This lab explores threat intelligence gathering within a SOC environment. You will analyze how deception technologies are used to extract actionable intelligence from adversaries targeting your infrastructure.
Scenario Context
You are a Tier 3 SOC Analyst at a large e-commerce provider. Over the past 48 hours, the L1 team has observed low-and-slow credential stuffing attacks against the external VPN portal. To map the threat actor's infrastructure and tooling without tipping them off, you have deployed a Cowrie SSH honeypot mimicking a vulnerable internal bastion host, intentionally left exposed on a DMZ segment.
Security Environment
SIEM query results from the deception network (Cowrie Honeypot Logs):
SOC Note: The attacker believes they have compromised a real asset and is dropping their toolset. We are actively extracting the payloads for reverse engineering.
Question
A type of threat intelligent that find out the information about the attacker by misleading them is known as __________.
SOC Hint: While the *act* of misleading is a deception tactic, think about the *tier* of intelligence this generates. We are learning about their specific campaigns, malware (TTPs), and infrastructure (who, what, how, where).
Expert Insight
What is happening in the SOC?
We've deliberately exposed a honeypot to a known adversary. Instead of simply blocking their IP (which forces them to rotate infrastructure and try again), we are tricking them into interacting with a fake environment. By doing this, we capture their exact commands, download their malware (`dropper.sh`), and map their C2 infrastructure (`203.0.113.10`). This transforms reactive defense into proactive intelligence gathering.
Why the answer is C (Operational Intelligence)
In standard Threat Intelligence frameworks (and specifically in the context of the CSA exam), understanding the "Who, What, Where, and How" of a specific attack campaign is defined as Operational Intelligence. Deception networks (misleading the attacker) are a primary method for gathering Operational Intelligence because they allow defenders to directly observe adversary Tactics, Techniques, and Procedures (TTPs) in real-time without risking production assets.
Why the other options are incorrect
D. Counter Intelligence: While deception is a counter-intelligence tactic, "Counter Intelligence" itself isn't recognized as one of the four core tiers of CTI (Strategic, Operational, Tactical, Technical) in standard exam terminology. The intelligence generated by the counter-operation is Operational.
A. Threat trending Intelligence: Not a standard CTI category. Trending usually falls under Strategic Intelligence (long-term shifts in adversary behavior).
B. Detection Threat Intelligence: While intelligence is used for detection, this is not a recognized category. (Tactical/Technical intelligence provides the actual IoCs and rules for detection).
MINI LESSON: The 4 Tiers of Cyber Threat Intelligence (CTI)
To succeed in a SOC or on the CSA exam, you must clearly distinguish between the levels of CTI:
Operational: Details on specific adversary campaigns, infrastructure, and TTPs (how they operate). Often gathered via human intelligence, deep web monitoring, or deception tech (honeypots). Audience: Threat Hunters / IR Teams.
Tactical: Specific methodologies and tools used by attackers. Contextualized IoCs. Audience: SOC Architects / Engineers.
Technical: Raw, short-lived indicators of compromise (IoCs) like malicious IPs, domains, or file hashes. Audience: Automated SIEMs / Firewalls / EDR.