Lion Cipher Lab
Track how an actor's tradecraft changes across ATT&CK campaigns (and test whether the change is real)
- Threat Intel Analyst
- Advanced
- ~90 min
- Free · no account required
Why it matters
Every intelligence brief eventually claims something about change over time: 'the group has shifted to living-off-the-land', 'they reused the same playbook', 'their tradecraft is evolving'. Those claims drive real decisions, from which detections to build to which threat to brief the board on. ATT&CK's campaign objects let you test them against data instead of instinct, because each campaign is dated and tied to a group. But the data was built from public reporting, not from watching the actor, so the obvious measurement mostly measures how much was written about each operation. This lab…
What you'll learn
- Reading ATT&CK campaign objects: first_seen / last_seen, their citations, and attributed-to relationships to groups
- Ordering a group's campaigns in time and measuring technique churn with Jaccard similarity at technique and parent-technique level
- Separating core tradecraft (in every campaign) from one-off techniques, and weighting the core by how rare it is across all campaigns
- Building a baseline (same-group pairs vs every other pair) before calling a similarity number high or low
- Measuring reporting density as a confounder: how strongly technique count tracks citation count
- Merging the Enterprise and ICS bundles for the same campaigns, and explaining why the picture changes
- Turning rarity-weighted core tradecraft into a detection priority list, with its limits stated
Steps in this lab
- From one snapshot to a timeline: what a campaign object adds
- Pin both halves of the dataset: Enterprise and ICS v20.0
- Inventory the campaigns: who, how many, how precisely dated, how well reported
- Measure the churn: Sandworm's three Ukraine power-grid campaigns
- Granularity changes the answer: technique vs parent technique, and the v19 tactic split
- The other half of the story lives in a different bundle: add ICS
- Is 0.12 low? Build the baseline before you interpret
- Rarity-weighted core tradecraft: what to put first in the detection backlog
- What campaign churn can and cannot tell you (the judgement)
- Where to go next