Mandiant

---
name: mandiant
description: "Expert agent for Mandiant Threat Intelligence (Google). Covers APT/UNC actor tracking, Advantage platform modules, breach analytics, Attack Surface Management, Digital Threat Monitoring, Security Validation, Google SecOps/Chronicle integration, and Mandiant IR consulting expertise. WHEN: \"Mandiant\", \"Google Threat Intelligence\", \"GTI\", \"Advantage\", \"APT group\", \"UNC group\", \"breach analytics\", \"Mandiant IR\", \"FireEye\", \"Mandiant Academy\"."
license: MIT
---

# Mandiant Threat Intelligence

This skill covers Mandiant Threat Intelligence (now Google Threat Intelligence, GTI). It has deep expertise in Mandiant's threat actor tracking methodology, Advantage platform, breach analytics, and the incident response context that underlies Mandiant's intelligence.

**Context:** Mandiant was acquired by Google in 2022 and operates as part of Google Cloud Security. The Mandiant brand is maintained for threat intelligence and IR services; the platform is being integrated with Google SecOps (Chronicle) as "Google Threat Intelligence" (GTI).

## How to Approach Tasks

1. **Classify the request type:**
   - **Threat actor research** -- Apply APT/UNC actor tracking and intelligence
   - **Platform usage** -- Apply Advantage module-specific guidance
   - **Detection/validation** -- Apply Security Validation or breach analytics guidance
   - **Integration** -- Apply Google SecOps/Chronicle integration knowledge
   - **IR context** -- Apply Mandiant's incident response intelligence context

2. **Clarify platform version** -- Mandiant Advantage (standalone) vs. Google Threat Intelligence (in Google SecOps)?

3. **Load context** -- Read `references/architecture.md` for platform architecture.

## Mandiant's Intelligence Foundation

Unlike most TI vendors, Mandiant's intelligence is grounded in front-line incident response experience since 2004. Key differentiators:

- **IR-derived intelligence**: Mandiant responds to 1,000+ breaches annually; intelligence is derived from actual attacker behavior observed during incident response
- **Direct attribution confidence**: APT attribution based on direct evidence from IR engagements, not just open-source inference
- **Novel TTP discovery**: Mandiant identifies new techniques before they are widely known (APT1 report 2013, SolarWinds 2020, Exchange ProxyLogon 2021, Log4Shell 2021)
- **Zero-day tracking**: Access to zero-day and n-day exploitation data through IR engagements

## Threat Actor Tracking

### APT Naming Convention

Mandiant assigns APT numbers to confirmed nation-state actors:
- **APT1-APT45**: Confirmed state-sponsored groups with attributable nation-state backing
- Numbers assigned sequentially as attribution is confirmed
- Each APT has a detailed dossier: country, motivation, targets, TTPs, malware families

**Selected APT groups:**

| APT | Nation | Motivation | Known For |
|---|---|---|---|
| APT1 | China (PLA Unit 61398) | Espionage | 2013 report; mass IP theft from US companies |
| APT10 | China | Espionage | MSP supply chain attacks, Operation Cloud Hopper |
| APT28 (FANCY BEAR) | Russia (GRU) | Espionage + influence | DNC breach, election interference |
| APT29 (COZY BEAR) | Russia (SVR) | Espionage | SolarWinds, Microsoft breach |
| APT34 | Iran (MOIS) | Espionage | Middle East financial/energy targeting |
| APT38 | North Korea (RGB) | Financial | Bank heists, SWIFT network attacks |
| APT41 | China (dual: state + criminal) | Espionage + financial | ShadowPad, supply chain attacks |
| APT43 | North Korea | Financial + espionage | Cryptocurrency theft |
| APT44 (Sandworm) | Russia (GRU) | Disruption | Ukraine power grid, NotPetya, Olympic Destroyer |
| APT45 | North Korea | Financial + espionage | Healthcare targeting, nuclear programs |

### UNC Group Tracking

UNC (Uncategorized) groups are clusters of activity that have not yet been definitively attributed:
- **UNC1234**: Activity with common infrastructure, TTPs, or targeting -- but attribution not yet confirmed
- UNC groups may be consolidated (two UNC groups found to be the same actor)
- UNC groups may be promoted to APT designation (UNC2452 → APT29 after SolarWinds attribution)
- Some UNC groups remain UNC indefinitely if attribution evidence is insufficient

**Significance for SOC:** UNC advisories are often more timely than APT advisories because they don't wait for attribution confidence.

### FIN Groups (Financial)

FIN groups are financially-motivated actors:
- **FIN6**: Retail/hospitality POS malware, evolved to ransomware
- **FIN11**: Clop ransomware operator
- **FIN12**: Healthcare ransomware (Ryuk, now Conti affiliates)

## Advantage Platform

Mandiant Advantage is the SaaS platform delivering Mandiant's intelligence and services.

### Threat Intelligence Module

**Core capabilities:**
- Actor profiles: Detailed TTPs, malware, infrastructure for APT/UNC/FIN groups
- Campaign tracking: Active campaigns with TTPs and targeting patterns
- Malware family profiles: Technical analysis of malware families
- Vulnerability intelligence: Exploitation evidence and threat actor associations
- Intelligence reports: Finished intelligence reports from Mandiant analysts

**Analyst-grade intelligence:**
- Mandiant analysts write high-context finished intelligence reports
- Reports include confidence assessments and evidence citations
- Peer-reviewed by Mandiant's research teams before publication

**ATT&CK integration:**
- All actor TTPs mapped to MITRE ATT&CK
- ATT&CK Navigator layers available for each APT/UNC group
- Enables: "Show me which ATT&CK techniques APT29 uses that my controls don't detect"

### Breach Analytics Module

Breach Analytics matches Mandiant IOCs and threat indicators against your SIEM/log data.

**Architecture:**
- Mandiant provides a connector to your SIEM (Splunk, Sentinel, BigQuery, etc.)
- Connector continuously queries your data against Mandiant's IOC database
- Match = your environment has seen infrastructure or artifacts associated with known threats

**What it detects:**
- Network connections to known C2 infrastructure
- DNS queries for known malicious domains
- File hashes matching known malware
- User agent strings associated with specific malware families
- Behavioral indicators (process execution patterns associated with specific actors)

**Value vs. manual IOC lists:**
- Mandiant's IOC database is curated by analysts (low false positive rate)
- Retroactive coverage: Matches against historical data (detect past compromises you missed)
- Continuous: New Mandiant IOCs automatically checked against your data
- Context: Each match comes with intelligence context (actor, campaign, malware family)

**Integration:**
- Splunk: Mandiant Breach Analytics Splunk App
- Microsoft Sentinel: Mandiant-Sentinel integration
- Google SecOps/Chronicle: Native integration (same Google Cloud ecosystem)
- BigQuery: Direct data export + Mandiant provided lookup tables

### Attack Surface Management (ASM) Module

ASM continuously discovers and assesses your external attack surface from an attacker's perspective.

**Discovery coverage:**
- Internet-facing hosts (IP ranges, discovered via DNS, certificates, scanning)
- Web applications
- Exposed services (RDP, SSH, databases, management interfaces)
- Certificate details and expiry
- Technology fingerprinting (web server, CMS, CDN, etc.)
- Subdomain enumeration (including forgotten/shadow IT)

**Assessment outputs:**
- Severity rating per exposed asset
- Vulnerability correlation (CVEs in discovered technologies)
- Exposed credential detection (in code repos, paste sites, search engines)
- Data exposure detection (S3 buckets, git repos, exposed documents)

**Continuous monitoring:**
- Daily re-scan; alert on new assets discovered or new vulnerabilities
- Track change over time (what was added to your attack surface this week?)

### Digital Threat Monitoring (DTM) Module

Monitors external sources for threats targeting your organization.

**Sources monitored:**
- Dark web forums and marketplaces
- Paste sites (Pastebin, etc.)
- Social media (Twitter/X, Telegram, Discord)
- Illicit messaging channels
- Code repositories (GitHub leaked secrets)

**Alert types:**
- **Credential exposure**: Employee credentials in breach dumps or dark web markets
- **Data leakage**: Sensitive company data exposed publicly
- **Brand abuse**: Impersonation, phishing targeting your employees/customers
- **Infrastructure targeting**: Threat actors discussing attacking your systems
- **Executive threats**: Physical or cyber threats to named executives

**Comparison to Recorded Future DTM:**
- RF: Broader OSINT coverage, AI-driven processing of 1M+ sources
- Mandiant DTM: Deeper analyst context, higher fidelity on dark web intelligence (informed by IR experience)

### Security Validation Module

Security Validation tests whether your security controls actually detect the TTPs Mandiant tracks.

**Architecture:**
- Uses Mandiant's actor-attributed TTP library
- Executes actual attack simulations in your environment
- Reports: Which techniques triggered detections vs. which were missed

**Modes:**
- **Network validation**: Replay malicious traffic patterns, check if firewall/NDR detected
- **Endpoint validation**: Execute TTP scripts on endpoint, check if EDR detected
- **Email validation**: Send simulated phishing, check if email gateway blocked

**Output:**
- Coverage heatmap on ATT&CK matrix (green = detected, red = missed)
- Prioritized remediation: Which gaps are most exploited by your relevant threat actors?
- Trending: Has your coverage improved or degraded since last test?

## Google SecOps (Chronicle) Integration

As part of Google Cloud, Mandiant intelligence integrates natively with Google SecOps:

### Google Threat Intelligence (GTI) in SecOps

In the Google SecOps console, analysts have direct access to GTI (Mandiant's intelligence):

**Context enrichment:**
- Any entity in a SIEM alert → click → GTI intelligence card appears inline
- No context-switching to separate portal
- GTI confidence score, related actors, campaign context shown directly

**Mandiant investigations:**
- Suspicious domain appears in DNS log → Analyst clicks → GTI shows: "This domain is associated with APT41 infrastructure observed in Q3 2024 campaign targeting US manufacturing firms"

**Retroactive search:**
- GTI pushes new IOC → Google SecOps automatically checks historical SIEM data
- "This IOC was just confirmed malicious -- did you see it in your environment in the last 90 days?"

**YARA-L in SecOps:**
- Mandiant provides YARA-L rules (Google SecOps detection language) for ATT&CK techniques
- Import directly into SecOps detections
- Keep rules updated as Mandiant publishes new threat research

## Mandiant Incident Response

While not a platform feature, Mandiant's IR practice is core to understanding their intelligence:

**IR service types:**
- **Emergency IR**: Active breach response
- **Proactive Compromise Assessment**: "Have we been breached?" assessment
- **Tabletop Exercise**: Facilitated scenario-based IR planning
- **Red Team**: Adversary simulation against your environment

**Intelligence feedback loop:**
- IR engagements discover new TTPs → fed to Mandiant's intelligence team → published as advisories
- First-hand, unfiltered intelligence from actual attacker behavior in live environments

**Post-IR deliverables:**
- Detailed timeline of attacker activity
- ATT&CK mapping of all observed techniques
- IOCs from the environment (hashes, IPs, domains used against you)
- Remediation guidance
- Intelligence brief (can be shared with Advantage subscribers)

## Mandiant Academy

Mandiant Academy provides threat intelligence training:

**Courses:**
- Cyber Threat Intelligence Fundamentals
- Advanced Malware Analysis
- APT Attribution Methods
- Windows Forensics
- Network Forensics

**Format:** Self-paced online, instructor-led virtual, or on-site

**Certifications:**
- GCIA, GCFE, GREM (GIAC certifications offered through Mandiant training)
- Mandiant certifications in malware analysis and IR

## Reference Files

- `references/architecture.md` -- Mandiant Advantage platform architecture, Google SecOps integration, Breach Analytics data flow, Attack Surface Management discovery methodology, Digital Threat Monitoring source coverage, Security Validation execution environment, APT/UNC group tracking database, and intelligence production workflow.