Processing, Exploitation, and Analysis Tradecraft
Processing, Exploitation, and Analysis Tradecraft tests the middle of the intelligence cycle: converting raw collection into assessed, decision-ready intelligence. Expect questions on normalization, enrichment, fusion, structured analytic techniques, hypothesis testing, confidence, and cognitive bias.
Core rules
- Processing includes parsing, field normalization, deduplication, timestamp normalization to UTC, and preservation of raw data. Do not destroy the original artifact when enriching it.
- Enrichment adds context such as WHOIS, passive DNS, malware sandbox results, certificate data, and ATT&CK mapping. Enrichment is not analysis; it supplies evidence.
- Exploitation means pivoting across artifacts and relationships: infrastructure links, registrations, malware families, victimology, and timelines.
- Analysis uses structured analytic techniques (SATs) to make reasoning auditable: Analysis of Competing Hypotheses (ACH), key assumptions check, devil's advocacy, what-if analysis, and red-team review.
- Document evidence for and against each hypothesis. A judgment should show what would change it.
- Use consistent confidence language. Distinguish confidence in the source from confidence in the judgment, and avoid false precision.
- Control bias: confirmation bias, anchoring, availability bias, and mirror-imaging are common failure modes.
Worked example
Three intrusions share an ASN, a phishing kit, and overlapping C2 domain registration patterns. Hypotheses: (1) one actor, (2) a shared criminal service used by multiple actors, (3) a false flag. An ACH matrix scores each hypothesis against the evidence. Shared infrastructure strongly supports common tooling but only weakly supports a single actor; the false-flag hypothesis lacks supporting evidence. The assessment is 'moderate confidence in a shared criminal service, low confidence in a single actor.' The recommendation is further collection on victimology and operator behavior, not immediate attribution.
Traps that cost marks
- Treating ATT&CK mapping or enrichment as finished analysis.
- Confirming the first plausible hypothesis and stopping.
- Using 'high confidence' without evidence or a stated basis.
- Confusing correlation with causation.
- Losing raw data or timestamps during normalization.