>> Hello and welcome to the new module,
call it campaign analysis.
This is a first lesson,
and it will be an introduction to campaigns.
In this lesson, we will discuss how patterns are
identified and how intrusion correlation is done.
We will introduce as well some techniques and
methods that can be for campaign analysis.
But before this, let's start by defining campaigns.
A campaign is a set of incidents that occur over
a specific time period that
relate to each other by shared indicators,
tools and infrastructure, or TTPs,
which indicated that there were
performed by the same intrusions set,
threat actors and or have a shared objective.
For instance, to be able to build a campaign analysis,
we need intelligence gathered from
multiple intrusions over an extended period of time.
This requires from analysts to
notice trends in intrusions.
But here, a common question is,
where to start a campaign analysis?
When we are dealing with an incident,
it's important to keep reports with full details,
including indicators because they may
serve in the future for a campaign analysis,
it all starts with noticing a trend between intrusions.
Then after looking into the past reports,
we should be able to find
sufficient data, especially key indicators.
The key indicators should
remain consistent across intrusions.
This is really important.
Here comes the role of
external intelligence that we
collected from multiple sources,
including [inaudible] [inaudible],
vendors and resources.
Searching for key indicators will help the analysts to
identify whether the trend
is targeting a specific sector,
country or probably targeting only the organization.
Also comparing key indicators and
the TTPs will help in identifying the adversaries.
I only have one new recommendation here.
When dealing with external reports,
please don't mix them with your internal data
because there is always
the risk of misleading the analysis.
The next step, we require
leveraging techniques for analysis to
identify patterns and based on the output results,
you can apply the most appropriate course of action.
It's also important to mention
that understanding patterns and intrusions correlation to
define a campaign refines the ability to
anticipate what future intrusions will look like.
Keep in mind that even
unsuccessful intrusions are useful in
these cases because it's very
likely that adversaries will try them again.
Now, let's move to the techniques and
methods that can be used for campaign analysis.
The message that we studied in the previous module
are still valid as campaign analysis techniques,
they may be extended to
support correlation between intrusions.
The first technique is ACH,
and here we replace
the hypothesis by campaign hypothesis.
We identify candidates campaigns for correlations.
Of course, these are the ones which
have the most key indicators and TTPs.
The key indicators and TTPs are considered the evidence,
the position against campaigns as hypothesis.
Here, another example that we've seen previously,
and it is the mapping of Cyber Kill
Chain and Diamond Model here as well.
We don't take all the possible insurance,
but the only ones with
the most key indicators and
we correlate them based on these indicators.
The techniques and methods that we studied in
the intrusion analysis cases are still valid,
but there are also techniques that
are proper to campaign analysis,
which are data analysis,
temporal analysis or visual analysis,
and the heat map analysis.
We will go in details with some
of these methods in future videos.
This is all for this lesson.
It was a quick introduction to
the module campaign analysis.
We started the lesson with a definition of campaign.
We've seen where to start campaign analysis.
We also discover the previously seen techniques are
still valid for a campaign analysis and we discover
the new methods and techniques that can be
used for campaign analysis and which we
are going to discover in
future videos belonging to this module as well.
In the next video, we'll start
the first technique dedicated to campaign analysis,
which is a heat map analysis.