Threat Intelligence Workstream
Owning the MITRE ATT&CK intelligence layer behind an AI-powered security dashboard, from raw technique research to a live data feed another team's code consumed directly.
- Network Threat Intelligence Analyst. Sole owner of the threat intelligence module
- Digibit Strategic Intelligence & Advisory Unit · 15-member cross-functional programme
- 2026 · 12 weeks · Remote
- techniques in the heatmap data feed
- 20
- techniques in the heatmap data feed
- threat actor profiles simulated
- 3
- threat actor profiles simulated
- techniques with P1/P2/P3 alert logic
- 15+
- techniques with P1/P2/P3 alert logic
- steps per documented kill chain
- 5–6
- steps per documented kill chain
The problem
The programme's capstone was an AI-powered security dashboard, and its most visible feature was a MITRE ATT&CK heatmap. A heatmap needs real intelligence behind it: which techniques matter for GCC-sector organisations, how often they appear, how severe they are, and when they should trigger an alert.
That data had to come from somewhere. My workstream was that somewhere: research the techniques, model the attacks, document the indicators, and deliver it all in a form another team's code could ingest without a human reformatting anything.
The approach
I worked backwards from the dashboard's display requirements to design the data schema first: technique IDs in strict ATT&CK notation (T####.###), a controlled vocabulary for alert colour (RED/AMBER/GREEN) and priority (P1/P2/P3), and fixed columns for frequency and severity. Every downstream deliverable was produced to fit that contract.
The intelligence itself came from scenario work. Three full threat simulations, each built around a distinct actor profile (an APT financial actor, a nation-state C2 operator, a ransomware affiliate targeting OT/energy) and developed into a 5-6 step kill chain with technique IDs, per-step IOCs, and the control gaps they exploit.
The intelligence pipeline
Each weekly cycle ran the same route: MITRE ATT&CK v14 technique research, then kill chain development with IOC documentation (process names, network indicators, registry artefacts, Windows Security Event IDs), then ISO 27001:2022 Annex A control mapping, and finally structured output validated against KPI criteria before handoff to the dashboard, API, and compliance workstreams.
The IOC layer covered real detection territory: lateral movement and C2 beaconing patterns, DNS tunnelling indicators, LSASS memory access, Kerberoasting, DCSync, Golden Ticket, token impersonation, and spearphishing delivery chains.
- T1566.001P1
Spearphishing Attachment
- T1003.001P1
LSASS Memory
- T1558.001P1
Golden Ticket
- T1021.002P1
SMB/Admin Shares
- T1071.001P1
C2 Web Protocols
- T1558.003P2
Kerberoasting
- T1003.006P1
DCSync
- T1134P2
Token Impersonation
- T1110.003P2
Password Spraying
- T1071.004P2
DNS Tunnelling
- T1547.001P3
Registry Run Keys
- T1574.009P3
Unquoted Service Paths
Real feed: 20 techniques × frequency / severity / alert colour / priority, in strict ATT&CK notation — consumed by the dashboard team without reformatting.
T1566.001
Spearphishing Attachment
macro-enabled doc · anomalous child process of winword.exe
T1003.001
LSASS Memory
non-system process reading lsass · Event ID 4656/4663
T1134
Token Impersonation
SeImpersonatePrivilege abuse · Event ID 4674
T1021.002
SMB / Admin Shares
ADMIN$ mounts from workstation VLANs · 445 fan-out
T1071.001
Web Protocols
beacon-interval HTTPS to young domains · JA3 mismatch
Three full simulations delivered — APT financial actor, nation-state C2 operator, ransomware affiliate targeting OT/energy — each with per-step IOCs and control gaps.
Engineering decisions
Design the schema before the intelligence
The heatmap feed was a live integration input. Any inconsistency in notation, naming, or column structure would break the dashboard. Fixing the contract first meant twenty techniques' worth of research landed in a format the dashboard team accepted without a single reformatting pass.
Strict ATT&CK notation everywhere
Every technique reference across every deliverable was cross-checked against MITRE ATT&CK v14 in T####.### form. Consistency wasn't cosmetic; it was what let reports, heatmap rows, and alert rules reference each other reliably.
Scenarios over checklists
Three distinct actor profiles produced grounded, sector-specific intelligence for banking, government, and energy instead of a generic technique list. The kill chains gave the alert logic its priorities: a P1 trigger means something because a modelled adversary actually uses it.
What was hard
Deliverables had named recipients, hard weekly deadlines, and dependency chains across a 15-person team. My output was other people's input.
Treated every handoff like an API contract: agreed formats upfront, validated against KPI criteria before delivery, and distributed a MITRE reference sheet that became the shared framework resource for the whole cohort.
The capstone required demonstrating an end-to-end attack convincingly to a mixed technical and advisory audience, live, in four minutes.
Scripted and rehearsed the attack phase of the threat simulation, co-leading the live demonstration at the Capstone Showcase with a teammate handling containment.
Outcome
The heatmap data feed shipped on time and powered the dashboard's most visually prominent feature at the Capstone Showcase. The ISO 27001 control data enabled the compliance gap-mapping workstream, the simulation reports became reusable assets in the programme library, and the whitepaper's threat landscape chapter documented the GCC threat environment for an advisory audience.
This was analytical work with engineering discipline: no code shipped, but every deliverable was structured data with a consumer, a contract, and a deadline.
P1 — Immediate escalation
Domain-dominance techniques like DCSync and Golden Ticket page the on-call the moment they fire
P2 — Investigate within SLA
Password spraying and Kerberoasting get correlated before escalation to cut noise
P3 — Log and monitor
Registry run keys and unquoted service paths are tracked as posture signals, not pages
Intelligence that needs a human to reformat it before a machine can use it isn't finished. Working backwards from the consumer is what turns research into product.