A Practical Case of Threat Intelligence – From IoC to Unraveling an Attacker Infrastructure

SANS Cyber Threat Intelligence Summit 2023

Luna Moth: A Practical Case of Threat Intelligence – From IoC to Unraveling an Attacker Infrastructure
Oren Biderman, Senior Incident Response & Threat Hunting Expert, Sygnia
Noam Lifshitz, Incident Response Team Leader, Sygnia

Pivoting, or being able to move between indicators of compromise and up David Bianco's Pyramid of Pain to uncover the threat actor's tactics, techniques and procedures (TTPs) is a common practice in Cyber threat intelligence (CTI) operations. However, it is sometimes …

actor amp art case compromise cti cyber cyber threat cyber threat intelligence expert hunting incident incident response incident response team indicators of compromise infrastructure intelligence ioc leader luna luna moth operations pivoting practice procedures pyramid pyramid of pain response sans summit sygnia tactics team techniques techniques and procedures threat threat actor threat hunting threat intelligence ttps uncover