Writing · Tag

Posts tagged threat-intelligence

2 posts .

Mandiant APT1

22 February 2013

Mandiant's APT1 report landed on Tuesday. The most operationally substantial piece of public attribution work the security industry has produced. The structural significance is that we now have an attribution framework that does not stop at "this is a state actor".

apt1 attribution china mandiant pla-unit-61398 threat-intelligence

Detection content

16 July 2012

Six weeks of writing detection content for the Hedgehog SOC build. The technical innovation pool is shallower than the press coverage suggests; six categories cover most of what shows up.

detection kill-chain soc threat-intelligence training ttps