Lion Cipher Lab
Model an intrusion as an ATT&CK flow: the sequence, not a checklist of techniques
- Threat Intel Analyst
- Intermediate
- ~90 min
- Free · no account required
Why it matters
Ask most analysts to summarise an intrusion and you get a list: twelve ATT&CK technique IDs in a bag. That list is genuinely useful and genuinely lossy — it throws away the ORDER the techniques happened in, the DEPENDENCIES between them (this step was only possible because that step succeeded), and the ASSETS involved. Which is a disaster, because those three things are exactly what tells you where ONE control would have broken the whole chain. A checklist says 'we saw T1190, T1059.001, T1053.005, T1003.001.' A flow says 'everything you are looking at hangs off one unpatched internet-facing…
What you'll learn
- Attack Flow (the language, not just the diagram)
- turning a public incident report into an ordered graph
- attack-action, attack-asset, attack-condition and attack-operator objects
- AND/OR branching and effect_refs edges
- recording per-action confidence on a defined scale
- chokepoint analysis — finding the node the whole chain depends on
- annotating a flow with detection coverage
- using the Attack Flow Builder and exporting STIX 2.1 JSON
- validating a flow with the project's own CLI
- knowing when a flow is the wrong artifact
Steps in this lab
- The problem: a bag of technique IDs is not a story
- What Attack Flow is, and where it actually lives now
- The vocabulary: five object types and that is genuinely all
- Why this, not a whiteboard drawing: it is a STIX 2.1 extension
- Choose the report — and choose it for ORDER, not for detail
- Write the ordered action table BEFORE you open any tool
- Open the Attack Flow Builder and place your first action
- Connect the nodes — the edges are the whole point
- Save it properly: .afb to keep working, .json to hand to a machine
- Validate it, and render it, with the project's own CLI (optional but worth it)
- Calibrate: compare yours against the official corpus flow
- The payoff: chokepoint analysis, and the detect/no-detect pass
- The pro move: keep the unknowns as gaps, and know when NOT to build a flow