Cisco Talos Proposes Crime Script Analysis to Demystify Cyberattacks

Cisco Talos has proposed a novel approach called Crime Script Analysis (CSA) as a method to describe cyberattacks in a manner that is easily understandable to non-technical audiences. This technique, adapted from criminology, breaks down an attack into a sequence of human-readable steps, decisions, and situational requirements. Unlike the more technical Tactics, Techniques, and Procedures (TTPs) used in frameworks like MITRE ATT&CK, CSA aims to tell a story, making it more accessible for broader communication and understanding within organizations.

The traditional methods for detailing cyberattacks, such as Lockheed Martin's Cyber Kill Chain or MITRE ATT&CK's Attack Flow, provide valuable technical insights but can be overwhelming for those without a deep cybersecurity background. CSA offers a complementary perspective, akin to an architect's artistic impression compared to engineering blueprints. By focusing on the narrative flow of an attack, CSA helps identify critical "choke points" where defenders can most effectively intervene and disrupt the threat actor's operation.

As a case study, Talos applied CSA to Business Email Compromise (BEC) attacks. Historically, BEC attacks required significant manual reconnaissance to identify targets, spoofed individuals, and craft convincing social engineering lures, limiting their scalability to larger businesses. However, the advent of Artificial Intelligence (AI) is poised to automate these time-consuming preparatory steps, making attacks against smaller, previously unprofitable targets more feasible.

Talos outlines a typical BEC crime script, highlighting that steps such as target identification, reconnaissance, and initial contact can be automated by AI. This automation shifts the attack model from high-value fraud against a few targets to lower-value fraud against a much larger number of victims. Furthermore, AI can personalize social engineering messages, generating urgent payment requests that appear credible to the intended victim, thereby enhancing the attack's effectiveness.

The CSA framework also proves useful in identifying specific intervention points. For instance, the initial reconnaissance steps (1-4) could be disrupted by seeding AI with fake "canary" organizations, allowing defenders to block malicious reconnaissance attempts. AI providers could potentially detect and disrupt the generation of social engineering messages (Step 5) by identifying patterns in user prompts and outputs.

The most robust disruption point remains the delivery mechanism (Step 6). Email service providers can implement rate-limiting or reputation-based blocking for anomalous account behavior or high volumes of outgoing mail. Finally, at Step 7, increased victim awareness, coupled with strict payment verification processes and mandatory delays for urgent requests, can serve as a crucial last line of defense against successful BEC attacks.

By framing cyberattacks as narratives, CSA provides a powerful tool for security teams to communicate threat landscapes effectively to executives, board members, and other non-technical stakeholders. This enhanced understanding can lead to better-informed security decisions and more strategic allocation of resources to combat evolving threats.