ABSTRACT Tactical threat intelligence describes adversary behavior through Tactics, Techniques, and Procedures (TTPs). Its application in Threat Hunting offers significant advantages over Indicators of Compromise (IoCs); however, the high level of abstraction of TTPs poses challenges to rule‐based detection, thereby limiting the automation and scalability of this approach. To bridge this gap, this paper proposes a structured methodology to produce actionable tactical intelligence geared toward creating rules for detecting adversarial behavior. The methodology defines an iterative process for mapping TTPs, developing and validating detection rules, reducing complexity, and enabling continuous improvement. Furthermore, a data model is presented to organize and standardize the information generated in Runbook format, serving as a source of tactical intelligence for Threat Hunting to ensure interoperability and reuse. The proposal was evaluated through a proof of concept, which demonstrated its effectiveness in generating actionable tactical intelligence and creating accurate rules, enabling the operationalization of TTP‐based detection. Finally, the identified benefits, limitations, and challenges are discussed, and future prospects are presented.
Santos et al. (Fri,) studied this question.