# Threat Attribution Methodology

## Attribution Framework

### Technical Attribution Indicators

#### Infrastructure Analysis
- **Domain registration patterns**: registrar, privacy services, naming conventions
- **IP address allocation**: ASN patterns, hosting providers, geographic distribution
- **SSL/TLS certificates**: issuer patterns, subject fields, validity periods
- **DNS configuration**: nameserver patterns, TTL values, record types

#### Malware Analysis
- **Code similarities**: shared functions, libraries, string tables
- **Compilation artifacts**: compiler version, language, build environment
- **PDB paths**: developer usernames, project names, directory structure
- **Timestamps**: compile times (timezone inference), modification dates
- **Digital signatures**: stolen certificates, self-signed patterns

#### Operational Patterns
- **Working hours**: activity correlated with timezone/business hours
- **Language artifacts**: keyboard layouts, locale settings, comments
- **Tool preferences**: specific exploitation frameworks, C2 platforms
- **Target selection**: sector, geography, organization size patterns

### Attribution Confidence Levels

| Level | Criteria | Example |
|-------|----------|---------|
| **Definitive** | Multiple independent technical + human intelligence sources; government-level attribution | APT28/Fancy Bear → GRU Unit 26165 |
| **High confidence** | Strong technical overlap with known actor; consistent TTPs; corroborating HUMINT | Code reuse + infrastructure overlap + target alignment |
| **Moderate confidence** | Significant technical indicators; some alternative explanations possible | Shared C2 infrastructure + similar malware family |
| **Low confidence** | Limited technical indicators; multiple plausible actors | Geographic targeting + general TTP alignment |
| **Unattributed** | Insufficient evidence for any attribution | Novel tooling, no infrastructure overlap |

### False Flag Considerations
- **Deliberate misdirection**: embedded language strings, timezone manipulation, copied code
- **Shared tooling**: commercial/open-source tools used by multiple actors
- **Infrastructure reuse**: bulletproof hosting used by many groups
- **Contractor overlap**: shared developers across state-sponsored programs

## Threat Actor Profiling Template

```markdown
# [Actor Name/Designation]

## Aliases
- [List all known names across vendors]

## Attribution
- **Sponsor**: [State/Criminal/Hacktivist/Unknown]
- **Country**: [Assessed origin]
- **Confidence**: [Definitive/High/Moderate/Low]
- **Unit/Organization**: [If known]

## Motivation
- [Espionage/Financial/Disruption/Destruction]

## Target Profile
- **Sectors**: [Industries targeted]
- **Geography**: [Regions targeted]
- **Organization size**: [Enterprise/SMB/Government]

## Technical Profile
### Initial Access
- [Preferred entry vectors with ATT&CK IDs]

### Tooling
- **Custom**: [Proprietary malware families]
- **Shared**: [Open-source/commercial tools]
- **Living-off-the-land**: [LOLBins used]

### Infrastructure
- **C2**: [Protocols, platforms, patterns]
- **Staging**: [Hosting preferences]
- **Exfiltration**: [Methods, destinations]

## Campaign History
| Date | Campaign | Targets | Tools | Reference |
|------|----------|---------|-------|-----------|
| YYYY-MM | [Name] | [Targets] | [Tools] | [Link] |

## Detection Opportunities
- [Specific signatures, behavioral indicators]
- [YARA rules, Sigma rules, Snort/Suricata rules]

## References
- [Reports, advisories, blog posts]
```

## Attribution Analysis Workflow

1. **Collect artifacts**: malware samples, network logs, infrastructure data
2. **Technical analysis**: reverse engineering, infrastructure mapping, TTP extraction
3. **Cluster activity**: group related incidents by shared indicators
4. **Compare to known actors**: overlay TTPs against known threat actor profiles
5. **Assess alternative hypotheses**: consider false flags, shared tooling, contractors
6. **Determine confidence level**: apply framework criteria above
7. **Document and disseminate**: produce attribution assessment with evidence chain
8. **Track and update**: monitor for confirming/disconfirming evidence over time
