Certified Cyber Threat Intelligence Analyst

Explore hunting as a core threat intelligence technique and learn how VirusTotal works, including its free and paid tools, UI, tagging, sample uploads, and basic hunting rules.

Explore VirusTotal as a public, free-to-use platform (with paid options) to analyze samples, download data, and automate with the API using Yara rules and retro hunts.

Explore hacking forums in the deep web to understand malware, exploits, and zero-days from a threat intelligence perspective, while highlighting red flags and legal risks.

Examines the challenges of researching hacking forums for cyber threat intelligence, including fake profiles, proxies, language, and the role of monitoring by authorities.

Analyze how hacking forums recruit with criminal intent, discuss malware, and expose threat intelligence researchers to risks like law enforcement infiltration and jail for malware development.

Explore how the deep web and dark web sit below the regular internet, why search engines miss them, and how proxies, Tor, and robots.txt govern access and risk.

Explore the deep web beyond the surface internet, including tor anonymity, captcha challenges, and access controls, plus illegal forums, dark marketplaces, bitcoin transactions, and data like card dumps.

Honeypots provide early detection by deploying decoy systems that lure attackers and reveal their behavior. Use OSINT tools like Maltego and theHarvester to map attackers, domains, and assets.

Learn to use virus total intelligence for threat hunting, building and applying general rules, exploring samples with static and dynamic features, clustering results, and identifying threat actors.

Develop binary-level detections with Yara by analyzing strings, Unicode indicators, imports/exports patterns, entry points, sections, and file size to identify polymorphic malware.

Enhance threat intelligence by mastering feature extraction from malware samples, building on hunting to extract static features using ssdeep, mirror data, and strings, then cluster into families.

Extract malware creation timestamps to establish timelines, and analyze digital certificates—self-signed or stolen—to detect fraud and antivirus bypass, including using serial numbers to trace related samples.

Learn how import table hash (imphash) fingerprints Windows binaries by combining API sequences in order to reveal malware behavior and ensure file integrity through hash comparisons.

Learn how import table hash (imphash) uses API order and content to identify similar malware, cluster samples, and track families across datasets using tools like VirusTotal.

Explore how fuzzy hash (ssdeep) enables feature extraction by breaking files into pieces, generating CT-PH fingerprints, and measuring similarity to detect malware variants, while analyzing metadata.

Extract and analyze VBA macros from malicious email attachments using Didier Stevens tools, decoding base64 streams to reveal embedded macro behavior.

Trace how macro malware downloads and executes a payload, then pivots to a C2 IP, using host indicators and passive DNS to map the threat's infrastructure.

Learn to perform behavior extraction through dynamic analysis, identifying unique dynamic features in malware samples to classify them into malicious groups and aid threat intelligence.

Analyze dynamic indicators as behavior extraction in sandboxes. Identify mutex names like groove path mutex and API calls such as get cursor position and get address info to classify malware.

Analyze sandbox evasion through get cursor position, mouse speed, and timestamps to classify malware, infer sandbox containment, and identify potential downloaders that connect to the Internet.

Analyze how malware evades sandbox detection through delay execution using native APIs like sleep, and how researchers extract features such as mutexes and behaviors to classify and cluster samples.

The lecture covers process-based infection techniques, including write process memory and set context for code injection. Explore keylogger and mouse hooks that intercept keyboard and mouse input.

Explore passive DNS (DNSDB) and how sensors collect DNS request data to a central repository, enabling researchers to analyze domain changes, subdomains, and C-2 infrastructure.

Explore how passive DNS using DNSDB captures DNS queries and stores authoritative answers, revealing how domain resolutions flow from users to DNS authorities for threat intelligence.

Explore how clustering and correlation classify malware by features and behaviors, using graph databases and query tools, and compare graph DBs with traditional relational databases.

Learn how clustering classifies cyber threat samples using static features and DNS data to form buckets for persistent threats, memory scrapper, and malware, revealing infrastructure and attack vectors.

Explore how clustering uses static features, dynamic behavior, and metadata to group malware samples, then apply correlation to connect the dots with DNS DB and IP histories to identify origins.

Explore how clustering and correlation reveal the full attack flow, tracing from hashes to IPs and emails, and map malware progression with a graph database.

Explore graph databases through GraphDB Part 1, detailing nodes, edges, and properties, and compare them to RDBMS while illustrating clustering and correlation of binaries, documents, and DNS data.

Explore graph-based threat intelligence by applying clustering and correlation to classify malware and store findings in a graph database, using tools like Tago, TinkerPop, and Neo4j.

Master clustering and correlation in cyber threat intelligence with static and dynamic analyses, mapping email attachments and indicators to campaigns and attribution.

Explore how to locate threat actors by analyzing location, targets, and attribution through feature extraction and profiling. Apply tactics, techniques, and procedures to clustering, support attribution, and name threat groups.

Develop attribution by tracing source IPs to the malware's C2, using IP location, hosting providers, and Tor exit nodes, and corroborate with logs and regional patterns such as Nigeria scams.

Identify targets in attribution by analyzing sectors, locations, and threat groups. Assess data exfiltration patterns and motives, from intellectual property to political pressure, across industries and nations.

Learn how attackers achieve initial compromise through spearfishing, waterhole attacks, spam campaigns, and exploit kits, and how these tactics enable access to everything.

Explore privilege escalation techniques, including zero-day exploits used by state-sponsored actors like Stuxnet and Dooku, and the role of hacking tools, social engineering, and password cracking.

Maintain access to a compromised system for long periods using persistence through registry keys, rootkits, backdoors, and COM object hijacking. Detect anomalies and remove the infection.

Explore lateral movement after initial compromise, examining tactics, techniques, and procedures for spreading through a local network via internal reconnaissance, port scanning, network mapping, and credential harvesting.

Pivot within a compromised network using passwordless ssh key access, vnc, and encrypted tunnels for stealthy lateral movement and exfiltration, plus internal reconnaissance and port scans.

Explore exfiltration strategies to profile threat actors by analyzing techniques, traffic patterns, and data post parameters, including man-in-the-middle, fake encrypted channels, and custom encryption.

Profile the attacker to support attribution by analyzing X5's static features and behaviors, including spearphishing emails, rootkits, sniffers, and base64-encoded exfiltration targeting South Korean nuclear plants.

Explore threat intelligence tracking by applying passive DNS analysis and internet port scans to uncover open domains, C2 infrastructure, and threat actor activity, and learn how hunting differs from tracking.

Track threat actor techniques and variants to anticipate attacks proactively and protect networks. Use passive DNS, port scans, and evolving exfiltration strategies to update detection rules and defenses.

Use passive DNS to detect attackers' new IP addresses through DNS DB records. Identify new hosting providers across countries, map patterns, and flag new attack sources for early notification.

Leverage internet port scans and passive dns to proactively map attacker infrastructure, identify open ports for command and control, and track changing IP addresses and tactics.

Develop threat intelligence by performing lookups and OSINT against hacking forums, using feature extraction and rules to surface related samples and validate them with VirusTotal.

Explore open source intelligence to identify infection vectors and malware trends. Link email headers to IP addresses and monitor hacking forums for threat intelligence and tracking.

Learn how sinkholes dismantle cyber threats by guiding law enforcement actions, taking down criminal infrastructure, and preventing attackers from rebranding domains or changing IP addresses.

Learn how sinkholes redirect malicious C2 traffic from attackers to researchers' analysis servers to study attacker techniques, identify attack vectors, and develop long-term mitigation with law enforcement and providers.

Explore how sinkholes in cybersecurity redirect malware traffic to researcher-controlled servers, using DNS sinkholes and man-in-the-middle approaches to observe and halt infections while staying within legal boundaries.

Explore sinkhole strategies to disrupt botnets by taking over domain, IP, or C2 infrastructure, with law enforcement collaboration, and analyze infection counts, operating systems, and countries for threat intel.

Explore how hacking forums are taken down through long-term law enforcement infiltration and international cooperation, with cautions for researchers to avoid risky discussions that could lead to arrest.

Explain victims notification in cyber incidents, including sinkholes, with trained professionals and coordinated law enforcement to ensure lawful, safe communication.