Dark › Module 8 › Lesson 1
IOC Packaging
STIX IOC handoff literacy — indicator type, STIX object stub, confidence score, TLP marking stub, source attribution — named STIX rows on YOUR `$DW_LAB` fictional org TI pack.
Visual · t39_stix_ioc_handoff
STIX IOC handoff = named TI rows. $DW_LAB. Original Cyberlium.
Opening
Threat intel handoffs need structured IOCs — name STIX row categories on YOUR lab pack before sharing unverified dark-web rumors or stranger org data without TLP.
STIX IOC handoff literacy names: indicator type category (domain, hash, email literacy stub), STIX object structure stub category, confidence score category, TLP marking stub category, and source attribution category. Analyst documents STIX handoff card on `$DW_LAB` fictional org — five STIX rows from Module 6–7 defender findings labeled LAB — without sharing unverified marketplace rumors, without exporting stranger org IOCs without authorization, without stripping TLP markings, without including crime how-tos in intel packages. Cyberlium teaches STIX vocabulary on YOUR notes — defender handoff only. Refused: unverified rumor intel, unauthorized IOC export, TLP stripping. Lab row: STIX handoff card (five rows, sample IOC stub LAB, TLP stub).
1. Named STIX rows
Indicator type, STIX object, confidence, TLP marking, source attribution — five anchors.
Each IOC cites `$DW_LAB` fictional finding — not live criminal marketplace chatter.
Command guide
Try these commands — Named STIX rows
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
OASIS STIX — https://oasis-open.github.io/cti-documentation/stix/intro.html MITRE ATT&CK — https://attack.mitre.org/ MISP — https://www.misp-project.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export DW_LAB=${DW_LAB:-$HOME/cyberlium-lab/t39-dw}
curl -sS https://oasis-open.github.io/cti-documentation/stix/intro.html | head -8
cat > "$DW_TI/stix-ioc-handoff-stub.json" <<'EOF'
{
"type": "bundle",
"id": "bundle--dw-lab-fake-001",
"objects": [{
"type": "indicator",
"name": "FAKE-CORP dark-web mention LAB",
"pattern": "[domain-name:value = 'example.com']",
"labels": ["LAB-SAMPLE-NOT-PRODUCTION"]
}]
}
EOFCommand — copy this
grep -E 'FAKE-CORP|LAB-SAMPLE' "$DW_TI/stix-ioc-handoff-stub.json"
Primary tools to practice this lesson: grep, curl. Reference sites: OASIS STIX (https://oasis-open.github.io/cti-documentation/stix/intro.html); MITRE ATT&CK (https://attack.mitre.org/); MISP (https://www.misp-project.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. TLP discipline
TLP marking stub mandatory on every handoff row — not silent public sharing.
Confidence score documented before distribution — not inflated for drama.
3. Refused
No unverified rumor intel; no unauthorized IOC export; no TLP stripping or crime how-tos in pack.
STIX literacy supports professional handoff — not gossip amplification.
4. What you ship: STIX handoff card
Five STIX rows + sample IOC stub LAB + TLP stub + NEVER unverified rumor line.
5. What you record before the next lesson
STIX handoff card path.
6. Wrong vs right: criminal markets vs YOUR OPSEC lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Share unverified dark-web marketplace rumor as STIX IOC without confidence or TLP marking.
Right
STIX handoff card from `$DW_LAB` defender findings. Next: TI Platform Literacy.
Mission: STIX handoff card
1) Name five STIX handoff literacy rows. 2) Three sample IOC stubs from lab findings. 3) TLP and confidence stub each. 4) Write NEVER unverified rumor intel line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “TLP GREEN vs AMBER — literacy stub on lab IOC?”
Knowledge Check
APPLY: STIX handoff literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: TLP marking optional on IOC handoff.
True or False
Knowledge Check
APPLY: STIX handoff card includes:
Multiple choice