A threat-intel-driven campaign will take all knowledge and topics previously covered and combine them to create a well-planned and researched campaign. The task flow in this room logically follows the same path you would take as a red team to begin planning a campaign, Identify framework and general kill chain Determine targeted adversary Identify adversary's TTPs and IOCs Map gathered threat intelligence to a kill chain or framework Draft and maintain needed engagement documentation Determine and use needed engagement resources (tools, C2 modification, domains