Infrastructure Research and Hunting: Boiling the Domain Ocean

The Diamond Model of Intrusion Analysis identifies two main nodes as actor assets that may ultimately interact with a target / victim’s own assets — capabilities and infrastructure. But while “exploitation” is usually considered something the adversary does, it works both ways as threat intelligence researchers and defenders in general can exploit the discoverable characteristics and tactics those adversaries employ with either node.

In this blog, we’re going to explore important considerations and methodologies for exploiting a…