Threat Intelligence: IOCs, Feeds, and Sharing Standards

What Is Threat Intelligence?

Threat intelligence is processed, actionable information about adversaries, their tools, and their methods. Raw data — a list of IP addresses or a pile of log lines — is not intelligence until it has been analyzed and put in context. Cybersecurity analysts use threat intelligence to detect attacks faster, prioritize which vulnerabilities to patch first, and share knowledge with other defenders so the whole community benefits.

Indicators of Compromise (IOCs)

An indicator of compromise is an observable artifact that suggests a system or network has been attacked or compromised. IOCs come in several types:

• IP addresses — outbound connections to known command-and-control servers
• Domain names — newly registered or algorithmically generated domains used by malware
• File hashes — MD5, SHA-1, or SHA-256 checksums that uniquely identify a malicious file
• File names or paths — suspicious executables dropped in unusual directories (e.g., `C:\Users\Public\svchost32.exe`)
• Registry keys — persistence mechanisms written to Run keys
• User-agent strings — non-standard HTTP headers used by malware beaconing
• Unusual login times or locations — an account logging in at 3 a.m. from an unfamiliar country

When you analyze a Windows Event Log, look for Event IDs associated with process creation (4688), logon events (4624, 4625), and network connections. Correlate timestamps, usernames, source IPs, and process names to spot anomalies.

Threat Intelligence Feeds

A threat intelligence feed is a continuous stream of IOC data that analysts subscribe to. Feeds vary in coverage, freshness, format, and cost. Three widely used open-source feeds are:

• AlienVault OTX (Open Threat Exchange) — a community-driven platform where researchers publish pulses containing IOCs linked to specific threat campaigns. Data is available via API and web interface and includes IP reputation, domain, URL, file hash, and YARA rules.
• CISA Known Exploited Vulnerabilities (KEV) Catalog — maintained by the Cybersecurity and Infrastructure Security Agency; lists CVEs that have confirmed, active exploitation in the wild. Federal agencies are required to remediate KEV entries on defined timelines; private organizations treat it as a high-priority patch list.
• Abuse.ch — a non-profit research project offering several focused datasets: MalwareBazaar (file hashes), Feodo Tracker (botnet C2 IPs), URLhaus (malicious URLs), and ThreatFox (structured IOC data). Abuse.ch data is freely available and frequently updated.

When comparing feeds, evaluate: coverage (what IOC types and threat categories are included), update frequency (hourly vs. daily vs. on-demand), format (STIX/TAXII, CSV, JSON, plain text), and reliability (false-positive rate, source credibility).

STIX and TAXII

STIX (Structured Threat Information eXpression) is an open standard — maintained by OASIS — for representing threat intelligence in a consistent, machine-readable JSON format. The current version is STIX 2.1. STIX organizes data into objects. The most common object types for IOCs are:

• `indicator` — describes a pattern (e.g., a file hash or IP) that, if observed, suggests malicious activity
• `observed-data` — records raw observations from a sensor
• `malware` — describes a malicious software family
• `threat-actor` — describes an adversary group
• `relationship` — links two STIX objects together (e.g., an indicator indicates malware)

Every STIX object has mandatory fields: `type`, `spec_version` (set to `"2.1"`), `id`, `created`, and `modified`. An `indicator` object also requires a `pattern` field written in STIX Pattern Language and a `valid_from` timestamp.

TAXII (Trusted Automated eXchange of Indicator Information) is the companion transport protocol. Where STIX defines what intelligence looks like, TAXII defines how it is shared — over HTTPS using a REST API with collections and channels.

Working with a STIX 2.1 Template

In today's activity you will fill in a pre-built JSON template. Here is the structure you will work with for an IP-address indicator:

```json

{

"type": "indicator",

"spec_version": "2.1",

"id": "indicator--<UUID>",

"created": "2024-01-15T08:00:00.000Z",

"modified": "2024-01-15T08:00:00.000Z",

"name": "Suspicious outbound IP",

"pattern": "[ipv4-addr:value = '203.0.113.45']",

"pattern_type": "stix",

"valid_from": "2024-01-15T08:00:00.000Z",

"indicator_types": ["malicious-activity"]

}

```

For a file hash, the pattern uses: `[file:hashes.'SHA-256' = '<hash>']`

For a domain, the pattern uses: `[domain-name:value = 'evil-domain.com']`

After editing, validate your JSON using the built-in formatter in VS Code (right-click → Format Document) to catch syntax errors before submission.

Safety and Responsible Handling

Do not query or visit any IOC (IP address, URL, or domain) found in logs or feeds using a standard browser on a production or personal machine. Malicious URLs can deliver drive-by exploits. If you need to verify an IOC, use a sandboxed environment, a service like VirusTotal, or a dedicated analyst workstation isolated from the network. Treat all IOC data as potentially sensitive — some feeds carry TLP (Traffic Light Protocol) markings that govern how widely you may share the data.