Grey Noise | Work Smarter, Not Harder: How to Upgrade Your Threat Intel Program in 2023

Summary: GreyNoise added features to help threat intel teams move from simple indicators like IPs, domains, and hashes toward harder-to-change tactics, techniques, and procedures, citing David Bianco's Pyramid of Pain. The new IP Similarity feature clusters attacker activity by shared behavior such as HASSH and JA3 fingerprints, RDNs, user agents, and ports scanned, while IP Timeline shows an IP's activity against GreyNoise sensors over the past thirty days.
Key Takeaway: The pitch rests on a real trade-off: TTP-level indicators take more time to derive than an IP or hash, and the timeline is meant to show whether an attacker is running an automated process or working by hand. A program that never gets past IPs and hashes is denying adversaries the least painful indicators to change.

Read the original at GreyNoise Blog ↗