OpenCTI — THM

OpenCTI is built for one main purpose: turning threat intelligence into real action.

— — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

Task 2: Introduction to OpenCTI

Cyber Threat Intelligence can often feel confusing and difficult to manage, as orgs struggle with how to collect, analyze, and present threat data in a meaningful way. This is where OpenCTI becomes useful.

• OpenCTI is an open-source platform designed to help orgs manage CTI by enabling the storage, analysis, visualization, and reporting of threat intel, including campaigns, malware, and IOCs.
• Developed in collaboration with the French National Cybersecurity Agency (ANSSI), OpenCTI aims to provide a complete system that links both technical and non-technical intel to its source, while also building relationships among all data pieces. It supports structuring intel using the MITRE ATT&CK framework and can integrate with other threat intel tools.

— — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

Task 3: OpenCTI Data Model

• OpenCTI organizes threat intel using STIX2 (Structured Threat Information Expression), a standardized format designed for sharing CTI. Instead of storing data as random notes, OpenCTI stores it as entities (malware, threat actors, and IOCs) and connects them through relationships, making it easy to trace where info came from and how everything is linked.

• This model is supported by OpenCTI’s architecture, which is built around a few core components:
  I- GraphQL API: Acts as the main bridge between users, the DB, and the messaging system.
  II- Write Workers: Python-based processes that handle writing tasks asynchronously using RabbitMQ.
  III- Connectors: Python services responsible for importing, enriching, and exporting threat intelligence, allowing OpenCTI to integrate with many external tools and frameworks.
• Connectors are a major part of OpenCTI’s strength, and they are grouped into categories such as:

the types of OpenCTI connectors

— — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

Task 4: OpenCTI Dashboard 1

• OpenCTI organizes entities into two main categories: Activities and Knowledge.
  I- Activities (what happened): It focuses on sec incidents/events that happened or were reported.
  II- Knowledge (who/what is involved): It contains linked intel on adversaries and their operations, including info abt the tools and malware used, victim orgs, and the threat actors and campaigns involved.

• Analysis (Why it matters): It displays entities extracted from analyzed reports, along with their associated external references. Reports help analysts easily trace info back to its source (essential for validation and investigation). Additionally, analysts can also enrich reports by adding investigation notes and linking additional external resources.

The Trion Software report published by MITRE ATT&CK, where extracted intel can be observed and further expanded if needed

• Events: It allows sec analysts to doc suspicious/ malicious activities and enrich their investigations by linking related threat intel entities and building associations between incidents.

• Observations: It contains tech evidence collected during a cyber attack (artifacts, detection rules, and indicators). These elements help analysts track suspicious activity, map out threat events during investigations, and correlate what they find in their environment with threat intel feeds.

• Threats: It contains intel abt anything considered dangerous to an org. It mainly focuses on the ppl and operations behind cyberattacks.
  I- Threat Actors: Individuals/ groups responsible for malicious activity against targets
  II- Intrusion sets: Collections of known tools, malware, infrastructure, and TTPs linked to a specific threat group (APT groups)
  III- Campaigns: Organized series of attacks carried out during a specific time period, usually targeting particular victims and driven by clear objectives

• Arsenal: It contains everything related to the tools and techniques used during an attack.
  I- Malware: Info abt known malware/trojans and their linked relationships.
  II- Attack Pattern: Adversary techniques and TTPs mapped to MITRE ATT&CK.
  III- Course of Action (CoA): Defensive recommendations to prevent/ reduce attack success.
  IV- Tools: Legitimate tools attackers may abuse (CMD) and their related attack patterns.
  V- Vulnerabilities: Known weaknesses/CVEs exploited by attackers, enriched via external connectors like the MITRE CVE list.

• Entities: It organizes threat intel entities by sector, country, org, and individual to support investigation and enrichment.

• 1st question:

• On the OpenCTI dashboard, click Arsenal from the left panel. Then locate and open the 4H RAT malware entity. In the Details panel on the right, you’ll find that it’s associated with the threat actor Putter Panda.

• 2nd question:

• Go to the Arsenal tab, then search for Command-Line Interface under the Attack Patterns tab. In the Details panel on the right, the associated Kill Chain Phase is execution-ics.

• 3rd question:

• Within the Activities category, Indicators are found under the Observations tab.

— — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

Get Basmala Yasser’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Task 5: OpenCTI Dashboard 2

• In day-to-day OpenCTI work, analysts mainly navigate between different entities to explore relationships and extract useful threat intel. For this walkthrough, the focus is on the Cobalt Strike malware entity, which can be found under the Arsenal tab. When selecting any intel entity, OpenCTI displays its info through several tabs. The most important one is:
• Overview Tab: Shows general details about the entity, including its ID, confidence level, description, linked relationships (threats, intrusion sets, attack patterns), related reports, and external references.

• Knowledge tab: displays all intel linked to the selected entity. It includes related reports, indicators, relationships, and an attack pattern timeline. Analysts can also explore detailed connections through the right-hand panel, such as associated threats, attack vectors, events, and observables tied to that entity.

• Analysis Tab: It shows the reports where the selected entity has been observed. It helps analysts gain useful threat context and supports investigation by providing guidance based on documented intel.

• Indicators Tab: Displays the IOCs linked to the selected entity and related threats.
• Data Tab: Contains uploaded files/ exported reports related to the entity, useful for sharing intel in technical/ non-technical formats.
• History Tab: Tracks changes made to the entity, including updates to attributes and relationships.

4th question:

• On the OpenCTI dashboard, open Arsenal from the left panel and search for Cobalt Strike. After selecting it, go to the Knowledge tab. In the Intrusion Sets panel, the intrusion sets with a Good confidence level are CopyKittens and FIN7.

5th question:

• On the Overview tab, under Basic Information, the Author field shows the source of the intelligence. In this case, the author is The MITRE Corporation.

— — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

Task 6: Investigative Scenario

• As a SOC analyst, you have been tasked with investigations on malware and groups rampaging through the world. Your assignment is to look into the CaddyWiper malware and the APT37 group. Gather information from OpenCTI to answer the following questions.

6th question:

• In the Arsenal tab, searching for CaddyWiper and checking the Latest Reports about this entity section shows the earliest recorded data as 15/03/2022.

• 7th question:

• In the Knowledge tab for CaddyWiper, checking the Attack Patterns panel and looking at the Execution column shows that the attack technique used for execution is Native API.

8th question:

• In the Knowledge tab for the Native API attack technique, checking the Distribution of Relations section shows that it is associated with 113 malware relations.

9th question:

• In the Knowledge tab for the Native API attack technique, check the Tools panel and order for 2016. The tools used are BloodHound, Empire, and ShimRatReporter.

10th question:

• In the Arsenal tab, searching for APT37 and checking in the Description section shows that the associated country is North Korea.

11th question:

• Lastly, I checked the Attack Patterns panel under the Initial Access column. Although multiple techniques were listed, I noticed T1566 was the most prominent. Since the THM question required two specific answers, I used T1566 and then tested the other listed techniques until T1189 was accepted as the second answer.

— — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

[إِنْ أَحْسَنْتَ فَمِنَ اللَّهِ، وَإِنْ أَسْأْتَ فَمِنْ نَفْسِي وَالشَّيْطَانِ — اِذْكُرُونَا فِي صَالِحِ دُعَائِكُمْ]