses, and domain names) are relatively easy for the attacker to modify. The threat actor can quickly and easily change minimal elements of the attack pattern (e.g., a domain generation algorithm) and relaunch further attacks against your organization that are likely to bypass your SOC's latest IOC-based security mitigations. A TTP, such as relying on a specific protocol to exfiltrate stolen data, is more difficult for adversaries to change than simply changing the C2 server IP address.  

blog 5 graph

Figure 1 - The Pyramid of Pain
 

From the above example, your SOC tracking and blocking exfiltration protocols force the adversary to use a different attack vector, such as a supply chain compromise, if they want to continue to attack your organization.  

Implementing a new attack pattern imposes higher resource costs to retool and forces the adversary into new, unfamiliar territory where they are more liable to make errors. Any error an adversary makes is an opportunity for you to detect them sooner.  

I don't have time to worry about TTPs 

SOCs are inherently overloaded, and SOC teams are perpetually overworked. Changing the discussion from IOCs to TTPs at first may sound like a lot of extra work. It's tempting for your SOC analyst to say, "I don't care about what got us to this point; help me deal with the current fire I've got to extinguish." Persist. Moving beyond IOCs to TTPs has some inherent benefits for the SOC team:  

Preventing future attacks

A focus on TTPs provides better context and detail SOC analysts can use to block further attacks. Every breach contained saves significant SOC resources. As discussed in our "Three Strategic Steps to a Threat-informed Defense (TiD)" post, one premise of a threat-informed defense is to research and validate the organization's ability to defend against specific attacks. TTPs enable you to rapidly model attacks with better context and detail. This additional context and detail arm your security teams with more information to make sure they cover the active threat and cut off the threat actor's key attack channels. For example, understanding that a threat actor using a particular strain of ransomware prefers remote desktop protocol (RDP) as their attack pivot vector provides you with directional insight. Instead of scrambling to mitigate ransomware as the attacker moves from system to system, blocking RDP access can stop them in their tracks, ultimately expelling them from your network. 

Enabling threat hunting

Shifting to TTPs helps to direct threat hunting practices. Specifically, TTPs provide pivot points from specific attack elements by connecting the dots within attack patterns. By joining seemingly isolated events, TTPs facilitate hunting down otherwise undetected attacks. A neutralized threat vector is one fewer potential breach that your SOC and IR teams must deal with, ultimately freeing up strapped SOC and IR resources. 

Making your SOC analyst's life easier

One of the most important benefits of shifting the focus to TTPs is improving information sharing between intelligence and security professionals. Your intelligence analysts and security experts may miscommunicate because they come from different perspectives. Your security team is 100 percent focused on protecting the organization right now. Your CTI team's focus is much broader: discovering what is going on now, reviewing what happened in the past, and projecting what might happen in the future. Through TTPs, both teams gain more attack context, enabling each to select the relevant information that supports their role and mission.

blog 5 illu3

Pushing the CTI team to produce actionable intelligence 

Just as the shift from IOCs to TTPs forces your SOC team to adjust its focus, it also puts significant pressure on your threat analyst team to produce easily consumable reports. These reports must empower your SOC and incident response (IR) teams with actionable insights and guidance that communicate common objectives. As discussed in our white paper, "Beyond the IOC with Cyber Threat Intelligence," a key to developing actionable intelligence reports is finding the right balance between valuable data and supporting detail. Achieving this balance requires a threat intelligence management platform that makes it easy to generate reports that help non-CTI staff translate essential intelligence factors like confidence level and maliciousness into actionable information. As a CTI director at a global financial services organization told us, before implementing EclecticIQ Intelligence Center, no matter how hard his CTI team worked, the rest of the organization could not "take that extra step to leverage the intelligence. That step requires actionable intelligence." 

Shifting to TTPs gives you time to breathe 

The rat race created by continually trying to stop attacks with blocklists is exhausting and potentially catastrophic for your organization, since attackers quickly bypass the blocks. By moving up the Pyramid of Pain to focus on TTPs, your security and CTI teams change the game. This move requires changing both the focus of the threat intelligence and how it is developed and structured.  

The beauty of shifting from "what" to "how" is that rather than being 100 percent reactive, your security team can take a breath and gain time to become proactive. Your SOC will still be under intense pressure to block active threats. However, by leveraging higher-level CTI that maps out specific TTPs in alignment with the kill chain, your SOC will not only be able to block existing threats intelligently and proactively but will also be better positioned to prevent future threats.  

As we discuss in “Achieving Early Warning for Cyber Resilience,” shifting from "what" to "how" also positions your organization to play a more significant role in the broader threat intelligence community. Through collaboration and sharing, you can both help other organizations and leverage their CTI for a more robust defense. 

Beyond the IOC with Cyber Threat Intelligence (CTI)

Indicators of Compromise (IOCs) have their place in cybersecurity, but as cyber threats evolve, they have become ineffective in threat detection. In order to detect the techniques, tactics and procedures (TTPs) of adversaries as well as to fully understand and anticipate threats, we have to go Beyond the IOC with structured intelligence.

Three Steps to Aligning CTI, SOC, and IR for Action

Three Steps to Aligning CTI, SOC, and IR for Action

Learn three straightforward steps to be more proactive with your CTI to better align your SOC and IR teams for action.

© 2014 – 2022 EclecticIQ B.V.
EclecticIQ. Intelligence, Hunting, Response.
Get demo