SSCP Systems Security Certified PractitionerRisk Identification, Monitoring, and AnalysisMedium
A security operations center (SOC) analyst observes a series of alerts indicating that an internal host is attempting to establish connections to multiple external IP addresses on unusual ports, and the volume of data being exfiltrated is significantly higher than normal baseline traffic for that host. The analyst cross-references this behavior with known threat intelligence and finds similarities to a recently documented command and control (C2) communication pattern. Which type of threat intelligence is the analyst primarily using to correlate these observations?
- ATactical Threat Intelligence
- BTechnical Threat Intelligence
- COperational Threat Intelligence
- DStrategic Threat Intelligence
Show answer & explanationAnswer & explanation
Correct answer: C. Operational Threat Intelligence
Operational threat intelligence provides information about specific attacks, campaigns, and the TTPs (Tactics, Techniques, and Procedures) used by threat actors, often including details about C2 communication patterns. This helps an analyst understand and respond to ongoing or imminent threats.
Why the other options are wrong
- A. Tactical threat intelligence focuses on specific TTPs, but 'operational' is more appropriate for correlating active campaign details like C2 patterns.
- B. Technical threat intelligence focuses on indicators like IP addresses and hashes, which are part of the initial observation but not the correlation of the overall C2 pattern itself.
- D. Strategic threat intelligence provides a high-level overview of an organization's threat landscape, not specific C2 patterns.
Operational Threat Intelligence
Information about the specific methods, tools, and processes (TTPs) used by adversaries in their campaigns. It helps understand how attacks are being executed.
- Focuses on 'how' attacks are conducted.
- Includes TTPs, campaign details, C2 patterns.
- Useful for incident responders and security analysts.
Memory trick: STOP! Strategic, Tactical, Operational, Technical.