Attribution Under Conflicting Signals at a Regional Bank
You are the sole CTI analyst at a 2,000-employee regional bank. At 07:10 a paid vendor feed publishes a report titled 'FIN7 Targeting U.S. Regional Banks via Cobalt Strike.' At 07:40 the SIEM correlates a rare external IP, 185.199.108.153, with beacon-like HTTPS traffic from one teller workstation. The vendor report lists that same IP as C2. Your proxy logs show the workstation contacted the IP during a scheduled penetration test four weeks earlier, and a free OSINT service labels the IP a Tor exit node. No malware sample is available; the endpoint agent was offline for 36 hours and has not yet been triaged. The user is on leave. The incident response bridge is at 13:00 and the CISO wants a yes/no answer: 'Are we being targeted by FIN7?' Your team has no reverse-engineering capability and only NetFlow, proxy, and EDR telemetry.
1. What structured analytic technique should you use to weigh the competing explanations, and what evidence would you map?
Read the worked answer
Use Analysis of Competing Hypotheses (ACH). List at least: H1 FIN7 targeted intrusion; H2 authorized penetration-test residue; H3 commodity malware using shared infrastructure; H4 Tor exit-node noise; H5 insider or unapproved testing. Build an evidence matrix with rows for the vendor report naming the IP, beacon-like HTTPS cadence, single-host scope, prior pen-test contact, Tor label, user on leave, and the 36-hour EDR gap. Score each cell as consistent, inconsistent, or not applicable. H1 explains the IP and beaconing but is weakened by the pen-test history and Tor label. H2 explains prior contact but not necessarily current cadence. H3 and H4 explain reputation data but not host-specific timing. The key ACH discipline is to seek disconfirming evidence: does the beacon interval match the pen-test tool? Did passive DNS show the IP changed ownership? Do not anchor on the vendor's title.
2. Write the confidence statement you would give at 13:00 and justify the confidence level.
Read the worked answer
At 13:00 I would say: 'We assess with low confidence that this workstation is conducting beacon-like communication to infrastructure named in a vendor report. We assess with very low confidence that FIN7 is the actor. The IP has alternative benign explanations, no sample exists, and EDR coverage was absent for 36 hours. We recommend isolating the host and preserving memory rather than enterprise-wide containment.' Separate three claims: observed activity, capability, and attribution. Confidence is low because the source is a single vendor, corroboration is ambiguous, and malware is unavailable. Confidence would rise to moderate if memory captured a Cobalt Strike beacon configuration or if passive DNS and certificate history tied the IP to known FIN7 infrastructure. It would fall if the penetration-test vendor confirms it used that IP on those dates.
3. What collection would most change your assessment in the next six hours, and how would you task it?
Read the worked answer
Prioritize collection that distinguishes H1 from H2/H3/H4. Task endpoint forensics to recover EDR offline cache, PowerShell and Windows event logs, and a memory image if tooling exists. Task network teams to query passive DNS, TLS certificate history, and proxy logs for any other host contacting the same IP or domain. Contact the penetration-test vendor for its IP list, dates, and tooling. Review authentication logs for lateral movement from the workstation. Assign each request an owner, deadline, and priority. Document chain of custody. This is a lawful, proportionate collection plan tied to a specific intelligence requirement: 'Is there current beaconing to known C2, and is it unique to this host?'
4. How would you avoid bias in the final report to the CISO?
Read the worked answer
State the vendor's claim separately from your assessment, label all confidence levels, and include the alternative explanations. Use language such as 'the IP is named in a vendor report' rather than 'the IP is FIN7 C2.' Include what would change the judgment. Avoid mirror-imaging or assuming a sophisticated actor because the vendor says so. Have a peer review the ACH matrix if possible. In the recommendation, focus on risk reduction that is robust across hypotheses: isolate the host, preserve evidence, and block the IP only after checking business impact.