Summary
This white paper discusses the concept of human fingerprints in the context of malware analysis. The paper outlines how malware serves as a tool for adversaries in cyber threats and provides valuable information for cyber threat intelligence. Specifically, it focuses on the Diamond Model as a framework for structuring the analysis of malware and its associated features. The paper categorizes adversarial elements into four key features: Adversary, Infrastructure, Capability, and Victim. Each feature plays a crucial role in understanding and analyzing intrusions. The Adversary feature highlights human choices in intrusions, while the Infrastructure feature pertains to the mechanisms used to deliver the malware. The Capability feature focuses on the tools and methods employed by adversaries, and the Victim feature describes the targets of these intrusions. The paper aims to introduce and expand knowledge of these concepts, encouraging analysts to cluster intrusions for improved proactive defense strategies.
