Pivoting in Threat Intelligence: AIL and MISP Insights

At the FIRST CTI Conference 2025 in Berlin, we presented our recent work on practical pivoting strategies in threat intelligence, based on threat intelligence experiments with the AIL and MISP platforms.

The talk explores how less conventional indicators—such as cookie names, QR codes, HTTP headers (HHHash), DOM structure, and even reused Google Analytics IDs—can uncover surprising links between threat actor infrastructure and behavior.

We also shared observations from real-world crawling and analysis using AIL, including:

• How “weak” indicators can become valuable through composite correlation
• Unexpected reuse of metadata in Tor services and social networks
• Ways how AIL can support more creative pivoting workflows

Thanks to everyone who attended and shared feedback!

• Slides PDF Slide - The Art of Pivoting - How You Can Discover More from Adversaries with Existing Information

Funding

This work is co-funded by CIRCL and co-funded by the ECCC under the FETTA (Federated European Team for Threat Analysis) project aims to address this issue by creating a federated team that spans across borders, providing Cyber Threat Intelligence (CTI) products and tooling.