OSINT for CTI
The sources are easy to list. The skills that get tested are knowing what each one actually proves, and not tipping off the adversary while you look.
Open-source collection in CTI is not "googling". It is a set of technical data sources, each with a specific evidentiary value and a specific failure mode.
Infrastructure sources
| Source | What it proves | Limits |
|---|---|---|
| Passive DNS | That a name resolved to an address at a point in time — the backbone of infrastructure pivoting | Coverage varies hugely by provider and region; absence proves nothing |
| Certificate transparency (crt.sh and similar) | That a certificate was issued for a name; often reveals hostnames before they are used | Only covers CT-logged public CAs — not self-signed or private CA certs |
| WHOIS / RDAP | Registration dates and registrar patterns; historical records occasionally expose an operator | Redaction is now the norm; current data is rarely decisive on its own |
| Internet scan data (Shodan, Censys) | What was listening on a host, with banners, certificates and service fingerprints | Snapshot-based; adversary infrastructure is often short-lived between scans |
| TLS and service fingerprints (JARM, JA3/JA4) | Clusters hosts running the same C2 framework configuration | Fingerprints collide across unrelated deployments; a cluster hint, never an identity |
| Scan-noise reputation (GreyNoise) | Whether an address is mass-scanning the whole internet or specifically touching you | Answers "is this targeted", not "is this malicious" |
Malware and file sources
- VirusTotal — detections, but far more usefully: submission metadata, relationships, embedded strings, and pivots on imphash or similar. Detection names are a weak signal and vendors disagree constantly.
- MalwareBazaar, MalShare and similar repositories — sample acquisition and family tagging.
- Public sandboxes (Any.Run, Hybrid Analysis, Triage) — behavioural reports and, frequently, extracted C2 configuration. Also a source of other people's mistakes: sensitive documents get uploaded to public sandboxes constantly.
- URLScan — how a page behaved when fetched, including redirect chains and resources loaded. Public scans are searchable, which cuts both ways.
Operational security
This is the part interviews probe, and the part self-taught candidates most often miss.
Ways analysts burn an investigation
- Uploading a sample to a public repository. If the malware was targeted, the adversary is watching for it. Uploading tells them you found it and starts their clock. Use a private sandbox for anything targeted, and treat this as a decision with a stakeholder, not a reflex.
- Active interaction with live infrastructure. Resolving a domain, fetching a payload or connecting to a C2 from a corporate range attributes your organisation to the adversary. Prefer passive sources; if you must go active, do it from infrastructure that is not attributable to you.
- Public URL scans of a targeted lure. The scan is visible to anyone, including the actor.
- Search-engine and account hygiene. Researching an actor's persona from an account tied to your real identity is a durable mistake.
From collection to intelligence
The pivot chain is the deliverable, not the tool list. A defensible sequence from one malicious domain:
- Passive DNS for historical resolutions → candidate IP set.
- Each IP: what else resolved there in the same window? Filter shared hosting hard before treating co-residency as a link.
- Certificate transparency on the domain and on the IPs → related hostnames, sometimes naming conventions.
- Scan data on the IPs → services, banners, C2 framework fingerprints.
- Malware repositories for samples beaconing to any of the above → capability.
- Cluster with explicit reasoning, then assess against what the evidence can actually support.
Record provenance for every hop. When someone asks in three months why you believed two campaigns were related, the answer needs to be reconstructable. Grade each source as you go — see source grading.
Next step
Run a mock interview on this material. You get the question, a graded response against a vetted rubric, and the probing follow-up an interviewer would ask next.
Related reading
- Attribution and its limits Attribution is the fastest way to fail a scenario interview. The skill is not naming the actor — it is knowing what your evidence can and cannot support, and saying so.
- Analytic confidence and estimative language These are two different axes. You can be highly confident that something is unlikely. If you cannot say that sentence and explain it, you will lose points in every scenario round.
- Source grading for analysts A reliable source can report something false. An unreliable source can be right. Grading them on one axis loses the information that matters.
- Structured analytic techniques ACH is not a spreadsheet ritual. It is a discipline for finding the evidence that would prove you wrong, which is the only kind that carries much information.