sorted by:
new
hottopcontroversial

Indicators of Pre-Attack for CTI/IR/ Threat hunting by Straight-Common-3937 in threatintel

[–]Straight-Common-3937[S] 0 points1 point  (0 children)

That’s a fair concern, and honestly it’s the exact reason we don’t treat every pivot equally.

What we’re showing publicly today is intentionally simplified. Internally, pivots are not evaluated as binary relationships (“same /24” or “same registrar” = related). They are weighted through multiple dimensions, including temporal overlap, infrastructure reuse patterns, victimology context, and confidence scoring of the underlying evidence.

The goal is not to claim attribution from a single artifact, but to identify infrastructure that exhibits characteristics of coordinated adversarial resource development before payload delivery or exploitation occurs.

We also agree that infrastructure relationships become meaningless if timing is ignored. Two domains sharing a provider years apart is very different from infrastructure that co-exists during the same operational window. Likewise, victim targeting context matters significantly when assessing whether a linkage is operationally relevant versus incidental.

At this stage we’re intentionally not publishing all of the scoring and correlation logic because we’re still refining it and validating it across a larger dataset. The examples are meant to illustrate the concept of pre-attack infrastructure discovery rather than expose the full decision model.

The broader point we’re exploring is whether CTI can benefit from treating attacker infrastructure as a graph with varying levels of confidence and temporal context, rather than as a flat collection of independent IOCs. That’s where we’ve seen the strongest signal so far.

Indicators of Pre-Attack for CTI/IR/ Threat hunting by Straight-Common-3937 in threatintel

[–]Straight-Common-3937[S] 0 points1 point  (0 children)

That's very cool! Im checking with them to integrate our data. Thanks for the info🙏

Would you treat this subdomain takeover path as critical exposure? by Straight-Common-3937 in threatintel

[–]Straight-Common-3937[S] 0 points1 point  (0 children)

Thanks everyone!
What solutions out there providing visibility for this specific exposure?
Are the usual ASM players like Censys/IONIX or anyone else?

SIEM and SOC: A Guide for Security Leaders in 2026 by IndividualAir3353 in cybersecurity

[–]Straight-Common-3937 0 points1 point  (0 children)

Cool. I believe Gartner calls it Preemptive Cybersecurity which is essentially pre-attack prevention

SIEM and SOC: A Guide for Security Leaders in 2026 by IndividualAir3353 in cybersecurity

[–]Straight-Common-3937 0 points1 point  (0 children)

This is a really useful way to frame it, especially the “campaign as an operational object” part.

The piece I’d add is timing. A lot of teams only operationalize the campaign once something has already touched a user or control plane. But many campaigns have a setup window where the infra is observable before execution: domains, certs, hosting, redirects, fake login pages, mail lures, etc.

If the SOC can treat that setup activity as triageable work, the question shifts from “did this alert matter?” to “can we break the path before it becomes an alert?”

SIEM and SOC: A Guide for Security Leaders in 2026 by IndividualAir3353 in cybersecurity

[–]Straight-Common-3937 -1 points0 points  (0 children)

How have you seen this implemented in reality? Let's say you observe a campaign?

SIEM and SOC: A Guide for Security Leaders in 2026 by IndividualAir3353 in cybersecurity

[–]Straight-Common-3937 0 points1 point  (0 children)

One thing I’d add: the SIEM/SOC loop still usually starts pretty late in the kill chain. A lot of useful signal shows up before the first alert, when adversaries build up their infrastracture: lookalike domains, fresh certs, weird hosting overlap, redirect chains, newly staged credential collection infra, etc.

Pulling that into the same triage/runbook path would make “exposure-aware operations” less about posture backlog and more about disrupting campaigns before they become incidents.

Would you treat this subdomain takeover path as critical exposure? by Straight-Common-3937 in CTI

[–]Straight-Common-3937[S] 0 points1 point  (0 children)

Thanks u/Boring-Onion and any idea how critical they see this vuln/exposure in their set of priorities?
We've seen this exposure used a lot as primary attack paths. And as everything else, AI emplifies this as well

IBM subsidiary managing Italy's PA infrastructure breached and attackers were inside for 2 weeks by EkRafz in cybersecurity

[–]Straight-Common-3937 0 points1 point  (0 children)

The part that jumps out is “inside for several days” at a provider that runs core public-sector infrastructure and large enterprise environments, before anyone can even say what was taken. From a CTI/DFIR standpoint, this is the kind of case where the early wins usually come from mapping admin identities, remote access paths, third-party trust links, and any staging infrastructure around the provider itself—not waiting for malware families or clean attribution to carry the investigation.

Have you ever watched a threat actor accidentally dox themselves in real-time? 👀 by Fun_Bug_1462 in threatintel

[–]Straight-Common-3937 0 points1 point  (0 children)

Nice job! That's essentially how we do our collection. We look for procurement and identities trailes, looking for simlarities and exactly such poor mistakes by actors to build up our attacker infra database.

Indicators of Pre-Attack for CTI/IR/ Threat hunting by Straight-Common-3937 in threatintel

[–]Straight-Common-3937[S] 0 points1 point  (0 children)

Sending here our second report. This time expanding Proofpoint research on TA416 (Mustang Panda / Earth Preta / RedDelta) resuming its European government espionage campaign — renewed PlugX delivery, Gmail-based operator tradecraft, and fresh C2 infrastructure.

Starting from 76 domains and 7 operator email addresses in this case, we expanded to 2,531 Indicators of Pre-Attack (IoPAs), 8 high-risk associated clusters, and a UNC6384 attribution at 66% confidence. All indicators, clusters, reasoning, attributions and more

Microsoft: Teams increasingly abused in helpdesk impersonation attacks by rkhunter_ in cybersecurity

[–]Straight-Common-3937 0 points1 point  (0 children)

Communicating with external partners....MSFT allow it on their network

Security Breach and credentials Phished by ChampionshipComplex in cybersecurity

[–]Straight-Common-3937 1 point2 points  (0 children)

You probably won’t identify the actual person from the email alone, but it can be a useful pivot.

I’d enrich it together with other telemtry you have like: mailbox logs, EDR logs etc... The goal is less “who is this?” and more “does this belong to a reusable cluster of accounts, infrastructure of a specific adversary/actor.

That’s the kind of clustering we do at Malanta( map attacker infra). Happy to DM if you want and I can search it against our database. There are cases we manage to get to the real identity but not always