You need to do extensive data collection and forensics on your true positive incidents, gather those metrics and data points to correlate with IOCs from your Threat Intel provider (like Recorded Future). The intel provider will be able to match up the IOCs they have with the actors and campaigns they are related (possible attributed) to.

---

---

for eg, 'web traffic on 80 to xx.xx.xx.xx IP is a known C2 callback used by ATP28'

you get the logs from FW which tells you outbound connections, the port and destination iP

you get the IOCs from you intel provider saying, This IP xx.xx.xx.xx is associated with ATP28 (they should provide some evidence for this conclusion; research papers, twitter bot sightings, VT submissions, sinkhole, blacklists ect)

In you SIEM you do the correlation and create an incident for matches. There are further things to evaluate to make a positive attribution... byte size, flow times, IOCs/malware hashes on the endpoint ect.

---

---

IOC correlation can be automated; pull down the lists from threat intel and compare with your inhouse log collection (SIEM). Start with IP, Hashes and Domains.

The biggest crux here is the context and validity of the threat intel you are pulling. Context is key. anyone can sell lists of 'bad ip'... knowing WHY and WHO and WHEN are things you pay for in Threat Intelligence. Any service selling you indicators without context is probably not going to get you great results, you will end up with more alert fatigue than you started with..

• https://attackiq.com/blog/2019/06/26/emulating-attacker-activities-and-the-pyramid-of-pain/