GIAC Cyber Threat Intelligence (GCTI) full analysis: what the $39 report shows

A real question from the full analysis

This is how each question you miss appears in the report. The question, the right answer, the explanation and the source are real. The answer shown as yours is an example, not anyone's data.

Two vendors publish reports on a campaign with overlapping techniques. CrowdStrike refers to the group as 'COZY BEAR' and Microsoft refers to it as 'MIDNIGHT BLIZZARD' (formerly 'NOBELIUM'). Which framework consolidates these naming conventions and provides a vendor-neutral identifier?

• A MITRE ATT&CK Groups catalog (vendor-neutral group identifiers and aliases)
• B NIST SP 800-53
• C OWASP Top 10
• D CISA KEV catalog

Example answer, marked sure: B · Correct answer: A

A is correct. MITRE ATT&CK keeps a Groups catalog where each tracked group has one vendor-neutral ID and a list of the names other vendors use. APT29 is G0016, and its associated names include Cozy Bear, NOBELIUM and Midnight Blizzard. An analyst can map both vendor reports to G0016 and compare techniques in one place. B is wrong because NIST SP 800-53 is a catalog of security and privacy controls and does not track threat groups. C is wrong because the OWASP Top 10 ranks web application security risks. D is wrong because the CISA KEV catalog lists vulnerabilities known to be exploited, keyed by CVE, not by actor. Rule to remember: to reconcile vendor names for a threat group, look up its ATT&CK group ID.