From IOCs to Group Profiles: on the Specificity of Threat Group Behaviors in CTI Knowledge Bases

Indicators of Compromise IOCs such as IP addresses, file hashes, and domain names are commonly used for threat detection and attribution. However, IOCs tend to be short-lived as they are easy to change. As a result, the cybersecurity community is shifting focus towards more persistent behavioral...