Recommended Tools
Investigation Steps
- 1
Identify indicators of compromise (IOCs)
- 2
Search threat intelligence databases and feeds
- 3
Analyze dark web forums and leak sites
- 4
Correlate findings with known threat actors
- 5
Document TTPs and create threat reports
Quick Wins
- Check email addresses and domains in breach databases
- Monitor threat intelligence feeds for emerging threats
- Use MISP to share and correlate threat indicators