What information is required for attribution during an investigation?
Attribution links an intrusion to a threat actor by correlating observed behavior—such as tactics, techniques, procedures, and other behavioral fingerprints—with activity associated with that actor. MITRE ATT&CK documents adversary groups together with their known behaviors, supporting this form of correlation.
Community Discussion