Certified Threat Intelligence Analyst (CTIA) inkl. Examen

EC-Council CTIA (Certified Threat Intelligence Analyst) ist eine spezialisierte Cert für Threat Intelligence-Spezialisten in SOC, CSIRT und Threat Hunt-Teams. Themen: 1. Threat Intelligence-Foundations — Definitionen (Threat Intelligence = evidence-based knowledge about existing or emerging threats), 4 Stufen (Strategic für Executive-Level, Operational für SOC-Manager, Tactical für SOC-Analysten mit TTPs, Technical mit IoCs für Tools). 2. Threat Intelligence Lifecycle — 6 Phasen: Planning and Direction (Requirements von Stakeholders), Collection (OSINT, Dark Web, Vendor Feeds, Internal Logs), Processing (Normalization, Deduplication), Analysis (Cyber Kill Chain, MITRE ATT&CK Mapping, Diamond Model), Dissemination (Reports an Stakeholders), Feedback (Loop für Continuous Improvement). 3. Threat Actoren und Motivationen — Nation State (APTs Advanced Persistent Threats mit langer Persistence, hochkomplex, gut finanziert wie APT28 Fancy Bear/APT29 Cozy Bear/Lazarus Group/Volt Typhoon), Cybercrime (Profit-orientiert, Ransomware-Gangs wie Conti/LockBit/ALPHV/BlackCat), Hacktivists (Ideologisch wie Anonymous), Insider Threats (Malicious oder Negligent), Script Kiddies. 4. Sources of Threat Intelligence — OSINT (Open Source Intelligence — Shodan für exposed Devices, Censys, Maltego für Link-Analysis, Have I Been Pwned, VirusTotal, AbuseIPDB), Commercial Feeds (Mandiant, Recorded Future, CrowdStrike, Anomali, Flashpoint für Dark Web), Government Sources (CISA, BSI in DE, NCSC in UK), ISACs (Information Sharing and Analysis Centers branchenspezifisch), Threat Reports von Vendors. 5. Indicators of Compromise IoCs vs. Indicators of Attack IoAs — IoCs (Hash, IP, Domain, URL, Email, Registry Key, File Path — Hard to Change), IoAs (TTPs — Tactics, Techniques, Procedures — Pyramid of Pain). 6. MITRE ATT&CK Framework vertieft — Tactics (TA0001-TA0040), Techniques (T-IDs), Sub-Techniques. ATT&CK Navigator für Heatmap-Visualisierung. ATT&CK Evaluations für Tool-Vergleiche. 7. Cyber Kill Chain nach Lockheed Martin (Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, Actions on Objectives). 8. Diamond Model of Intrusion Analysis (Adversary, Capability, Infrastructure, Victim). 9. Threat Hunting — Hypothesis-Driven Hunting basierend auf TI, Tools (SIEM-Queries mit KQL/SPL, EDR-Logs, Network Traffic mit Zeek/Suricata). 10. Reporting — Strategic Reports für Executives (klar, knapp, business-orientiert), Tactical Reports für SOC mit IoCs/TTPs. Examen CTIA: 50 MC, 2h, 70% Pass.