← Cyber Intelligence Foundations
Module 1: Start With the Decision
From Security Data to Intelligence Write an Intelligence Requirement
Module 2: Build an Evidence Base
Collect Evidence With a Plan Evaluate Sources and Claims
Module 3: Analyze, Report, and Improve
Describe Adversary Behavior Without Overclaiming Indicators of Compromise and Their Types Use Indicators With Context Write and Review a Decision-Ready Assessment
Module 4: Turn Intelligence Into Better Defense
Build a Bounded Defensive Hunt Keep Intelligence Useful Over Time
Module 5: Apply Intelligence to Common Security Problems
Build Vulnerability Intelligence That Prioritizes Action Analyze Identity and Social-Engineering Threats Analyze Malware and Ransomware Activity
Module 6: Operate Intelligence as a Capability
Work With Stakeholders and Decision-Makers Govern Intelligence and Handle Information Responsibly Share Structured Intelligence and Automate Safely
Module 3: Analyze, Report, and Improve

Describe Adversary Behavior Without Overclaiming

Use behavior, capability, and context to explain threats without treating attribution as certainty.

About this learning content: Courses, lessons, assessments, explanations and illustrations may be created with the help of artificial intelligence. We review and check the material and do our best to avoid incorrect or outdated information, but mistakes, omissions or ambiguous questions may remain. Please verify information before relying on it for professional, security, legal or operational decisions. Read the full notice or report an issue.

In this lesson, you will learn to:

  • Describe adversary behavior using observable evidence while separating capability, intent, opportunity, and attribution confidence.

Describe Adversary Behavior Without Overclaiming

This lesson teaches a careful way to discuss actors and campaigns. You will distinguish observed behavior from inferred intent and learn why technique overlap, shared infrastructure, and false flags make attribution a separate analytic claim.

Describe What the Adversary Can Do

A useful behavior description answers four questions: What capability is visible? What opportunity does the adversary have? What target or objective appears relevant? What evidence supports the assessment? This is more durable than starting with a dramatic actor label.

Suppose a campaign uses valid cloud accounts, sends convincing invoices, and creates mailbox forwarding rules. You can describe those observable behaviors, the access they require, and the defensive telemetry that could reveal them. You may assess that the activity is consistent with financially motivated credential theft. You should not state that a named group definitely conducted it unless the evidence supports that separate claim.

Use ATT&CK or another shared vocabulary to make behavior searchable, but do not confuse a technique mapping with attribution. Many actors can use the same technique. A technique says what happened or could happen; it does not, by itself, prove who acted, why they acted, or whether the activity belongs to one campaign.

Behavior, capability, opportunity, and objectiveA layered stack shows how observable behavior supports cautious assessments of capability, opportunity, objective, and possible identity. BEHAVIORAL ANALYSISBuild the claim from observable layers OBSERVED BEHAVIOR: mailbox forwarding ruleCAPABILITY: maintain email accessOPPORTUNITY: valid accountOBJECTIVE?Identity remains a separate claim requiring separate evidence.
Behavior, capability, opportunity, and objective — Four evidence layers build a behavior assessment while keeping identity and intent as separate claims.

Treat Attribution as a Hypothesis

Attribution can be useful, but it is often the least certain part of an assessment. Shared tools, copied procedures, compromised infrastructure, contractors, malware-as-a-service, and deliberate false flags reduce the uniqueness of many indicators. Government attribution may also rely on evidence unavailable to a private analyst.

Use a confidence statement that names the basis and the limits: “We assess with low confidence that the activity may be associated with Group A because of infrastructure overlap and targeting similarities; shared hosting and reused tools prevent a firm attribution.” This gives the reader a useful hypothesis without turning it into a fact.

Defensive action should usually depend on the behavior and exposure, not on winning the attribution debate. If the activity suggests credential theft, improve identity telemetry and protect accounts even while actor identity remains uncertain. If a domain is malicious-looking but evidence is weak, preserve it for investigation rather than blocking a broad provider range without context.

Attribution confidence with alternative explanationsA confidence scale moves from low to high while alternative explanations remain visible below the attribution hypothesis. ATTRIBUTION DISCIPLINEState the hypothesis and its limits LOWHIGHone overlapseveral signalsindependent supportrare evidenceALTERNATIVES: shared tools • compromised host • false flagDefend against the behavior while the hypothesis develops.
Attribution confidence with alternative explanations — A confidence scale keeps infrastructure overlap, targeting, shared tools, and alternative explanations visible beside an attribution hypothesis.

Resources

  • MITRE ATT&CK Groups — Compare group descriptions and techniques while practicing the distinction between documented behavior and attribution certainty.
← Previous: Evaluate Sources and Claims Next: Indicators of Compromise and Their Types →