Featured Advisory: Intelligence Requirements

The ZeroFOX Threat Intelligence Team would like to announce the addition of our customer-facing intelligence requirements. This will better facilitate transparency to our customers in the execution of our threat intelligence lifecycle, as well as providing an avenue for customers to provide input where they observe a potential gap or opportunity to better address their needs.

Discussion

Vision

Intelligence requirements are a vehicle by which ZeroFOX can focus our attention and effort to maximal and measurable effect. Intelligence requirements are clear, single focus questions that define a general intelligence need. They define a concept of what is needed as opposed to the specifics of how it is collected. As we roll out our product offerings, all of our CTI products and initiatives are going to tie directly back to one or more of these intelligence requirements.

ZeroFOX has grouped these intelligence requirements into seven categories: Personally Identifiable Information (PII) and Fraud; Deep/Dark Web and Criminal Underground; Brand; Vulnerabilities; Malware; Internet Infrastructure; and Geopolitical and Physical. Each of these categories has several requirements associated with them that we feel provides excellent coverage of the general threat landscape, and they will also be augmented by shorter-term priority intelligence requirements driven by urgent and time-limited initiatives such as high-risk vulnerabilities or on-demand investigations and requests for information.

Categories

This category of intelligence requirements focuses on capturing activities related to stealing personal data, such as Social Security numbers, credit card numbers , compromised account credentials, or potentially other sensitive data that could be used for impersonation, identity theft, fraud, doxxing, or social engineering campaigns.

Designation	Question
PII Packages	What stolen data packages are being sold, traded or released that contains customer data?
PII Doxxing	What sites, tools or data breaches are being used for doxxing or targeting against customers?
PII Sites	What locations are being used to buy or sell stolen or illicitly obtained data, such as PII or FI (financial information)?
PII Phishing	Who and what are the biggest phishing and fraud actors and Tactics, Techniques, and Procedures (TTPs)?
PII TTPs	How do adversaries attack and exfiltrate PII/FI to sell?
PII Social Engineering	What TTPs are being used to socially engineer or leverage our customer's employees as knowing or unknowing insider threats?

This category of intelligence requirements focus on actors and activities on deep web, dark web, covert communication channels or clearnet criminal underground sites. This collection effort examines both actors and victims, as well as the sites and campaigns they operate. This category also encompasses Ransomware.

Designation	Question
DDW Communications	Where are adversaries congregating and discussing TTPs?
DDW Ransomware	What is the most up to date list of active ransomware shame websites being used to publish victim data?
DDW Markets	What shops exist where adversaries can buy or sell illicit services or data related to other ZeroFOX Intelligence Requirements?
DDW Victims	Where are victims of malware and cybercriminal attacks discussed?
DDW Indirect Victims	What victims of malware and cybercriminal attacks can negatively impact our customers?

Brand Protection is one of ZeroFOX’s core competencies. To that end, we look to protect our customers and their brands, monitoring social media, impersonation, critical dissent and threats. We are capturing who, where, and how adversaries act to diminish the brand of our customers.

Designation	Question
BR TTPs	What are the most successful TTPs being used to target and impersonate brands?
BR Social Networks	What policies and procedures are social networks implementing that affect how adversaries target our customer's brands?

Vulnerability awareness is a critical component of any company’s risk management and security posture. While ZeroFOX does not generally perform internal exploit and vulnerability research, we do seek to be a one-stop provider to collate major published vulnerability write ups and enrich them to better assist our customers to maintain peak preparedness and vigilance.

Designation	Question
VULN Publication	What are the latest vulnerabilities being released publicly by vendors?
VULN Community	Which vulnerabilities and exploits are being discussed and prioritized by the security research & adversary communities?
VULN Exploitation	Which exploits are being discussed and prioritized by the security research & adversary communities?
VULN Customer	Which vulnerabilities have been detected and reported on ZeroFox customers' networks?

This category of requirements centers on malware campaigns and the broader context of the CTI attack lifecycle. Advanced Persistent Threats (APTs), e-crime, and malware-as-a-service issues fall under this domain.

Designation	Question
MAL Initial Access	What malware, adversaries and TTPs are being used to gain initial access to organizations?
MAL Pivoting	What malware, adversaries and TTPs are being used to pivot and escalate access within organizations?
MAL Exfiltration	What malware, adversaries and TTPs are being used to exfiltrate data from organizations?
MAL Ransomware	What malware, adversaries and TTPs are being used to ransomware organizations?
MAL Infrastructure	What infrastructure is being used to host, distribute, coordinate or provide failover for malware campaigns?

Not all components of an attack are localized. Virtualization, bulletproof hosting, DNS attacks, and supply chain attacks are potential blind spots if the focus is limited narrowly on local resources. We take a broader look at infrastructure vectors and monitor how they could potentially affect our customers.

Designation	Question
INF Registrars	What domain registrars typically host domains connected to malware, phishing or attack infrastructure?
INF Hosting	What Virtual Private Server (VPS) providers are most likely bulletproof hosters?
INF Exploitation	What vulnerabilities are currently being exploited in internet facing infrastructure?
INF TTPs	What are the TTPs of actors trying to breach internet facing infrastructure for downloading databases to sell?

Not all threats are limited to the virtual world. ZeroFOX constantly observes the geopolitical climate as it relates to our customers, as well as physical threats to their offices or employees.

Designation	Question
GEOP Events	What events or policies are affecting our specific customer's geographic areas of operation?
GEOP Risk	What physical TTPs are affecting our customer's cybersecurity and physical posture?
GEOP Disinformation	What active disinformation campaigns are our customer cohorts or geographic areas of operation facing?

Future Growth

However, there is always room for improvement, and in an effort to ensure that we appropriately address the needs of customers, external submissions will be accepted for consideration. Furthermore, in an effort to ensure that the requirements remain timely and relevant, the entire set will be actively curated and reviewed every quarter.

We are excited to begin this new initiative, and believe it is an excellent step in providing the best world-class coverage in our sector. We look forward to continuing to provide timely, meaningful, actionable, and far-reaching intelligence in a more improved, efficient, effective, and responsive way with these improvements.