Unit 1: Who attacks and how · Lesson 1 of 4 · 16 min
Who attacks and why
Build a one-line threat profile for Northwind from the actor list.
mission
- You are
- A new analyst in Northwind Freight's SOC.
- Situation
- Your manager asks who is most likely to attack a freight company and what they would go after. The intel team keeps a short actor list on the workstation.
- Goal
- Read the list and name the actor that matters most to Northwind, with its motive and methods.
- Hand in
- One sentence: who, why and how they usually get in.
Open the case folder
Every case on this workstation starts with a README. Read it before touching the data so you know what each file is.
ls README.txt actors.csv alerts.csv stages.txt cat README.txt Case: IR-2026-0921, closed Last month's intrusion, kept for training. The SIEM tagged every alert with the stage of the attack it belongs to. Files: actors.csv who attacks companies like Northwind, and why stages.txt the stages of an attack, in order, and what you see alerts.csv every alert from the incident, oldest first
you should see Three files: actors, stages and alerts.
Read the actor list as a table
CSV is hard to scan raw. column lines the fields up so you can compare rows.
column -s, -t actors.csv
actor motive targets methods
financially motivated crew money finance teams and payroll invoice fraud; gift card scams; ransomware
hacktivist group ideology public websites defacement; leaks; denial of service
insider grievance or money data they can already reach copying files; misusing access
state-backed group espionage suppliers and logistics data long quiet access; stolen credentials
opportunist easy wins anything exposed to the internet scanning; default passwords; old software
you should see Each row pairs a motive with the targets it leads to.
defender tip Motive predicts targets. A crew after money goes for whoever can move money, so finance and payroll get the most phishing.
Filter for what Northwind has
Northwind moves money to suppliers every day. Filter the list for the actors that go after finance.
grep -i finance actors.csv financially motivated crew,money,finance teams and payroll,invoice fraud; gift card scams; ransomware grep -i finance actors.csv | cut -d, -f4 invoice fraud; gift card scams; ransomware
you should see Invoice fraud and gift card scams lead the methods list.
Check who wants the logistics data
Freight data, routes and customers, is worth something to a different actor. Look for it too.
grep -i logistics actors.csv | cut -d, -f1,2
state-backed group,espionage
defender tip Espionage actors are quiet and patient. They show up as odd logins weeks apart, not as loud alerts.
Two ways to brief your manager
Threat: hackers Risk: high Action: be careful
Threat: financially motivated crew Wants: supplier payments How: invoice fraud, gift card scams Watch: bank-change emails to finance
Specific enough to decide what to monitor first.
What a defender takes away
- 1Attackers have motives, and motives predict targets.
- 2For a company that pays suppliers, money-driven crews are the first threat to plan for.
- 3A good threat profile names who, what they want and how they get in.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.