06 May 2024

Maltego Handbook for Cyber Threat Intelligence

Maltego Team

With cyber threats and attack methods evolving in complexity, companies can no longer only work on a traditional and reactive basis but utilize insights from past incidents and current alerts to swiftly identify and address potential future threats. In this context, Maltego emerges as a critical platform for helping companies deal with the complexities of streamlining the entire lifecycle of threat intelligence, from collection and processing to analysis as part of their advanced security measures. Moreover, adopting these advanced security measures has become essential for businesses to protect their digital assets.

That is why businesses are turning to incident observations and cyber threat intelligence (CTI) to enhance their understanding of security events, allowing them to anticipate and proactively defend against future threats. CTI, in particular, plays a critical role in refining digital forensics and enhancing the incident response process, but it is still described as a nascent and fast-developing field.

In this article, we will cover foundational concepts and the application of cyber threat intelligence, a field shaped significantly by governmental and military organizations over the years. Additionally, we provide a handbook that your threat intelligence team can use to replicate the investigative process using Maltego, available for download.

What is Cyber Threat Intelligence? 🔗︎

In cybersecurity, threat intelligence refers to the data an organization collects, processes, and analyzes to better understand the motives, targets, and attack behaviors of threat actors, which can assist the decision-making process.

The fact that cybersecurity is increasingly recognized as a priority business risk, along with the growing variety and maturity of products, and factors such as regulatory requirements, are all driving the demand for cyber threat intelligence services. Let’s examine different types to determine the level of cyber threat intelligence your team would need.

Levels of Cyber Threat Intelligence 🔗︎

Cyber threat intelligence can be categorized into four levels:

  • Strategic Threat Intelligence: It is high-level information including real-life factors such as economic conditions, political climates, the business impact of risks, and emerging trends in attack methodologies. Sources such as whitepapers, policy documents, and publications contribute to this knowledge base, aiming to enlighten non-technical stakeholders such as High-level executives and management.
  • Operational Threat Intelligence: It is high-level but actionable information including the timing, objectives, and specific methods utilized by threat actors. It equips cybersecurity teams with the foresight needed to predict attacks and understand the schematics behind threat actors’ operations, particularly useful for threat hunters and incident responders. It covers specifics on attack vectors, like domains employed to control comprised systems, and information from external sources like the dark web, all to facilitate the assembly of TTPs.
  • Tactical Threat Intelligence: It is information that outlines the TTPs employed by threat actors, utilizing frameworks like Mitre ATT&CK to track internal threat information feeds such as network traffic data. It provides a technical context that allows IT admins and SOC managers to detect system breaches or familiarize themselves with prevalent attack strategies. Furthermore, this information supports the improvement of security measures and the protection of businesses.
  • Technical Threat Intelligence: It is information that includes specific technical indicators or evidence of threat actor’s tools and infrastructures, aimed at SOC staff to block malicious activities. Such information can include identified malicious IP addresses, phishing email subject lines or content, rogue URLs, or samples of malware and exploits. For example, if adversaries leverage corporate emails as an entry point into an organization (as identified through tactical threat intelligence), the specific email subject lines used would be classified as technical threat intelligence.

With this categorization in place, each operational team and individual can access the most relevant intelligence to their role. The goal of categorizing threat intelligence is to facilitate the identification and mitigation of risks, potentially even leading to the attribution of actors, given their diverse motivations and targets. For example, a bank may request its threat intelligence team to create reports on well-known, persistent cybercriminal groups in the industry to avoid becoming their target. Below are the typical motivations and targets associated with different types of cyber threat actors.

Lifecycle of Cyber Threat Intelligence 🔗︎

Numerous approaches to cyber threat intelligence exist, tailored to the specific requirements and priorities of the teams and different cases. However, the most widely adopted lifecycle model of cyber threat intelligence is one that has been developed through decades of intelligence efforts by government and military organizations like the CIA and the NSA. This model outlines the process of developing raw information into finished intelligence in six essential phases: Direction, Collection, Processing, Analysis, Dissemination, and Feedback.

Access the cheat sheet provided below to gain a comprehensive understanding of the six phases of the threat intelligence cycle. It includes examples and key considerations, and showcases Maltego in action, demonstrating how your team can enhance the efficiency of the threat intelligence lifecycle, from data collection and processing to analysis, all through the use of Maltego.

Key Use Cases Involving Cyber Threat Intelligence 🔗︎

Tailoring cyber threat intelligence to align with the specific requirements of each function and organization is crucial. Possessing a sophisticated level of threat intelligence empowers stakeholders to make swift, well-informed decisions. Additionally, it enables security professionals to more accurately grasp the decision-making processes of threat actors, facilitating earlier detection of threats and the implementation of automated responses. This approach also allows for the evaluation of the efficacy of existing security measures. Let’s first find out how it can benefit each function:

Security professionals utilize:

  • Technical Threat Intelligence to proactively hunt for threat actors who bypass detections, investigate security alerts, and locate forensic evidence.
  • Tactical Threat Intelligence to test their security technologies and processes, fine-tune tools, and lessen the gaps in their security controls.
  • Operational Threat Intelligence to prevent or respond to planned attacks, create rules and signatures for detection alerts, and be proactive in vulnerability and patch management.

Stakeholders utilize:

  • Strategic Intelligence to understand the likelihood of data breaches during risk assessments, set up the company’s cybersecurity stance and budget, as well as gauge the company’s compliance capabilities with regulations.

Download the Handbook for Expert Insights! 🔗︎

In our Cyber Threat Intelligence Handbook, we present the investigative playbook of five commonly known use cases, providing scenarios to demonstrate how you can utilize Maltego for cyber threat intelligence:

  1. Threat Intelligence Collection
  2. Malware Infrastructure Tracking
  3. Vulnerability and Attack Surface Assessment
  4. Threat Actors Profiling
  5. Attacks and TTPs Analysis

Additionally, you can also find out different methodologies of cyber threat intelligence such as mapping the threats to the MITRE ATT&CK framework and the diamond model of intrusion analysis. It also includes tips on various tools and the steps of setting up Maltego on your devices. If you haven’t used Maltego yet, now is the perfect opportunity to discover our organization plan for CTI designed specifically for your team!

Download the handbook to make your threat intelligence analysis effortless!

Download the resource

DE +49
Albania +355
Algeria +213
Andorra +376
Angola +244
Anguilla +1264
Antigua And Barbuda +1268
Argentina +54
Armenia +374
Aruba +297
Australia +61
Austria +43
Azerbaijan +994
Bahamas +1242
Bahrain +973
Bangladesh +880
Barbados +1246
Belarus +375
Belgium +32
Belize +501
Benin +229
Bermuda +1441
Bhutan +975
Bolivia +591
Bosnia and Herzegovina +387
Botswana +267
Brazil +55
Brunei Darussalam +673
Bulgaria +359
Burkina Faso +226
Burundi +257
Cambodia +855
Cameroon +237
Canada +1
Cape Verde +238
Cayman Islands +1345
Central African Republic +236
Chile +56
China +86
Cote d'Ivoire +225
Colombia +57
Comoros +269
Congo +242
Cook Islands +682
Costa Rica +506
Croatia +385
Cuba +53
Cyprus +90392
Czech Republic +42
Denmark +45
Djibouti +253
Dominica +1809
Dominican Republic +1809
Ecuador +593
Egypt +20
El Salvador +503
Equatorial Guinea +240
Eritrea +291
Estonia +372
Ethiopia +251
Falkland Islands (Malvinas) +500
Faroe Islands +298
Fiji +679
Finland +358
France +33
French Guiana +594
French Polynesia +689
Gabon +241
Gambia +220
Georgia +7880
Germany +49
Ghana +233
Gibraltar +350
Greece +30
Greenland +299
Grenada +1473
Guadeloupe +590
Guam +671
Guatemala +502
Guinea +224
Guinea-Bissau +245
Guyana +592
Haiti +509
Honduras +504
Hong Kong +852
Hungary +36
Iceland +354
India +91
Indonesia +62
Iran, Islamic Republic of +98
Iraq +964
Ireland +353
Israel +972
Italy +39
Jamaica +1876
Japan +81
Jordan +962
Kazakhstan +7
Kenya +254
Kiribati +686
Korea, Democratic People's Republic of +850
Korea, Republic of +82
Kuwait +965
Kyrgyzstan +996
Lao People's Democratic Republic +856
Latvia +371
Lebanon +961
Lesotho +266
Liberia +231
Libyan Arab Jamahiriya +218
Liechtenstein +417
Lithuania +370
Luxembourg +352
Macao +853
Macedonia, the former Yugoslav Republic of +389
Madagascar +261
Malawi +265
Malaysia +60
Maldives +960
Mali +223
Malta +356
Marshall Islands +692
Martinique +596
Mauritania +222
Mauritius +230
Mayotte +269
Mexico +52
Micronesia, Federated States of +691
Moldova, Republic of +373
Monaco +377
Mongolia +976
Montserrat +1664
Morocco +212
Mozambique +258
Myanmar +95
Namibia +264
Nauru +674
Nepal +977
Netherlands +31
New Caledonia +687
New Zealand +64
Nicaragua +505
Niger +227
Nigeria +234
Niue +683
Norfolk Island +672
Northern Mariana Islands +670
Norway +47
Oman +968
Pakistan +92
Palau +680
Panama +507
Papua New Guinea +675
Paraguay +595
Peru +51
Philippines +63
Poland +48
Portugal +351
Puerto Rico +1787
Qatar +974
Reunion +262
Romania +40
Russian Federation +7
Rwanda +250
San Marino +378
Sao Tome and Principe +239
Saudi Arabia +966
Senegal +221
Serbia +381
Seychelles +248
Sierra Leone +232
Singapore +65
Slovakia +421
Slovenia +386
Solomon Islands +677
Somalia +252
South Africa +27
Spain +34
Sri Lanka +94
Saint Helena +290
Saint Kitts and Nevis +1869
Saint Lucia +1758
Sudan +249
Suriname +597
Swaziland +268
Sweden +46
Switzerland +41
Syrian Arab Republic +963
Taiwan +886
Tajikistan +7
Thailand +66
Togo +228
Tonga +676
Trinidad and Tobago +1868
Tunisia +216
Turkey +90
Turkmenistan +993
Turks and Caicos Islands +1649
Tuvalu +688
Uganda +256
United Kingdom +44
Ukraine +380
United Arab Emirates +971
Uruguay +598
United States +1
Uzbekistan +7
Vanuatu +678
Holy See (Vatican City State) +379
Venezuela +58
Viet Nam +84
Virgin Islands, British +84
Virgin Islands, U.S. +84
Wallis and Futuna +681
Yemen +967
Zambia +260
Zimbabwe +263

By clicking on "Access", you agree to the processing of the data you entered and you allow us to contact you for the purpose selected in the form. For further information, see our Data Privacy Policy.

Don’t forget to follow us on Twitter and LinkedIn and sign up for our email newsletter, so you don’t miss out on updates and news!

Happy investigating!

By clicking on "Subscribe", you agree to the processing of the data you entered and you allow us to contact you for the purpose selected in the form. For further information, see our Data Privacy Policy.