Transferring Knowledge to Customers Through Software Technology

Dragos introduces recurring content packs for the Dragos Platform that codify its threat intelligence and Threat Operations Center expertise into behavior-based analytics and guided investigation playbooks, supported by Query Focused Datasets. The post explains why TTP-centric detections scale better than IOCs and illustrates with an example of detecting DNS exfiltration of HMI screenshots (e.g., activity associated with DYMALLOY). These packs aim to provide continuous, on-the-job training and actionable workflows so industrial defenders can more effectively detect, investigate, and respond to adversary behaviors without direct engagement with Dragos.