Key Requirements for the Detection and Sharing of Behavioral Indicators of Compromise

Cyber threat intelligence feeds the focus on atomic and computed indicators of compromise. These are main source tactical cyber most organizations benefit from. They expressed in machine-readable formats, they easily loaded into security devices order to protect infrastructures. However, their usefulness is very limited, specially terms time life. can be useful when dealing with non-advanced actors, but avoided by advanced ones. To detect actor’s activities, an analyst must deal behavioral compromise, which represent tactics, techniques procedures that not as common In this paper, we analyze why these widely used, identify key requirements for successful IOC detection, specification sharing. We follow cycle arranged sequence steps a defensive team work, thereby providing reference teams gaps capabilities.