Adversary Tradecraft and Attack Lifecycle Analysis
Adversary Tradecraft and Attack Lifecycle Analysis tests your ability to describe how adversaries operate and map behavior to frameworks. Expect the Cyber Kill Chain, the Diamond Model, MITRE ATT&CK, TTPs, intrusion sets, campaigns, infrastructure, victimology, and attribution reasoning.
Core rules
- The Kill Chain describes phases from reconnaissance through weaponization, delivery, exploitation, installation, command and control, and actions on objectives. Use it to locate activity and identify disruption points.
- The Diamond Model relates adversary, capability, infrastructure, and victim. Pivoting on any vertex can reveal related activity.
- ATT&CK organizes adversary behavior into tactics and techniques. Tactics are the goal; techniques are how the goal is achieved; procedures are specific implementations.
- Distinguish activity, campaign, intrusion set, and threat actor. A tool or malware family is not an actor. Shared tooling can indicate a common service rather than a common sponsor.
- Analyze at the TTP level as well as the IOC level. TTPs are more costly for adversaries to change and more durable for detection.
- Attribution is probabilistic. State the assessed actor, the evidence, alternative explanations, and confidence. Consider false flags, shared infrastructure, and borrowed tooling.
Worked example
A phishing email delivers a macro that launches Cobalt Strike, followed by credential dumping and lateral movement. Mapping shows initial access via phishing, execution via macro, command and control over HTTPS, credential access via LSASS dumping, and lateral movement via SMB. The team should not name a state actor: Cobalt Strike is commodity tooling. The defensible judgment is 'an intrusion using commodity post-exploitation tooling,' with moderate confidence. The operational output is hunting for the named techniques across the estate and blocking the specific infrastructure, not an attribution claim.
Traps that cost marks
- Building the entire assessment on IOCs that change quickly.
- Naming an actor before testing alternative explanations.
- Confusing a technique with a specific procedure or tool.
- Ignoring the victim's environment, which shapes what activity is visible.
- Treating ATT&CK mapping as attribution.