Pivot methods
As we saw in Chapter 7, Technical Threat Analysis – Enrichment, it's good to think about performing pivots based on the capabilities of the attacker, specifically focusing on files, capabilities, tools, and infrastructure. While there are other attributes, data points, and capabilities to pivot from and on, for the sake of brevity, we will be focusing exclusively on file, capabilities, and infrastructure pivots due to the amount of intelligence that can be generated for analyzing both data types.
Malicious infrastructure pivots
As we analyzed in Chapter 7, Technical Threat Analysis – Enrichment, there are several data sources available for analysis and enrichment: DNS, WHOIS, and PassiveTotal DNS data. We examined many data attributes in the last chapter that can be used to derive intelligence from. In the case of threat actor infrastructure, many of those same data points and attributes can be used to pivot and look for related malicious infrastructure...
