Data-Driven Threat Hunting Using Sysmon

Sharing of Cyber Threat Intelligence (CTI) has turned out to be an indispensable pillar of the modern cybersecurity landscape, it is enabling organizations to defend against the evolving threats. In this white paper, we will discuss the strategies to optimize the sharing of threat intelligence across multiple security platforms in the enterprise and community context. We will observe the current standards and practices, like Structured Threat Information eXpression (STIX) and trusted Automated Exchange of Indicator Information (TAXII) protocols, and also examine the role of these standards in integrating the Threat Intelligence Platforms (TIPs) with Security Information and Event Management (SIEM) systems. We will observe the impact of threat intelligence exchange through real-world case studies and how the cybersecurity attacks are mitigated, along with the challenges that are encountered (e.g., technical integration gaps, data overload, trust and privacy issues). We will also discuss the limitations in the current approaches, which include the inconsistent adoption of the standards, there is a prevalence of indicators with low context, and siloed systems that impede the information flow. The landscape of the emerging solutions, the future directions will be explored, machine learning prioritized to reduce the false positives, a decentralized sharing architecture by leveraging blockchain and federated learning for privacy, and also trust frameworks to incentivize collaboration. Through addressing the present challenges and leveraging the advanced technologies, organizations will be able to create a unified and effective threat intelligence sharing ecosystem that will strengthen the collective cyber defense.

Today’s threats use multiple means of propagation, such as social engineering, email, and application vulnerabilities, and often operate in different phases, such as single device compromise, lateral network movement, and data exfiltration. These complex threats rely on advanced persistent threats supported by well-advanced tactics for appearing unknown to traditional security defenses. As organizations realize that attacks are increasing in size and complexity, cyber threat intelligence (TI) is growing in popularity and use. This trend followed the evolution of advanced persistent threats, as they require a different level of response that is more specific to the organization. TI can be obtained via many formats, with open-source intelligence one of the most common, and using threat intelligence platforms (TIPs) that aid organizations to consume, produce, and share TI. TIPs have multiple advantages that enable organizations to quickly bootstrap the core processes of collecting, analyzing, and sharing threat-related information. However, current TIPs have some limitations that prevent their mass adoption. This article proposes AECCP, a platform that addresses some of the TIPs limitations. AECCP improves quality TI by classifying it accordingly a single unified taxonomy , removing the information with low value, enriching it with valuable information from open-source intelligence sources, and aggregating it for complementing information associated with the same threat. AECCP was validated and evaluated with three datasets of events and compared with two other platforms, showing that it can generate quality TI automatically and help security analysts analyze security incidents in less time.

This paper presents a comprehensive survey of the applications, challenges, and limitations of Generative AI (GenAI) in enhancing threat intelligence within cybersecurity, supported by real-world case studies. We examine a wide range of data sources in Cyber Threat Intelligence (CTI), including security reports, blogs, social media, network traffic, malware samples, dark web data, and threat intelligence platforms (TIPs). This survey provides a full reference for integrating GenAI into CTI. We discuss various GenAI models such as Large Language Models (LLMs) and Deep Generative Models (DGMs) like Variational Autoencoders (VAEs), Generative Adversarial Networks (GANs), and Diffusion Models, explaining their roles in detecting and addressing complex cyber threats. The survey highlights key applications in areas such as malware detection, network traffic analysis, phishing detection, threat actor attribution, and social engineering defense. We also explore critical challenges in deploying GenAI, including data privacy, security concerns, and the need for interpretable and transparent models. As regulations like the European Commission’s AI Act emerge, ensuring trustworthy AI solutions is becoming more crucial. Real-world case studies, such as the impact of the WannaCry ransomware, the rise of deepfakes, and AI-driven social engineering, demonstrate both the potential and current limitations of GenAI in CTI. Our goal is to provide foundational insights and strategic direction for advancing GenAI’s role in future cybersecurity frameworks, emphasizing the importance of innovation, adaptability, and ongoing learning to enhance resilience against evolving cyber threats. Ultimately, this survey offers critical insights into how GenAI can shape the future of cybersecurity by addressing key challenges and providing actionable guidance for effective implementation.

Cyber Threat Intelligence (CTI) plays a crucial role in cybersecurity risk management, providing valuable insights to organisations for threat identification and mitigation. The continuous and rapid increase of CTI volume, velocity, and variety requires a systematic approach to assessing their quality, operational significance, and actionable contribution. Threat Intelligence Platforms (TIPs) underpin the sharing and analysis of CTI, enabling organisations to collaborate and enhance their defensive measures ensuring the intelligence shared is effective and reliable for mitigating cyber threats. The assessment of CTI demands a detailed and comprehensive consideration of various factors addressing important quality and operational properties, such as their extensive approach, accuracy, timeliness, and standardisation. Drawing upon the MISP data model, this study defines quantifiable quality metrics based on simple mathematical equations. In addition, this study defines 2 approaches for weighting those criteria based on a subjective (fuzzy-Analytic Hierarchy Process) and an objective (Entropy-based) approach. Current CTI evaluation practices either lack standardized, comprehensive and quantifiable quality metrics or fail to balance subjective expert judgment with objective data variability. Moreover, existing models rarely integrate with operational platforms, limiting their practical applicability. This study addresses these gaps by proposing a framework that formally defines quality metrics, applies dual weighting mechanisms, and supports prioritization directly within a TIP context. By integrating quantifiable quality equations based on the MISP data model with diverse weighting approaches, this proposal enables researchers and practitioners to systematically assess and prioritize trustworthy, high-quality CTI. The dual weighting strategy allows organizations to flexibly adapt evaluations either to subjective expert-driven priority settings, or to objective, data-driven ones, depending on operational needs and available contextual knowledge. This approach facilitates informed decision-making, enhancing the organisation’s cybersecurity posture and resilience against evolving threats. This paper illustrates the potential of the proposed approach as well as demonstrates its benefits by implementing a proof of concept technical implementation on real Open Source Intelligence data, showcasing its utility in underpinning cybersecurity measures and facilitating threat response strategies.

In this paper we present CloudWall, a Cloud-enabled Resilience Framework specially tailored for the needs of the healthcare IT infrastructures. This framework will increase the
\ncapability of these infrastructures to prevent and react to cyber attacks. Starting from a risk analysis model based on multi-layer networks, CloudWall will allow to design and implement infrastructure deployments which are more resilient to cyber threats, and specially to malware spread, enforcing good practices in critical infrastructure IT design, such as isolated attack paths and hardware/software diversity in component deployment. The same risk analysis model will help to enhance threat detection using state-of-the-art technologies, like Security Information and Event Management Systems (SIEM). Finally, by deploying components and network elements in a virtualized private-cloud infrastructure when possible, it will leverage recent advances in container-based computing and network function virtualization (NFV) to allow the infrastructure (including both computation and networking assets) to reconfigure itself in the event of a
\nsecurity incident so that the risk of further damage is mitigated.

Cybersecurity threats are rising in frequency and sophistication, which calls for the enhancement of better, real-time threat detection systems. This paper introduces a cyber threat intelligence (CTI) platform that combines a deep learning-based detection model with real-time log analysis with the utilization of security information and event management (SIEM) systems. A deep neural network trained with stochastic gradient descent (SGD) is at the heart of the proposed gadget, which uses log data to detect malicious activity. Logs are collected and consumed from the Wazuh platform, permitting real-time correlation and possibility tracking. A tailored dashboard presents a friendly interface for visualizing alerts and designs. The suggested structure mixes detection precision, machine scalability, and functioning responsiveness in changing network environments. Experimental outcomes demonstrate that the model is highly accurate and responsive in determining dangers, structuring its feasibility for real-time business environments.

Computer security incident response teams typically rely on threat intelligence platforms for information about sightings of cyber threat events and indicators of compromise. Other security building blocks, such as Network Intrusion Detection Systems, can leverage the information to prevent malicious adversaries from spreading malware across critical infrastructures. The effectiveness of threat intelligence platforms heavily depends on the willingness to share among organizations and the responsible use of sensitive information that may potentially harm the reputation of the reporting organization. The challenge that we address is the lack of trust in the source providing the threat intelligence and the information itself. We enhance our security framework TATIS—offering fine-grained protection for threat intelligence platform APIs—with distributed ledger capabilities to enable reliable and trustworthy threat intelligence sharing with the ability to audit the provenance of threat intelligence. We have implemented and evaluated the feasibility of our distributed framework on top of the Malware Information Sharing Platform (MISP) solution, and we evaluate the performance impact using real-world open-source threat intelligence feeds.

Cyber-attack is one of the significant threats affecting to any organisation specifically to the Critical Infrastructure (CI) organisation. These attacks are nowadays more sophisticated, multi-vectored and less predictable, which make the Cyber Security Risk Management (CSRM) task more challenging. Critical Infrastructure needs a new line of security defence to control these threats and minimise risks. Cyber Threat Intelligence (CTI) provides evidence-based information about the threats aiming to prevent threats. There are existing works and industry practice that emphasise the necessity of CTI and provides methods for threat intelligence and sharing. However, despite these significant efforts, there is a lack of focus on how CTI information can support the CSRM activities so that the organisation can undertake appropriate controls to mitigate the risk proactively. This paper aims to fill this gap by integrating CTI for improving cybersecurity risks management practice specifically focusing on the critical infrastructure. In particular, the proposed approach contributes beyond state of the art practice by incorporating CTI information for the risk management activities. This helps the organisation to provide adequate and appropriate controls from strategic, tactical and operational perspectives. We have integrated concepts relating to CTI and CSRM so that threat actor's profile, attack detailed can support calculating the risk. We consider smart grid system as a Critical Infrastructure to demonstrate the applicability of the work. The result shows that cyber risks in critical infrastructures can be minimised if CTI information is gathered and used as part of CSRM activities. CTI not only supports understanding of threat for accurate risk estimation but also evaluates the effectiveness of existing controls and recommend necessity controls to improve overall cybersecurity. Also, the result shows that our approach provides early warning about issues that need immediate attention.

The continuous improvement of the cyber threat intelligence sharing mechanism provides new ideas to deal with Advanced Persistent Threats (APT). Extracting attack behaviors, i.e., Tactics, Techniques, Procedures (TTP) from Cyber Threat Intelligence (CTI) can facilitate APT actors’ profiling for an immediate response. However, it is difficult for traditional manual methods to analyze attack behaviors from cyber threat intelligence due to its heterogeneous nature. Based on the Adversarial Tactics, Techniques and Common Knowledge (ATT&CK) of threat behavior description, this paper proposes a threat behavioral knowledge extraction framework that integrates Heterogeneous Text Network (HTN) and Graph Convolutional Network (GCN) to solve this issue. It leverages the hierarchical correlation relationships of attack techniques and tactics in the ATT&CK to construct a text network of heterogeneous cyber threat intelligence. With the help of the Bidirectional Encoder Representation from Transformers (BERT) pretraining model to analyze the contextual semantics of cyber threat intelligence, the task of threat behavior identification is transformed into a text classification task, which automatically extracts attack behavior in CTI, then identifies the malware and advanced threat actors. The experimental results show that F1 achieve 94.86% and 92.15% for the multi-label classification tasks of tactics and techniques. Extend the experiment to verify the method’s effectiveness in identifying the malware and threat actors in APT attacks. The F1 for malware and advanced threat actors identification task reached 98.45% and 99.48%, which are better than the benchmark model in the experiment and achieve state of the art. The model can effectively model threat intelligence text data and acquire knowledge and experience migration by correlating implied features with a priori knowledge to compensate for insufficient sample data and improve the classification performance and recognition ability of threat behavior in text.

Phishing campaigns are becoming more sophisticated, using encrypted communication platforms like telegram to coordinate their activities and store stolen information. This paper introduces a structured and scalable framework that supports cyber threat intelligence (CTI) efforts in monitoring malicious telegram channels linked to phishing activity.The framework is based on a combination of machine learning and human expertise, and it leverages a large dataset of telegram messages and their corresponding labels to train and evaluate the performance of the model. The methodology involves four interconnected stages: extracting hidden artifacts from phishing code, gaining unauthorized access to private telegram groups, analyzing collected data automatically, and implementing counterintelligence measures to prevent detection. Initial findings validate the framework's ability to detect indicators of compromise (IoCs) and visualize the attacker's infrastructure. Additional functionalities like integration with threat intelligence platforms and artificial intelligence-based data enrichment enhance the framework's versatility and usefulness. This method improves proactive communication monitoring, providing a secure and flexible solution for tracking adversarial communication channels.

Ever enhancing computational capability of digital system along with upgraded tactics, technology and procedure (TTPs) enforced by the cybercriminals, does not match to the conventional security mechanism for detection of intrusion and prevention of threat in current cyber security landscape. Integration of artificial intelligence, machine learning and cyber threat intelligence platform with the signature-based threat detection models like intrusion detection system (IDS), SNORT, security information and event management (SIEM) which are being primarily implemented in the network for continuous analysis of the indicator of compromise (IoC) becomes inevitable, for prompt identification of true events and subsequent mitigation of the threat. In this paper, author illustrated the approach to integrate artificial intelligence and machine learning with the cyber threat intelligence for the collection of actionable threat intelligence from various sources like dark web, hacker’s forum, hacker’s assets, honeypot, etc. Furthermore, the application of threat intelligence in the aspect of cyber security has been discussed in this paper. Finally, a model has been proposed for generating actionable threat intelligence implementing a supervised machine learning approach employing Naive Bayes classifier.

Security Information and Event Management (SIEM) systems collect security information from multiple input systems, with a view to correlating and interpreting events so as to conduct security analysis and inference. Our analysis of large SIEM event sets has shown that in many instances the source events also contain personal information resulting from activities performed by users. The treatment of privacy in such ‘meta-systems’ is a challenging and, as yet, largely unaddressed consideration in privacy debates. This paper uses the 2012 EU Draft Data Protection Regulation as a basis to develop a view of its implications for SIEMs and other meta-systems. Providers of SIEM services have an obligation to ensure that their ‘meta-systems’ adhere to the same requirements as other systems, and the complexity can be compounded if the SIEM is not located in the same country as the originating events. Recommendations for role clarification, notification requirements, anonymisation and data protection officer oversight activities are presented – with respect to requirements of the associated privacy specifications. By adhering to these privacy specifications, security objectives can be achieved while ensuring that the rights of individuals and obligations, in terms of data privacy requirements, are met even when centralised security events and other types of meta-data, are collected.KeywordsSIEMPrivacyData protectionEuropean UnionRegulationDirective

This thesis focuses in the evaluation of Threat Intelligence Platforms (TIPs). TIPs are security tools that use global
\nsecurity data to help proactively identify, mitigate and remediate security threats. New and continually evolving
\nsophisticated threats are surfacing every day making the processes of detection and mitigation far more complicated
\nthan some years ago. So it’s obvious that the need for more and more intelligent security tools has become
\nimperative. Thus, organizations were encouraged to change their traditional defence models and to use and to
\ndevelop new systems with a proactive approach. Such changes are necessary because the old approaches are not
\neffective anymore to detect advanced attacks. Also, the organizations are encouraged to develop the ability to
\nrespond to incidents in real-time using complex threat intelligence platforms.
\nThis thesis is separated in three big sections. In the beginning we are going to discuss what threat intelligence is and
\nhow it is used by researchers and organisations. Subsequently a concise analysis and description of four open source
\nand widespread TIPs will be presented. The platforms I chose are: MISP (Malware Information Sharing
\nPlatform), OpenCTI (Open Cyber Threat Intelligence Platform), CIF (Collective Intelligence Framework) and
\nCRITs (Collaborative Reasearch Into Threats). Finally, at the last section I will present the evaluation of these
\nplatforms according to specific criteria along with some key findings and limitations that extracted from the analysis.

The increasing sophistication and frequency of cyberattacks necessitate advanced and transparent decision-making frameworks for threat intelligence and risk assessment. While artificial intelligence (AI) has demonstrated significant potential in automating threat detection, predicting attack patterns, and prioritizing incident response, the opaque nature of many AI models particularly deep learning poses challenges in trust, interpretability, and regulatory compliance. This paper presents an Explainable AI (XAI)-driven framework for enhancing Cyber Threat Intelligence (CTI) and risk assessment, enabling security analysts to understand, validate, and act upon AI-generated insights with confidence. The proposed approach integrates state-of-the-art machine learning algorithms with model-agnostic and model-specific interpretability techniques, such as SHapley Additive exPlanations (SHAP), Local Interpretable Model-agnostic Explanations (LIME), Layer-wise Relevance Propagation (LRP), and attention-based visualization. The framework processes diverse CTI data sources including network traffic logs, vulnerability feeds, malware signatures, and open-source intelligence (OSINT) to identify malicious patterns, quantify risks, and generate actionable intelligence. By coupling predictive accuracy with transparency, the system not only improves detection and classification of advanced persistent threats (APTs), phishing campaigns, and zero-day exploits, but also facilitates compliance with emerging AI governance frameworks, such as the EU AI Act and NIST AI Risk Management Framework. Experimental evaluations on benchmark cybersecurity datasets demonstrate that the XAI-enabled models maintain high precision and recall while offering interpretable outputs that significantly reduce analyst decision latency and improve collaborative threat response. The paper further discusses the role of XAI in mitigating bias, enhancing accountability, and fostering human–machine teaming in security operations centers (SOCs). Practical implementation considerations including scalability, computational efficiency, and integration with existing Security Information and Event Management (SIEM) platforms are addressed, along with recommendations for future research in multi-modal XAI for cybersecurity. This research underscores the critical value of explainability in AI-driven CTI, ensuring that automated systems are not only effective but also transparent, trustworthy, and aligned with organizational and regulatory requirements for responsible AI deployment in cyber defense.

The chapter considers a simulation-based approach to analysis of network resilience to botnet attacks in security information and event management (SIEM) systems, which can be applied to distributed geographic information systems (GISs). On the other hand, SIEM systems can use GIS technology for network awareness, taking into account the geographical location of hosts and network segments. To be able to protect the network against botnet attacks, it is necessary to investigate the processes occurring on all stages of the botnet lifecycle (propagation, control, and attack). The suggested approach can detect the critical nodes in the network, as well as determine and evaluate the protection mechanisms against botnet attacks. We propose the architecture of the dynamic attack simulation component (DASC) and describe its interaction with other SIEM components. The component prototype is presented and results of the implemented experiments are discussed.