What Is Cyber Threat Intelligence (CTI)?

CISA advisory AA23-144A, published 24 May 2023, contains this command line, attributed to a PRC state-sponsored actor on a domain controller:

"cmd.exe" /c wmic process call create "cmd.exe /c mkdir C:\windows\Temp\McAfee_Logs & ntdsutil \"ac i ntds\" ifm \"create full C:\Windows\Temp\McAfee_Logs\""

That line is intelligence. It changed what a detection engineer writes on Monday. The IP addresses in the same advisory are data. Most were dead before the PDF was opened, and no rule changed because of them.

Cyber threat intelligence is information about adversaries that changed a decision you were going to make anyway. Everything that did not change a decision is a feed.

The production cycle, briefly

CTI borrows its process from government intelligence work. Six stages:

1. Direction. Someone states what they need to know and why.

2. Collection. Data is gathered against that statement.

3. Processing. Raw data is normalised, deduplicated, parsed.

4. Analysis. A human decides what it means and how sure they are.

5. Dissemination. The judgement reaches whoever has to act on it.

6. Feedback. That person says whether it helped, which rewrites direction.

Every vendor deck draws this as a clean loop. It is not one. Stage 6 gets skipped, so stage 1 never updates, so stage 2 collects last year's requirement forever. To audit a CTI function, ask for the current requirements document and the date it last changed. If neither exists, it is a collection pipeline wearing an intelligence label.

Requirements come first or collection is noise

A detection team's requirement is not "tell us about ransomware". It is a question with a decision attached. Compare:

• Bad: monitor threats to the financial sector.

• Good: which credential access techniques are used against Windows domain controllers by actors that deploy no custom malware, and do we log process command lines on every DC to see them.

The second forces an action. Either 4688 carries command lines on your DCs or it does not. Either the technique is in your rule set or it is not.

Requirements also make it legitimate to refuse collection. Without them every source looks equally worth ingesting, and a CTI programme with no stated requirements produces a firehose nobody reads. The tell is a Slack channel with a bot posting report links and zero replies for three months.

The three levels

Strategic intelligence answers questions about risk and investment on a horizon of quarters. Which actor sets target our sector, what they want, how their tooling trends. Consumers approve budget and headcount. A strategic product containing a file hash has confused its audience.

Operational intelligence covers campaigns and tradecraft on a horizon of weeks. Which tools an actor reaches for, in what order, against which entry points. Hunt teams live here. AA23-144A is an operational product: it describes a way of working, not one event.

Tactical intelligence is the artifact layer. Command lines, file paths, registry keys, hashes, domains, JA3 strings. Perishability runs opposite to usefulness. A hash is precise and dies in days. Ntdsutil IFM on a domain controller is fuzzier and has held for over a decade.

Four ways CTI programmes fail

Buying a feed and calling it intelligence. A feed is stage 2 of six. Nobody stated a requirement, nobody analysed anything, and confidence came from whatever scraper produced the row. Not useless, just unfinished.

IOC lists with no expiry. An indicator without a validity window rots in place and inflates both your exception lists and your alert volume. Both major formats give you the field. STIX 2.1 Indicator objects carry a required valid_from and an optional valid_until. MISP ships a retention taxonomy whose stated job is removing the IDS flag from ip-dst and ip-src attributes once the configured time elapses. Skip these and you end up blocking an address that was a C2 relay in 2023 and is a CDN edge now.

Reports with no relevance filter for your estate. A 40-page advisory about an appliance you do not own is not intelligence for you. The filter is asset inventory, which means most CTI relevance problems are really inventory problems.

Confidence with no stated scale. "High confidence" without a named scale communicates a mood. Appendix A of the STIX 2.1 specification exists purely to map human scales onto the numeric confidence property, including Admiralty credibility from FM 2-22.3 and Words of Estimative Probability. MISP's estimative-language taxonomy does the same against ICD 203. Pick one, name it in the product, stop arguing about whether "likely" means 60 or 85.

Worked example: from advisory to rule

Sort AA23-144A by shelf life before doing anything else.

Perishable, not worth a rule: the IP addresses, the file names, the folder McAfee_Logs. The advisory says as much itself, noting the names and paths are examples and defenders should account for variants.

Durable, worth a rule: the actor used built-in ntdsutil.exe with its IFM subcommand to copy the AD database and registry hives in one step, launched through wmic process call create so the parent is not a shell anyone recognises. That is T1003.003 reached through T1047. The behaviour is the intelligence. The folder name is trivia.

If Sigma is new to you, start with how Sigma rules work.

title: NTDS.dit Extraction via Ntdsutil IFM
id: 8f4d1c2e-6b57-4a19-9c33-0d5a7e2b41f8
status: experimental
description: Detects use of the built-in ntdsutil.exe IFM subcommand to copy the
    Active Directory database and registry hives, as published in CISA advisory
    AA23-144A.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a
    - https://attack.mitre.org/techniques/T1003/003/
author: huntrule.com
date: 2026/07/31
tags:
    - attack.credential-access
    - attack.t1003.003
    - attack.t1047
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\ntdsutil.exe'
        - OriginalFileName: 'ntdsutil.exe'
    selection_ifm:
        CommandLine|contains: 'ifm'
    selection_create:
        CommandLine|contains:
            - 'create full'
            - 'create rodc'
            - 'create sysvol full'
            - 'create sysvol rodc'
    condition: selection_img and selection_ifm and selection_create
falsepositives:
    - Domain administrators building install-from-media sets to promote a new
      domain controller over a slow link
    - Backup or disaster recovery tooling that scripts ntdsutil
level: high

What it catches and what it misses

It fires on the ntdsutil process, not the shell that launched it. That matters here. In the CISA example the parent is WmiPrvSE.exe, because the actor went through wmic. A rule keyed to cmd.exe command lines misses it entirely.

It deliberately does not require the string ac i ntds. Ntdsutil accepts abbreviated subcommands, so activate instance ntds is the same instruction with a different string, and pinning to the short form hands an operator a one-word evasion. Matching the image plus ifm plus a create variant narrows that surface without closing it, since ifm itself has a documented short form of i.

False positives are real and rare. IFM is the supported way to promote a domain controller without replicating the directory over the wire, so a genuine hit looks like a scheduled change by a named admin. Triage is one question: was there a ticket.

What it misses is larger than what it catches. The same advisory documents a second route to the same file, using vssadmin to create a shadow copy and copying ntds.dit out of it, which never touches ntdsutil. Replication abuse never writes to disk on the DC at all, so collect Security event 4662 there for coverage. The rule also assumes command lines exist in your telemetry. Windows Security 4688 omits the command line unless process creation auditing is configured to include it. Sysmon event ID 1 carries CommandLine and OriginalFileName by default.

We did not test this against a live IFM operation. The logic comes from published command syntax, not from lab telemetry we collected ourselves.

Structured formats are transport, not intelligence

STIX 2.1 is the OASIS standard for expressing intelligence as typed objects and relationships. Its pattern_type vocabulary includes sigma alongside stix, pcre, snort, suricata and yara, so the rule above can travel as a first-class STIX indicator with valid_from set and a confidence value that means something.

MISP is the widely deployed sharing platform and its own JSON core format. Attributes carry a to_ids flag, the field separating context from something you will alert on. Taxonomies handle confidence, TLP and retention. Galaxies attach the larger objects, including ATT&CK clusters and actor naming.

ATT&CK is the shared vocabulary both lean on. Its value is not that T1003.003 reads better than "dumping the AD database". Its value is making coverage countable, which is where CTI stops being reading material and starts feeding detection engineering.

None of the three produce intelligence. They move it without loss.

What CTI cannot do

It cannot tell you what is on your network. Every relevance judgement rests on an inventory the CTI team does not own.

It cannot predict a specific target on a specific date. Products claiming otherwise are selling extrapolation.

It cannot fix missing telemetry. If your DCs do not log command lines, the advisory above is a document you agree with and cannot act on.

Attribution mostly does not change a detection decision. The rule is identical whether the operator is state-sponsored or a ransomware affiliate who read the same advisory.

And all of it describes the past. That is valuable, and it is not foresight.

ATT&CK mapping

Summary

Intelligence is the subset of your threat data that changed a decision. The fastest way to measure how much you have is to ask which rules changed last quarter and why. Requirements come before collection, not after. Read a public advisory for its behaviours, not its indicators, because behaviour outlives infrastructure by years. If your CTI function cannot name the requirement behind its last three products, fix that before buying another feed.

Telemetry to collect for the above:
  Windows Security  4688   process creation (needs command line auditing enabled)
  Windows Security  4662   directory service access on domain controllers
  Sysmon            ID 1   process creation, CommandLine + OriginalFileName
  Sysmon            ID 11  file created, under the IFM target directory

Existing coverage for this behaviour is in the catalog under ntdsutil, and the wider Windows rule set covers the rest of the domain controller surface.