domains / families / security / correlating-threat-campaigns

correlating-threat-campaigns

separate

'Correlates disparate security incidents, IOCs, and adversary behaviors

When to use

• Multiple unrelated-appearing incidents share IOCs (same C2 IP, same malware hash, similar TTPs)
• An ISAC partner shares indicators from an incident that match your own historical events
• Building a campaign report linking adversary activity over weeks or months to a single operation

When not to use

• forcing correlation based on weak signals

Skill page

Source