CuraSec

tag: Threat-Intelligence · 6 items

Learn DisCTI: ML-Based Automated Sector Routing for Cyber Threat Intel
2026-08-31 · arXiv cs.CR · source ↗ #threat-intelligence#machine-learning#cti
  • Engineer — Skip
  • SOC/IR — Learn: The finding that 98% of MISP events lack sector tagging quantifies a real operational gap in shared CTI value; the BERT-based approach achieving F1 0.89 for sector routing is worth tracking as a future tooling direction for CTI triage workflows.
  • Leader — Learn: The statistic that nearly all shared CTI events go uncategorized by sector is a useful benchmark for conversations about the operational return on threat intel program investments; no action is required now, but it frames the value case for better-structured intel feeds.
Learn archived Reproducible Pipeline for Labeling Illicit Bitcoin Addresses from HackForums
2026-08-17 · arXiv cs.CR · source ↗ #cryptocurrency#threat-intelligence#research
  • Engineer — Skip
  • SOC/IR — Learn: A dataset of 2,438 verified illicit Bitcoin addresses with HackForums provenance and cybercrime category labels could enrich threat intel feeds or wallet-screening tooling; no immediate detection action required, but worth evaluating the released dataset for integration.
  • Leader — Skip
Learn archived TTP-R1: RL-Driven ATT&CK Technique Extraction from CTI Text
2026-08-10 · arXiv cs.CR · source ↗ #threat-intelligence#mitre-attack#machine-learning
  • Engineer — Skip
  • SOC/IR — Learn: TTP-R1 automates mapping CTI prose to ATT&CK (sub-)techniques with meaningful F1 gains over LLM baselines; worth tracking if your team annotates CTI at scale, but no detection or hunt action follows from this research paper alone.
  • Leader — Skip
Learn archived Unit 42: Identity-Based Attacks Drive 90% of SOC Incidents
2026-08-09 · Unit 42 · source ↗ #identity#soc#threat-intelligence
  • Engineer — Skip
  • SOC/IR — Learn: Unit 42’s analysis of identity-based attack patterns offers context for triage judgment and detection prioritization, though no specific IOCs or new TTPs are surfaced in the summary.
  • Leader — Learn: The 90% statistic is a potential board-deck data point, but without independent corroboration of the underlying methodology this is vendor-sourced framing rather than actionable risk input.
Learn archived Google Threat Intelligence Group adopts unified actor naming schema
2026-07-25 · Google Threat Intelligence · source ↗ #threat-intelligence#attribution#taxonomy
  • Engineer — Skip
  • SOC/IR — Learn: GTIG is merging Mandiant and TAG naming systems into a cryptonym-based taxonomy; analysts should update internal runbooks and intel mappings to cross-reference old identifiers (e.g. APT numbers) with new names as GTIG rolls out the change.
  • Leader — Skip
Learn archived Unit 42 2026 Global Incident Response Report: AI & Automation Trends
2026-07-17 · Unit 42 · source ↗ #incident-response#ai-security#threat-intelligence
  • Engineer — Skip
  • SOC/IR — Learn: Unit 42’s IR report covers AI-assisted attack patterns and automation trends observed across real incidents; useful for calibrating triage judgment and updating mental models of adversary tempo, but no specific IOCs or detections to act on now.
  • Leader — Learn: Annual IR benchmarking data from a major vendor is useful for board deck context and budget justification around AI-related threat trends, though it should be weighed against independent corroboration given the Palo Alto source.