3.3Attribution and artifacts

Incident investigation is not only reconstructing "what happened" but connecting "who," "to which asset," and "at what stage" they did what. That connecting work is attribution, relating assets, threat actor, and artifacts to build the whole picture. In practice, distinguishing whether an artifact is something that already happened (IoC) or something in progress right now (IoA) changes the urgency of response, and whether the evidence you collect holds up later hinges on the record of the chain of custody. This section addresses those judgment axes.

3.3.1Objects of attribution: assets and threat actor

• An asset is what must be protected (servers, endpoints, data, credentials, services). Investigation first fixes "which asset was touched" and assesses the impact scope (data sensitivity, business criticality). The intent and severity of an attack vary greatly with the value of the targeted asset.
• A threat actor is the entity carrying out the attack (external criminals, insiders, nation-state groups, etc.). Attribution infers "which actor/campaign" from TTPs (tactics, techniques, procedures), infrastructure (C2 domains/IPs), and tooling characteristics, helping decide the next move and defensive priorities. But a source IP can be spoofed or a relayed pivot, so do not conclude from a single indicator.

3.3.2IoC (indicator of compromise) and IoA (indicator of attack)

• An IoC (Indicator of Compromise) is an after-the-fact trace showing a compromise already occurred—a malicious file hash, a known-C2 domain/IP, a specific registry change, a dropped filename, and so on. It is past-tense evidence, used for detection/hunting and confirming contamination of other hosts.
• An IoA (Indicator of Attack) is a sign that an attack is in progress right now. Rather than a fixed item like a hash, it is a chain of behaviors showing intent (e.g., script launch from a document -> credential dumping -> attempted lateral movement). Being present-tense, an IoA caught early may let you stop the attack before compromise completes.
• The chain of custody is management that records without gaps who acquired/stored/transported/handed off evidence, and when, where, and how. Together with hash-based integrity checks, it guarantees the evidence is untampered so it holds up legally and organizationally. Evidence with a broken chain loses reliability.

Late at night you receive an EDR notification: "on one endpoint powershell.exe shows behavior equivalent to a credential-dumping tool and is then attempting connections to SMB (445) on multiple internal hosts." At the same time, a threat-intel feed shares the hash of a malicious file and a known C2 domain found days ago on an endpoint in another department. Lumping the two together as the same "evidence" leads to a wrong call. The feed's hash/C2 domain are IoCs—after-the-fact traces of a compromise that already happened—used to hunt "which other endpoints are already contaminated by the same malware." The chain of behaviors unfolding in front of you now—"credential dumping -> attempted SMB lateral movement"—is an IoA, a sign of an attack in progress, with a completely different urgency of response. The correct judgment prioritizes, for the IoA, stopping the progression (isolate the endpoint, revoke credentials, block the lateral-movement ports) while using the IoCs to broadly confirm the scope of contamination. And when preserving the isolated endpoint's memory/disk, record the acquisition time, handler, method, and hash value, and keep the subsequent storage/transport/handoff as an unbroken chain of custody. Neglect this and, when later asked "can you assert this evidence is untampered," its reliability collapses. As for attribution, even if the C2 domain matches a known campaign, the source IP may be a pivot, so infer by correlating multiple indicators—TTPs, infrastructure, tooling— and avoid concluding from a single one. First distinguish whether an artifact is after-the-fact (IoC) or in-progress (IoA); stop the in-progress, use the after-the-fact for scoping, and preserve both while keeping the chain intact—this order is the backbone of investigative response.

3.3.3Section summary

• Attribution connects assets, threat actor, and artifacts; identify the threat actor by inferring from TTPs/infrastructure/tooling, not a single indicator
• An IoC is a fixed after-the-fact trace (hash/C2/registry change—used for scoping); an IoA is an in-progress chain of behaviors (stop it early)—first distinguish after-the-fact from in-progress
• The chain of custody records acquisition-storage-transport-handoff without gaps and guarantees integrity with hashes; evidence with a broken chain loses reliability