Threat intelligence is the knowledge-based approach to understanding adversaries, their capabilities, and their intentions through the systematic collection, analysis, and dissemination of threat data. It transforms raw security data into actionable insights that enable organizations to anticipate attacks, prioritize defenses, and respond faster to incidents. Unlike reactive security measures that wait for alerts, threat intelligence builds a proactive posture by mapping the threat landscape to your specific environment. At its core, effective threat intelligence answers three questions: who is targeting you, how they operate, and what you should do about it—making it the bridge between data and decision-making that defines modern security operations.
What This Cheat Sheet Covers
This topic spans 15 focused tables and 107 indexed concepts. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.
Table 1: Indicator Types
Indicators of compromise are the concrete fingerprints a defender watches for — the hashes, addresses, and artifacts that betray malicious activity. They're not all equally valuable: a file hash or IP is trivial for an attacker to swap out, whereas behavioral fingerprints like mutexes, JA3/JA4 TLS signatures, and YARA rules cut deeper into how the malware actually works and are far harder to change.
| Type | Example | Description |
|---|---|---|
5d41402abc4b2a76b9719d911017c592 | • 128-bit cryptographic hash of a file • fast but collision-prone, widely used for malware identification despite security weaknesses | |
aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d | • 160-bit hash offering better collision resistance than MD5 • still widely seen but deprecated for security-critical use since 2017. | |
2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae | • Industry-standard 256-bit hash providing strong collision resistance • preferred for modern threat intel and digital forensics | |
| 192021 | • 32-bit network address identifying a host or C2 server • easily rotated by attackers but essential for network-level blocking. | |
2001:0db8::1 | • 128-bit address space enabling virtually unlimited IPs • adoption growing but less commonly tracked in legacy threat feeds | |
malicious-site.example | • Human-readable DNS name resolving to IP addresses • attackers use domain generation algorithms (DGAs) to evade static blocks | |
https://phish.example/login?id=x | • Full web address including protocol, domain, path, and parameters • high specificity but easy for attackers to change | |
attacker | • Sender identity in phishing campaigns • spoofable but useful for tracking campaign infrastructure and actor attribution |