Listen to this Post
Introduction:
For years, the cybersecurity industry has paid lip service to TTPs (Tactics, Techniques, and Procedures), yet the “P”—the actual ground truth of how an adversary executes an attack—has remained trapped in unstructured prose and tribal knowledge. This gap prevents analysts from systematically comparing adversary behaviors or mapping them directly to detection logic. Now, leveraging advances in LLM-assisted analysis and a push for a formal STIX 2.1 extension, the industry is finally moving to standardize procedure modeling, turning vague incident reports into machine-readable, comparable data.
Learning Objectives:
- Understand the critical distinction between Techniques (what) and Procedures (how) in threat intelligence.
- Learn how a STIX 2.1 extension for procedures enables cross-group tradecraft comparison.
- Identify practical methods to extract and structure procedure-level data using open-source tools and command-line utilities.
You Should Know:
1. The Problem with Unstructured Procedures
Currently, if you read a threat report, the “procedure” is usually a paragraph describing how an adversary used a specific tool. For example: “The threat actor used a PowerShell command to enumerate running processes and write the output to a text file before exfiltration.” This is human-readable but machine-useless.
Why this fails: You cannot query a database for “PowerShell process enumeration followed by staging” across different intrusion sets. You cannot easily see if Group A and Group B are using identical command-line arguments, indicating a shared toolset or training.
Step‑by‑step guide to current reality (extracting procedures manually):
- Identify the raw log source: In a Linux environment, process enumeration might look like
ps aux > /tmp/proc.txt.Simulated attacker command ps aux | tee /tmp/process_list.txt
- In Windows, the equivalent command often used by adversaries is:
tasklist > C:\Users\Public\proc.txt
- Current manual extraction: An analyst reads a PDF report, copies the command `tasklist > 1.txt` (as seen in the referenced diagram), and pastes it into a detection rule comment field. This data is now siloed.
-
Toward a Structured Approach: The STIX 2.1 Extension
The proposed solution, inspired by Tidal Cyber’s methodology, is to create a formal object for “Procedure” within the STIX framework. Instead of just a `Campaign` using a `Technique` (like T1057 Process Discovery), it would link to a specific `Procedure` object containing the exact command-line strings, registry modifications, or API calls observed.
How to model a procedure conceptually:
- SCOs (Cyber-observable Objects): The file created (
1.txt), the process (tasklist.exe). - Relationship: `Threat Actor` -> `uses` -> `Campaign` -> `uses` -> `Technique` -> `implements` -> `Procedure` -> `created` ->
File: 1.txt.
3. Extracting Procedures with Command-Line Forensics
To populate these new procedure models, defenders need to extract ground-truth data from endpoints. This moves beyond “technique” detection to “procedure” detection.
Step‑by‑step: Using Linux Sysmon to capture procedure-level detail:
1. Install Sysmon for Linux:
wget https://packages.microsoft.com/config/ubuntu/20.04/packages-microsoft-prod.deb sudo dpkg -i packages-microsoft-prod.deb sudo apt-get update sudo apt-get install sysmonforlinux
2. Configure Sysmon to log command lines (critical for procedure analysis):
<!-- Save as sysmon-config.xml --> <Sysmon schemaversion="4.22"> <EventFiltering> <ProcessCreate onmatch="include"> <CommandLine condition="contains">tasklist</CommandLine> </ProcessCreate> </EventFiltering> </Sysmon>
3. Run Sysmon:
sudo sysmon -accepteula -i sysmon-config.xml
4. Query the logs for the exact procedure: This captures not just that process discovery happened, but the exact `CommandLine` used, enabling cross-group comparison.
4. Windows Security Logs: Hunting for Procedure Deviations
Standardizing procedures allows you to spot “deviations” in tradecraft—maybe a known Russian group suddenly uses a command-line flag commonly associated with a Chinese group.
Step‑by‑step: Hunting for specific command-line procedures in Windows Event Logs (Event ID 4688):
1. PowerShell cmdlet to search for specific process creation procedures across multiple machines:
Search for the exact procedure of using 'net user' to add a backdoor account
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4688} |
Where-Object { $<em>.Properties[bash].Value -like 'net user /add' } |
Select-Object TimeCreated, @{Name='CommandLine'; Expression={$</em>.Properties[bash].Value}}
2. Cross-referencing: If you have a STIX bundle with a formal procedure object containing command-line: "net user test Winter2025! /add", you can hash that string and compare it against your SIEM to find exact matches or minor variations.
5. Using LLMs to Bridge the Reporting Gap
As mentioned in the post, LLMs are “accelerating the tedious parts of STIX modeling.” You can use them to convert prose into structured data.
Step‑by‑step: Using `jq` and a hypothetical LLM output to create STIX objects:
1. Raw report text: “The adversary ran `schtasks /create /tn “UpdateTask” /tr “C:\evil.exe” /sc daily` to establish persistence.”
2. LLM Extracted Data (structured as JSON):
{
"procedure": {
"technique_id": "T1053.005",
"command_line": "schtasks /create /tn \"UpdateTask\" /tr \"C:\evil.exe\" /sc daily",
"binary": "schtasks.exe",
"arguments": ["/create", "/tn", "UpdateTask", "/tr", "C:\evil.exe", "/sc", "daily"]
}
}
3. Linux command-line processing with `jq` to format a STIX-like object:
Assuming the LLM output is in 'procedure.json'
cat procedure.json | jq '{
type: "procedure",
spec_version: "2.1",
name: "Schtasks Persistence",
command_line: .procedure.command_line,
technique_ref: .procedure.technique_id
}' > stix_procedure.json
6. API Security: Modeling Procedures in Web Logs
Procedures aren’t just for binaries; they exist in API abuse. Structured procedures help differentiate a script-kiddie using `curl` from an advanced attacker using a custom client.
Step‑by‑step: Mapping an API exploitation procedure:
1. Observed malicious API call:
curl -X POST https://api.target.com/v1/admin/backup \
-H "Authorization: Bearer {LEAKED_TOKEN}" \
-H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" \
-d '{"export_all": true, "format": "sql"}'
2. Extracting the procedure: The specific User-Agent, the exact JSON body structure (export_all), and the endpoint constitute the procedure.
3. Detection Logic (Sigma rule example for this procedure):
title: Suspicious Admin Backup API Call detection: selection: EventType: 'HTTP' cs-method: 'POST' cs-uri-stem: '/v1/admin/backup' cs(UserAgent): 'Mozilla/5.0Windows NT' Specific pattern cs-body: 'export_alltrue' Procedure-level detail condition: selection
What Undercode Say:
- The death of the PDF report: Standardizing procedures will force threat intel teams to output machine-readable data, making “tribal knowledge” obsolete and enabling automated defense updates.
- Detection becomes attribution-lite: When you can map a specific command-line string (procedure) to multiple groups, you can identify shared infrastructure or tooling that techniques alone would miss, revealing hidden connections between intrusion sets.
This push to model the “P” is the final frontier of threat-informed defense. By moving from abstract techniques to concrete, comparable procedures, we enable a level of forensic precision and automated response that has been technically impossible until now. It turns cybersecurity from a descriptive art into a data-driven science, where a command line is not just an IOC, but a fingerprint.
Prediction:
Within the next 18 months, major EDR vendors will begin supporting “Procedure ID” as a first-class alerting field, allowing SOCs to filter noise not just by “technique” (e.g., Process Injection), but by the specific variant of injection seen in the wild. This will reduce false positives by 30-40% as defenders can finally block the exact “how” without breaking legitimate business software that uses the same underlying “what.”
▶️ Related Video (78% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Shermanchu1 Ive – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
