Introducing Unit 42’s Attribution Framework
Unit 42 releases its Attribution Framework, a systematic method using Diamond Model and Admiralty scores to attribute activity clusters to named threat actors.
Palo Alto Networks' Unit 42 introduced a structured framework for threat actor attribution built on the Diamond Model of Intrusion Analysis and Admiralty reliability/credibility scoring. The framework tracks activity at three levels: activity clusters (named CL-STA, CL-CRI, CL-UNK, or CL-MIX), temporary threat groups, and named threat actors using the constellation naming schema. Analysts score evidence across TTPs, tooling, malware code, OPSEC, infrastructure, timelines, and victimology to decide when to merge or elevate clusters, avoiding premature group naming.
- Three attribution levels: activity clusters, temporary threat groups, and named threat actors
- Admiralty System scores assess source reliability and information credibility for each evidence item
- Clusters generally require at least two related observables such as shared IoCs, TTPs, or victimology
- Cluster naming uses motivation tags UNK, STA, CRI, or MIX, for example CL-STA-0001
- Premature group naming is avoided until sufficient visibility across evidence is achieved
- Vendors
- Palo Alto Networks
- Products
- Unit 42
- Organizations
- Palo Alto NetworksUnit 42
From the original article
13 min read at unit42.paloaltonetworks.com
Threat actor attribution has traditionally been considered more art than science, often relying heavily on a few threat researchers to confirm observed activity. This approach is unsustainable and contributes to confusion in naming threat groups. We have addressed this by creating the Unit 42 Attribution Framework, while leveraging the excellent work of the Diamond Model of Intrusion Analysis .
By Andy Piazza, Kyle Wilhoit, David Fuertes, Robert Falcone · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.