Beyond IOCs: AI-enabled threat intelligence
The cybersecurity industry is increasingly exploring the potential of artificial intelligence (AI) to enhance threat intelligence, moving beyond traditional indicators of compromise (IOCs) to derive deeper insights from unstructured data. While AI is often viewed as a double-edged sword, empowering both attackers and defenders, its application in managing and analyzing threat intelligence offers significant advantages for security professionals.
Current methods for disseminating threat intelligence often focus on tactical IOCs, which are easily integrated into data stores and enriched with context in formats like STIX/MISP. However, to enable effective responses, consumers of threat intelligence need to develop a comprehensive understanding of a threat's relevance to their specific environment and available resources. This requires the contextual information found in strategic and operational intelligence briefings.
These natural language reports, while rich in context, are notoriously difficult to index and cross-reference. Disparate sources like incident reports, darknet monitoring, and malware analysis often lack effective links, further complicated by inconsistent naming conventions for threat actors. This fragmentation hinders the ability to build a complete picture of the threat landscape.
Large language models (LLMs) present a potential solution to this challenge. Although these AI models do not possess true understanding, they can identify synonyms and connect entities across massive, unstructured datasets. This capability can streamline the retrieval of relevant threat intelligence reports and facilitate the generation of tailored protective advice.
However, challenges remain. Vigilance is required regarding the accuracy of data fed into LLMs and the confidentiality of queries made to these systems. Nevertheless, the development of personalized, domain-specific LLMs could lead to a future of integrated threat intelligence, where relevant information from various sources is readily accessible, and specific guidance can be provided even for vague inquiries.
Instead of fearing AI's impact on employment, the industry can embrace its development as a tool to improve access to threat intelligence and accelerate the delivery of actionable advice. Ultimately, AI can empower security professionals to perform their core functions more effectively, making adversaries' operations more difficult.
In a separate development, Cisco Talos is highlighting the increasing use of the Component Object Model (COM) by Windows threats for malicious activities. COM, a legitimate Windows technology for inter-process communication, is being exploited by malware families such as Qakbot and WarmCookie for lateral movement, persistence, and evasion. The opaque nature of COM, with its GUIDs and indirect vtable calls, obscures attacker intent and makes manual analysis time-consuming.
Threat actors favor COM because it provides access to built-in Windows functionalities while presenting a significant hurdle for static analysis. By embedding malicious behavior behind indirect function calls, attackers can bypass basic scrutiny and blend in with legitimate system processes, effectively turning Windows' own architecture against itself. Security analysts who do not prioritize COM during triage may miss critical elements of an infection chain. Defenders are advised to enhance their skills in recognizing COM usage and translating evidence like ProgIDs and vtable offsets into actionable intelligence. Specialized tools such as OleView.NET, IDA’s COM Helper, and DispatchLogger can help map indirect calls to specific behaviors. Security teams should also develop static hunting logic to track these threats, with simplified YARA hunting rules for binaries referencing the Task Scheduler COM class available in the full blog post.
