Threat Actor Attribution
Attribution is rarely needed to respond, and wrong attribution causes real harm (misdirected response, bad executive decisions). Do it carefully or not at all.
When to attempt
Attempt only if at least two of these hold:
- Infrastructure (IP/domain) with a reliable (A/B) public link to a named cluster.
- Tooling or malware family with known actor associations.
- A distinctive TTP sequence matching an ATT&CK group profile.
- Targeting consistent with the actor's known sector/geography interest.
Otherwise record "attribution not assessed — insufficient evidence" and stop.
Diamond Model
Describe the intrusion on four vertices and the links between them:
| Vertex | Questions | Evidence sources |
|---|---|---|
| Adversary | Who operates it? (often unknown — that's fine) | intel reporting |
| Capability | Tools, malware, exploits, techniques | host forensics, ATT&CK mapping |
| Infrastructure | IPs, domains, C2, hosting | IOC enrichment |
| Victim | Which assets, users, sector | case entities, org context |
Meta-features: timestamp, phase (ATT&CK tactic), result, direction, methodology. Pivot vertex-to-vertex (e.g. infrastructure → other victims seen in intel) to test links.
Comparing to ATT&CK groups
- List the case's confirmed techniques (from
mitre-attack-mapping). - Compare with candidate groups' technique sets from public ATT&CK group pages
(via
search_external_contextfor the group name — public data only). - Overlap on common techniques (T1059, T1078, T1110) means little; weight distinctive techniques and tool names higher.
- Record competing hypotheses, including "unknown / commodity actor".
Estimative language (ICD 203 style)
Use consistent probability terms and state confidence separately:
| Term | Approx. probability |
|---|---|
| almost no chance / remote | 1–5% |
| very unlikely | 5–20% |
| unlikely | 20–45% |
| roughly even chance | 45–55% |
| likely | 55–80% |
| very likely | 80–95% |
| almost certainly | 95–99% |
Confidence (low / moderate / high) reflects evidence quality and source reliability, not probability. Example: "We assess it is unlikely (moderate confidence) that this activity is linked to group X; infrastructure overlap is limited to a shared hosting provider."
Rules
- Never name a nation-state sponsor on your own; at most reference public reporting and grade it.
- Distinguish commodity crimeware, opportunistic scanning, and targeted operations.
- Attribution never changes containment urgency by itself.
Output
add_findingtitledAttribution assessmentwith the Diamond Model table, competing hypotheses with estimative language and confidence, sources with Admiralty grades, and key gaps. standard_refs:MITRE-ATTACK.
