Through the Eyes of the Adversary: How to Build a Threat Intel Program

## Overview This CrowdStrike presentation, delivered by Jason Rivera (Director of Strategic Threat Advisory Group) with Scott Jarkoff available for questions, teaches threat intelligence professionals how to build effective programs by understanding conflicts from an adversary's perspective. The core principle is that better understanding of adversary motivations, capabilities, and tactics enables organizations to communicate actionable intelligence to stakeholders and improve defenses.

## Key Topics The presentation structures threat intelligence around a strategic-operational-tactical framework applied to both defender and adversary sides. It identifies three fundamental conflict types: security (nation-state threats), economic (financial crime), and ideological (hacktivism). Organizations are engaged with adversaries across three spaces: your environment, the adversary's environment, and contested space (the internet).

Adversary analysis focuses on motive (why attack), intent (extortion, espionage, destruction), capability (malware, DDoS, social engineering), infrastructure (botnets, C2, proxies), and TTPs (techniques, tactics, procedures). The model emphasizes understanding how adversaries target people, processes, and technologies across three access vectors: digital (exploits), physical (USB/supply chain), and psychological (social engineering, bribery).

## Technical Details Three threat intelligence capability areas form the operational backbone:

**Intelligence Enrichment:** Consumes indicators of compromise and signatures to empower defensive systems. Includes IOC ingestion, sensor tuning, malware analysis, and automated sandbox analysis for timely, attack-telemetry-derived content.

**Threat Monitoring:** Monitors the internet (surface, social media, dark web, digital footprint) for leaked credentials, PII, brand infringement, malware, and malicious mentions. Critical to understanding adversary infrastructure and capabilities, though dark web should not be overemphasized—smart actors don't announce intent there.

**Threat Reporting:** Uses a "What, So What, What Next" model—describing what's happening, why it matters, and what actions stakeholders should take. Reports should be actionable and implications-focused rather than sector or geography-specific, since malware affects all industries.

Three stakeholder types require different intelligence products: strategic stakeholders (CSO, CIO, CTO) need decision-support intelligence; operational stakeholders (SOC analysts, threat hunters, vulnerability managers) need job-focused intelligence; tactical stakeholders (SIEM, firewall, EDR, IDS/IPS) need indicators and rules for automated blocking.

The presentation debunks common myths: more indicators cause false positives and false confidence; not all intelligence can be automated; dark web chatter is rare from sophisticated actors; and threats apply universally across sectors and geographies.

## Takeaways Effective threat intelligence programs require: (1) adopting an adversary perspective to understand motive, intent, capabilities, infrastructure, and TTPs; (2) collecting intelligence across enrichment, monitoring, and reporting areas; (3) designing teams with strategic analysts (presenters), operational analysts (SOC-aware), and tactical analysts (malware experts); and (4) ensuring all intelligence activities serve defined stakeholders. Two detailed scenarios—financially motivated ransomware targeting domain admins and nation-state intellectual property theft—illustrate how to map these frameworks and identify appropriate defenses. The underlying principle remains: understanding conflict through the eyes of the adversary enables better strategic decisions, operational effectiveness, and tactical system tuning.