300-215 Question 163
Select 3During a forensic investigation, you are analyzing artifacts provided by a threat intelligence feed. The artifacts include indicators of compromise (IOCs) such as IP addresses, domain names, malware hashes, and observed tactics, techniques, and procedures (TTPs). Based on these artifacts, how should you determine the likely threat actor profile?
- A
Compare the TTPs to known profiles in the MITRE ATT&CK framework.
- B
Correlate the IOCs against Cisco SecureX threat intelligence database to identify patterns.
- C
Focus solely on the IP addresses and domain names to determine the threat actor's location.
- D
Analyze the malware hashes to identify if they match any previously known advanced persistent threats (APTs).
- E
Ignore the IOCs and focus instead on network traffic logs to find the attacker.
Show answer and explanation
Correct answers: A, B, D
Explanation
To determine a threat actor profile, it is essential to analyze multiple artifacts and correlate them with known threat intelligence sources. TTPs, IOCs, and malware hashes provide crucial insights into the attack methodology and can help identify the attacker when matched against frameworks like MITRE ATT&CK or platforms like Cisco SecureX. However, relying on individual elements, such as IP addresses alone, or ignoring IOCs, would lead to an incomplete analysis.
- A. Correct.
TTPs are critical for identifying threat actor profiles because they reflect the specific behaviors and methods used by attackers. The MITRE ATT&CK framework is a valuable resource for mapping TTPs to known threat actors.
- B. Correct.
The Cisco SecureX threat intelligence platform can provide enriched context and correlate IOC data with known patterns, helping to identify the threat actor.
- C. Incorrect.
While IP addresses and domain names can provide some clues, they are insufficient on their own to determine the location or profile of a threat actor due to spoofing and the use of proxies.
- D. Correct.
Malware hashes can reveal matches to known APT-related malware, which helps infer the threat actor's identity or group.
- E. Incorrect.
Ignoring the IOCs entirely would be a critical mistake, as IOCs are essential for identifying and profiling threat actors.