Cyber Defense eMagazine May 2019

identities. Certainly, some attacks will always be worth the cost for malicious attackers, but by using PAI
to deny those malicious actors the certainty of anonymity, we can deter and disrupt attacks at scale.
The problem
While there are myriad methods for attribution, it’s useful to think in terms of two general categories. One
category begins with a persona search seed, such as an email address, social media handle or
username. The second category begins with a technical indicator, such as a code snippet, registry value,
IP address or domain name. I’ll discuss each separately, but in a real-world scenario, both methods
typically work in tandem.
A persona search seed can be a valuable lead for querying a variety of sources. Those sources can run
the gamut from the open internet to the deep web, to the dark web. Forums, social media, and news
sources can often yield artifacts that further the investigation. Ultimately, each artifact increases the
investigator’s ability to correlate the information they find, allowing them to drive toward a malicious
actor’s true identity with a high level of confidence.
Of course, using a persona search seed can feel a lot like looking for a needle in a haystack—or more
accurately, multiple needles in seemingly unrelated haystacks. But even the most sophisticated malicious
actors are susceptible to unmasking because they frequently must use public-facing personas, such as
email addresses, to launch their attacks. Furthermore, while a sophisticated actor may practice strong
tradecraft, their associates may not. By building context with PAI, investigators can expose the weakest
link in the chain and then exploit that advantage to develop attribution of the primary threat actor. Finally,
it’s important to note that many malicious actors, especially criminals, practice sloppy tradecraft. In many
cases, criminals boast about their exploits, and often times those boasts are made in time-stamped
forums that allow investigators to intuit their approximate location, intentions, associations and patterns
of life.
Of course, a technical indicator, such as snippets of code, malware, and IP addresses can also be a
starting point that leads to attribution. Sometimes, a simple file name might provide an artifact that can
be used to run a PAI query. Other times paste bins and further accessible documents that support
technical collaboration also contain email addresses or handles that can be used in a PAI query.
Increasingly, as malicious actors repurpose commodity malware coupled with novel, public-facing
command and control infrastructures, they’re more likely to leave artifacts useful for attribution sprinkled
throughout the attack framework. With the right tools and methods, analysist’s can follow these technical
leads to improve attribution.
Whether used separately or in tandem, both approaches can provide valuable starting points for PAI
inquiries. In time, as investigators assemble more artifacts and build a context around their targets, pulling
122