Threat Analytics and Activity Groups

This report argues for shifting from IOC-centric detection to behavioral analytics that track adversary TTPs, leveraging models like the Diamond Model to define activity groups by observable capabilities, infrastructure, and targeting. Using ICS-focused examples—such as DYMALLOY’s screenshot exfiltration and ELECTRUM’s use of PSExec and net use for lateral movement—it demonstrates how general behavior analytics can provide broader, forward-leaning detection while more specific, group-tuned variants enable higher-confidence, context-rich investigations.