Question

A threat analyst is documenting an intrusion using the Diamond Model of Intrusion Analysis. She has confirmed the malware sample (a custom RAT) and the compromised web server used to host the second-stage payload. To expand the investigation, she wants to identify other victims by pivoting from what she already knows. Which analytic pivot best leverages the confirmed data to discover additional affected organizations?

Accepted Answer

Pivot from the Infrastructure vertex by querying passive DNS and threat feeds for other hosts resolving to the same hosting server IP

Answer

Pivot from the Adversary vertex by attributing the campaign to a specific nation-state actor before analyzing further

Answer

Pivot from the Victim vertex by surveying all internal assets for missing patches

Answer

Pivot from the Capability vertex by rewriting the RAT's source code to test detection signatures