Lion Cipher Lab
Attribute an adversary's working hours and work-week from timestamps (and why it is a weak signal)
- Threat Intel Analyst
- Intermediate
- ~35 min
- Free · no account required
Why it matters
Behind every intrusion is a person who sleeps, eats lunch, and takes the weekend off. When you have many timestamps tied to one actor -- when their malware was compiled, when their command-and-control domains were registered, when they were active on target -- those times cluster around that person's local 9-to-5, which quietly leaks their timezone and even their work-week. Analysts have used exactly this to narrow attribution for years. But it is also one of the easiest signals to fake, so learning to read it AND learning not to over-trust it are the same skill. This lab teaches both on a…
What you'll learn
- Attribution tradecraft
- Pattern-of-life analysis
- Timestamp and metadata analysis
- Timezone and work-week inference
- Calibrating analytic confidence
Steps in this lab
- The idea: timestamps leak the human behind the keyboard
- Set up a folder (nothing to install)
- Generate a timeline you can trust (because you built it)
- Build the hour histogram and read the operator's clock
- Read the work-week from the two quiet days
- Measure yourself against the answer key
- How a pro does it better -- and how a pro gets fooled