Threat Actor Intelligence
Track The Actors That Target You.
Indicator feeds, YARA rules and ATT&CK mapping for your tools.
Trusted by security teams at
Talk To BrandefenseGet The Full Intelligence.
Thank you.
A Brandefense analyst or a partner in your region will reach out within one business day.
Back to ATLASFrom a public profile to detection content.
IndicatorsCVEsTechniquesMalwareATT&CK layerSample actorSample
Recon
Resource dev.
Initial access
Execution
Persistence
Priv. esc.
Defense evasion
Cred. access
Discovery
Lateral mov.
Collection
C2
Exfiltration
Impact
Indicator feedDelivered to your SIEM and SOAR tools
IP198.51.100.••High confidence
Domainc2.example.comHigh confidence
SHA-2569f3a••••••••e1Medium confidence
URLhxxps://example.com/•••Medium confidence
What you get
- Indicator feedsIP addresses, domains and file hashes tied to the actor, delivered to your SIEM and SOAR tools.
- YARA rules and hunting queriesDetection content and query templates for your SIEM, to hunt for known actor techniques.
- MITRE ATT&CK mappingTechniques mapped per actor and campaign, so intelligence turns into detections.
- Actor profiles and campaign timelinesMore detail on the actor than the public profile, with the campaigns behind it.
Free on ATLAS
Threat Actors Database on ATLAS
Research state-backed and criminal groups on ATLAS: how they work, what they use and their recent campaigns. The platform adds feeds and detection content.
Open the Threat Actors Database on ATLASatlas.brandefense.io/threat-actors-database
How it works, in three steps.
- 01Tell us who you areShare your business email and company. A Brandefense analyst or a partner in your region gets in touch.
- 02A live 30-minute sessionAn analyst walks through the actors that matter to your sector and what the platform adds.
- 03Continuous monitoring and alertsIndicators and context stay up to date and flow into the tools your team already uses.
Good to know.
What do I get beyond the public profile?
Indicator feeds, YARA rules and hunting queries, ATT&CK mapping and campaign timelines.
Where do the indicators go?
IP addresses, domains and file hashes are delivered to your SIEM and SOAR tools.
Does it stay up to date?
Indicators and context stay current and flow into the tools your team already uses.
Talk To Brandefense