TTP-Based Attribution — Diamond Model and MITRE ATT&CK Groups

Attribution is an analytic product, not a technical finding. Evidence informs the assessment — confidence levels communicate the uncertainty.

Diamond Model Analysis Workflow

DIAMOND MODEL ANALYSIS TEMPLATE
================================

VICTIM VERTEX:
  Organization: [Target org name and sector]
  Industry: [Healthcare / Defense / Finance / Energy]
  Geographic location: [Country/region]
  Crown jewels targeted: [R&D data / financial data / PII / operational data]
  Notable context: [Ongoing M&A? Defense contractor? Government supplier?]

ADVERSARY VERTEX (inferred — highest uncertainty):
  Motivation (inferred from victim + capability): [Espionage / Financial / Destructive / Ideological]
  Sophistication level: [Nation-state / Advanced criminal / Mid-tier / Low-tier]
  Possible groups (with confidence): [APTxx with LOW confidence based on TTP similarity]

CAPABILITY VERTEX (directly observable):
  Malware families identified: [CS Beacon, custom dropper, keylogger]
  Exploit used for initial access: [CVE-YYYY-XXXXX, phishing, supply chain]
  Persistence mechanisms: [Scheduled task, WMI subscription, modified service]
  C2 mechanism: [HTTPS beacon, DNS tunneling, cloud storage API]
  Operational patterns: [Active hours UTC, dwell time, pace of operations]

INFRASTRUCTURE VERTEX (directly observable):
  C2 IPs: [List with ASN and hosting provider]
  Domains: [With registration date, registrar, WHOIS privacy]
  Hosting: [Bulletproof, legitimate cloud, compromised]
  TLS certificates: [Specific cert fingerprints, CA used]
  Overlaps with known infrastructure: [VirusTotal, Shodan, threat intel feeds]

LINKAGE ANALYSIS:
  This intrusion shares [N] diamond features with [previously documented campaign]:
    - Same C2 beacon profile → same capability
    - Same hosting ASN pattern → same infrastructure provider preference
    - Same targeting of [sector] → same victim profile
  Attribution confidence: [Low/Moderate/High]
  Assessment: "We assess with [confidence] that this intrusion was conducted by 
               [actor/group], based on [specific evidence]."

TTP Mapping to ATT&CK

# Hypothetical TTP mapping from an IR investigation
# This is the structured output that feeds attribution analysis

observed_ttps = {
    "Initial Access": ["T1566.002"],          # Spearphishing with link
    "Execution": ["T1059.001", "T1047"],      # PowerShell, WMI
    "Persistence": ["T1053.005", "T1546.003"], # Scheduled Task, WMI Event Subscription  
    "Privilege Escalation": ["T1055", "T1078.002"],  # Process injection, Domain Accounts
    "Defense Evasion": ["T1140", "T1036.005"],  # Decode/Deobfuscate, Match Legitimate Name
    "Credential Access": ["T1003.001", "T1558.003"],  # LSASS Memory, Kerberoasting
    "Discovery": ["T1018", "T1087.002"],       # Remote System Discovery, Domain Account Discovery
    "Lateral Movement": ["T1021.006", "T1550.002"],  # WMI Remote, PtH
    "Collection": ["T1074.002", "T1560.001"],  # Remote Staging, Compress with Utility
    "Exfiltration": ["T1048.003"]              # Exfil Over Alt Protocol (HTTPS to cloud)
}

# Compare against ATT&CK Groups:
# Groups that use WMI for execution AND lateral movement (T1047 + T1021.006):
# → APT33 (Iranian, T1047 documented)
# → APT41 (Chinese, T1047 documented)
# → Wizard Spider (criminal, T1047 documented)
# 
# Groups that use WMI Event Subscription for persistence (T1546.003):
# → APT33, Turla, Lazarus Group, FIN7
#
# The COMBINATION of T1046.003 + T1021.006 + T1558.003 is more specific
# Cross-reference with victim sector and infrastructure for higher confidence

Infrastructure Intelligence

# Threat intelligence investigation of observed C2 infrastructure

# Step 1: Passive DNS lookup for C2 domains
# Use VirusTotal, SecurityTrails, or RiskIQ PassiveTotal
curl "https://www.virustotal.com/api/v3/domains/{domain}/resolutions" \
  -H "x-apikey: YOUR_VT_KEY" | jq '.data[].attributes | {ip: .ip_address, date: .date}'

# Step 2: Shodan search for C2 server characteristics
# A Cobalt Strike server has specific fingerprints:
# - Default certificate: CN=Major Cobalt Strike, OU=AdvancedPenTesting
# - Default port 50050 (team server, often firewalled)
# - HTTP response containing specific Cobalt Strike artifacts
shodan search "ssl.cert.subject.cn:'Major Cobalt Strike'" --fields ip_str,port,org

# Step 3: Check if domain/IP appears in threat intel feeds
# Commercial: Recorded Future, Mandiant Advantage, CrowdStrike Falcon Intel
# Free: AlienVault OTX, MISP, abuse.ch URLhaus

# Step 4: Domain registration analysis
# Registration age (newly registered = less confidence of persistent infrastructure)
# Registrar pattern (certain registrars are preferred by certain groups)
# WHOIS privacy (most threat actors use privacy services)
whois domain.example.com | grep -E "Creation Date|Registrar|Registrant"

# Step 5: TLS certificate fingerprint search
# Certificates with the same hash or common fields across different IPs
# indicate same operator (certificate reuse is a common attribution evidence)
echo | openssl s_client -connect target_ip:443 2>/dev/null | \
  openssl x509 -noout -fingerprint -sha256
# Search this fingerprint in Shodan/Censys for other IPs with the same cert

Retrieval Practice

An IR investigation finds: phishing email sent to defense contractors only, WMI-based lateral movement, Kerberoasting of high-privilege service accounts, data staged in a custom encrypted format, exfiltration to a Dropbox-like API over HTTPS, active only 09:00-17:00 Beijing time (UTC+8), and the C2 domain was registered 3 weeks before the attack began. How would you structure an attribution assessment and what confidence level is appropriate?

Reveal answer

Diamond Model analysis: VICTIM: Defense contractors (high-value targeting consistent with nation-state espionage rather than financial crime). CAPABILITY: Kerberoasting (skilled AD attacker), WMI lateral movement (evasion-focused, avoids common detection of PSExec), custom staging format (custom development capability), cloud API exfiltration (HTTPS blending with legitimate traffic). INFRASTRUCTURE: Short-lived domain (3 weeks — operational security practice), no infrastructure reuse detected. ADVERSARY (inferred): The combination of defense contractor targeting + custom tooling + Beijing business hours + sophisticated AD exploitation is consistent with Chinese cyber espionage activity. Groups associated with these TTPs: APT10, APT41, APT40 all have defense sector targeting. However: Beijing business hours could indicate China-based actors OR time-zone spoofing by another actor. WMI + Kerberoasting is used by many groups including criminal ransomware operators. Custom exfiltration format is not specific enough to narrow to a specific group without malware analysis matching known samples. Attribution statement: 'We assess with LOW confidence that this intrusion was conducted by a China-nexus threat actor, based on: (1) targeting of defense contractors consistent with known PRC espionage tasking, (2) operational hours consistent with UTC+8 business hours, (3) TTP sophistication consistent with nation-state capability. This assessment is limited by: lack of malware sample overlap with publicly attributed campaigns, no confirmed infrastructure linkage to known groups, and the possibility of time-zone spoofing.' This is the appropriate structure: state the assessment, state the evidence basis, explicitly state the limitations. Do NOT say 'this was APT41' without independent corroborating intelligence.