Host-Based Analysis · Topic 3 of 5
Attribution and Types of Evidence
Learn the role of attribution in an investigation, including assets, threat actors, IoCs, IoAs and chain of custody, and the types of evidence in logs.
- 5 min
- An asset is anything of value that may be targeted.
- A threat actor is the person or group behind the attack.
- An IoC is a sign that a compromise has already happened.
What it is
Attribution is the work of linking an attack to an actor, and evidence is what supports every claim made along the way.
An investigation needs to know what was attacked, who did it, how they did it and what proof exists. Each of those questions uses a specific term from the outline.
This page covers the terms used to describe the attack, and the three types of evidence an analyst finds in logs.
How it works
Attribution builds from assets and indicators, and the strength of the case depends on the type of evidence.
Assets and threat actors
An asset is anything of value to the organisation, such as a server, a database, an account or intellectual property. Knowing which asset was hit sets how serious the incident is.
A threat actor is the person or group behind the attack. Attribution tries to name or describe the actor from the techniques, tools, infrastructure and goals seen. It is often uncertain, and it may be less important than stopping the attack.
Indicators of compromise and indicators of attack
| Term | Meaning | Examples |
|---|---|---|
| Indicator of compromise (IoC) | Evidence that a compromise has already happened | A known bad file hash, a malicious domain, an unusual registry key |
| Indicator of attack (IoA) | Evidence of an attacker's actions or intent while an attack is under way | A document that spawns a shell, scanning followed by a login attempt |
An IoC is about the artefacts left behind. It is useful for searching other machines for the same sign. An IoA is about behaviour and sequence, so it can catch an attack in progress, even when the tools are new.
IoCs tend to be specific and short lived, because attackers change addresses and files. IoAs describe techniques that change less often.
Chain of custody
Chain of custody is the documented record of who handled evidence, when, and what they did with it. It shows that the evidence was not altered or swapped.
A good record includes:
- What the item is and where it was found
- Who collected it, with date and time
- A hash of the data when it was collected
- Every transfer between people and places
- How and where it was stored
If the chain is broken, the evidence may not be accepted in a legal or disciplinary process.
Types of evidence
| Type | Meaning | Example |
|---|---|---|
| Best evidence | The original, or the most direct form, of the proof | The original disk or the original log file |
| Corroborative evidence | Supporting evidence that backs up other evidence | A firewall log that agrees with a server log |
| Indirect evidence | Evidence that suggests a fact without proving it directly, so it needs inference | A user was seen near the server, or a login at an odd hour |
Best evidence is the original. In a case about a log entry, the original log is stronger than a screenshot or a typed copy. A forensic copy with a verified hash is generally treated as equivalent to the original, so analysts work on copies and leave originals untouched.
Corroborative evidence strengthens a claim. Two independent sources agreeing, such as a proxy log and an endpoint log showing the same download, is stronger than one.
Indirect evidence, sometimes called circumstantial, needs a chain of reasoning. It points toward a conclusion, but another explanation may exist.
Working through a scenario
A server log shows a file copied out at 2 am. A firewall log shows a large upload at the same time. A user account had a failed login earlier.
- The original server log is best evidence of the copy.
- The firewall record that agrees with it is corroborative evidence.
- The failed login suggests that someone was guessing passwords, but does not prove who copied the file, so it is indirect evidence.
What to remember for the exam
Seven facts cover most questions on this topic.
- An asset is anything of value that may be targeted.
- A threat actor is the person or group behind the attack.
- An IoC is a sign that a compromise has already happened.
- An IoA is a sign of attacker behaviour while an attack is under way.
- Chain of custody records who handled evidence and when.
- Best evidence is the original or most direct form of the proof.
- Corroborative evidence supports other evidence, and indirect evidence needs inference.
If the evidence needs a leap of reasoning to link it to the event, it is indirect.
Common mistakes
These four errors appear often.
Mixing up IoC and IoA. An IoC is the artefact left behind, and an IoA is the behaviour of the attack.
Working on the original evidence. Analysts work on verified copies and protect the original.
Treating attribution as certain. Naming an actor from technical traces is often a judgement with some doubt.
Failing to record a transfer. A gap in the chain of custody weakens the evidence.
Hash evidence when you collect it, and record the hash in the chain of custody form.
Check yourself
Work through these three questions.
How does an IoA differ from an IoC?
An IoA shows attacker behaviour while an attack is under way. An IoC is a trace left behind that shows a compromise has happened.
What does chain of custody record?
It records who handled the evidence, when, and what was done with it, so the evidence can be shown to be unaltered.
What is corroborative evidence?
It is evidence that supports and backs up other evidence, such as two independent logs that agree.
Topic 3 of 5 in Host-Based Analysis
Test yourself on Host-Based Analysis
The full Cisco CCNA 200-201 CBROPS question bank has 754 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.