Red › Module 3 › Lesson 1
Threat Intel Inputs
Threat intel informs emulation — read reports for TTP context on $LAB_RT plans, not as stranger attack playbooks.
Visual · rt_threat_intel_inputs
Threat intel inputs literacy. $LAB_RT only. Original Cyberlium.
Opening
Intel reports describe adversary behavior — your RoE decides what you emulate in lab.
Threat intelligence inputs include vendor reports, MITRE ATT&CK groups, ISAC bulletins, and internal incident summaries. Red teams extract TTP patterns, tooling names, and objectives to build emulation plans — filtered through RoE and lab constraints at $LAB_RT. Cyberlium teaches intel literacy for planning — not copying nation-state playbooks against classmates or production. Next: Emulation Plan.
1. Sources red teams consume responsibly
Public ATT&CK group pages, annual intrusion reports, and purple-team case studies name TTP sequences defenders should test. Extract: initial access pattern, persistence preference, C2 style — map to $LAB_RT feasibility under RoE.
Intel is context for detection value — not permission to replicate full campaigns on unauthorized networks.
Command guide
Try these commands — Sources red teams consume responsibly
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Threat intel inputs — https://attack.mitre.org/groups/ (named groups for emulation literacy) Adversary emulation plans — https://attack.mitre.org/resources/adversary-emulation-plans/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Built-in (PowerShell: Invoke-WebRequest) Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
curl -sS https://attack.mitre.org/groups/ | grep -oE 'G[0-9]{4}' | sort -u | head -8
python3 -c "groups=['G0016','G0050']; print('Lab emulation inputs:', ', '.join(groups))"Primary tools to practice this lesson: curl, python3. Reference sites: Threat intel inputs (https://attack.mitre.org/groups/); Adversary emulation plans (https://attack.mitre.org/resources/adversary-emulation-plans/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. From intel to emulation hypotheses
Hypothesis template: 'If we emulate T1059 PowerShell on $LAB_RT workstation, SOC should alert within N minutes via data source X.' Intel informs technique pick; RoE caps impact.
Discard intel steps that imply stranger phishing, mass email, or ransomware on production — note as out-of-scope in chmod 600 files.
3. Intel hygiene and classification
Treat shared intel per classification rules — no pasting restricted reports into public chat. Summarize TTP IDs and detection gaps in your own words for $LAB_RT debrief.
Ship: one intel source + three TTP IDs extracted for $LAB_RT planning. Next: Emulation Plan.
4. What you ship: intel input summary for $LAB_RT
Source name, three TTP IDs, detection hypothesis. $LAB_RT only. NEVER stranger replication. chmod 600.
5. What you record before the next lesson
Date. Intel summary. Three TTP IDs. $LAB_RT named. File t21-m03-l01-threat-intel-inputs.txt chmod 600.
6. Wrong vs right: stranger phishing vs authorized RT lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Copy APT report step-by-step against classmate VM. Treat leaked intel as authorization.
Right
Write intel input summary for $LAB_RT planning. Next: Emulation Plan.
Mission: extract intel inputs for YOUR lab plan
1) Name one intel source (ATT&CK group or public report). 2) Extract three TTP IDs for $LAB_RT. 3) Write one detection hypothesis. 4) chmod 600. Never plan stranger replication from intel.
Stuck? Ask Cyberlium AI Mentor
Intel informs technique pick — RoE caps impact.
Knowledge Check
APPLY: Threat intel for Cyberlium red team means:
Multiple choice
Knowledge Check
APPLY: True or False: Public APT reports authorize testing any reachable host.
True or False
Knowledge Check
APPLY: Intel should feed:
Multiple choice