Pivoting on C2 IP addresses and using URLs to expose threat actors' infrastructure are two techniques for collecting cyber threat intelligence

The text outlines five techniques for collecting cyber threat intelligence. The first technique involves pivoting on С2 IP addresses to pinpoint malware, leveraging threat intelligence databases like Threat Intelligence Lookup from ANY.RUN to gather essential information

The second technique focuses on using URLs to expose threat actors' infrastructure, identifying patterns in domains and subdomains to uncover broader infrastructure used in attacks. The third technique involves identifying threats by specific MITRE TTPs, utilizing the MITRE ATT&CK framework to proactively build knowledge about emerging threats. The fourth technique covers collecting samples with YARA rules, using YARA to automate the detection of known malware families and find new variants. Lastly, the fifth technique discusses discovering malware through command line artifacts and process names, a unique approach facilitated by ANY.RUN's live sandbox sessions for accessing real-time data to understand the threats faced.
https://thehackernews.com/2024/10/5-techniques-for-collecting-cyber.html