◇ OpenCyber Academy
Master's · Chapter 4 · English

Chapter 4 — Threat intelligence and OSINT: competing explanations

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 4 — Threat intelligence and OSINT: competing explanations

Lesson map

Lesson 04 published. Map, example, EX022.

flowchart TD
  N0["Learning outcomes"]
  N1["4.1 Why competing explanations"]
  N2["Lab 1 — ACH matrix"]
  N3["4.2 Reading the matrix"]
  N4["4.3 Estimative language"]
  N5["4.4 Change triggers"]
  N6["4.5 ATT&CK as evidence vocabulary"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX022"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["4.1 Why competing explanations"]
  N2["Lab 1 — ACH matrix"]
  N3["4.2 Reading the matrix"]
  N4["4.3 Estimative language"]
  N5["4.4 Change triggers"]
  N6["4.5 ATT&CK as evidence vocabulary"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX022"]

[Learning outcomes]
    |
    v
[4.1 Why competing explanations]
    |
    v
[Lab 1 — ACH matrix]
    |
    v
[4.2 Reading the matrix]
    |
    v
[4.3 Estimative language]
    |
    v
[4.4 Change triggers]
    |
    v
[4.5 ATT&CK as evidence vocabulary]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX022]

Learning outcomes

You will (1) build an analysis-of-competing-hypotheses (ACH) matrix; (2) identify diagnostic evidence; (3) express a judgment with calibrated estimative language; (4) record what new evidence would change the judgment.

4.1 Why competing explanations

Analysts tend to settle on the first plausible story. Heuer's method forces several hypotheses onto the table and asks which evidence is inconsistent with each. The hypothesis with the fewest serious inconsistencies survives — provisionally.

Lucía's seminar exercise on the CPSG ransomware incident uses three hypotheses: a criminal ransomware crew (H1), an insider (H2) and state-aligned espionage (H3). Listing all three before reading the evidence stops the most common story, ransomware means criminals, from closing the question too early. In the CPSG ransomware exercise, all three are scored against the same five evidence items, E1 to E5, so no hypothesis is judged on evidence chosen to suit it.

Lab 1 — ACH matrix

"""Lab 1 (ch 04): analysis of competing hypotheses - count inconsistencies per hypothesis (synthetic)."""
hyps = ["H1 criminal ransomware crew", "H2 insider", "H3 state-aligned espionage"]
# per evidence item: C consistent, I inconsistent, N neutral for H1,H2,H3
evidence = [
    ("E1 data staged then encrypted",         "C", "N", "I"),
    ("E2 access from a contractor VPN account", "C", "C", "C"),
    ("E3 ransom note with payment portal",     "C", "I", "I"),
    ("E4 activity outside staff working hours", "C", "I", "N"),
    ("E5 tooling sold on criminal markets",    "C", "N", "I"),
]
for i, h in enumerate(hyps):
    inc = sum(1 for e in evidence if e[i + 1] == "I")
    print(f"{h:30} inconsistent={inc}")
diag = [e[0] for e in evidence if len(set(e[1:])) > 1]
print("diagnostic items:", len(diag), "of", len(evidence))

Run with python3 lab_ach.py. Verified output:

H1 criminal ransomware crew    inconsistent=0
H2 insider                     inconsistent=2
H3 state-aligned espionage     inconsistent=3
diagnostic items: 4 of 5

4.2 Reading the matrix

H1, a criminal ransomware crew, has no inconsistencies; H2, an insider, has two; H3, state-aligned espionage, has three. Item E2 — access from a contractor VPN account — fits every hypothesis and is therefore not diagnostic. Four of five items discriminate. The matrix does not prove H1; it shows H1 is least contradicted by this evidence.

Lucía's written judgment follows directly: it is likely, 55–80% on her scale, that a criminal crew conducted the intrusion, and an insider role cannot be excluded. The non-diagnostic E2 is worth naming in the write-up, because analysts often cite such evidence first.

4.3 Estimative language

ICD 203 asks products to express uncertainty and to distinguish evidence from judgment. Kent's essay on words of estimative probability showed how readers interpret "probable" very differently. A team should publish its own scale — for example "likely" meaning roughly 55–80% — and use it consistently.

Lucía's ransomware judgment uses that scale: "likely (55–80%)". A member reading "likely" in one CPSG bulletin and "likely" in another should take the same meaning from both, which only works if the group publishes its scale and every writer applies it.

4.4 Change triggers

Every judgment carries indicators that would change it: evidence of data sale without ransom (would raise H3), or a confession from a disgruntled employee (would raise H2). Writing triggers prevents silent drift.

Lucía's written assessment names one trigger in its last sentence: evidence of data sale without a ransom demand would lower the criminal-crew assessment. Naming the trigger in the product lets a member who later sees such evidence know at once that the judgment should be reopened. The current evidence cannot do that work: E2, access from a contractor VPN account, fits every hypothesis, so only new evidence of the kind the triggers name can move the judgment.

4.5 ATT&CK as evidence vocabulary

Mapping evidence to ATT&CK — staging and T1486 Data Encrypted for Impact for E1 — helps other analysts check whether behaviour matches a known group's profile without overrelying on names.

For the CPSG incident, T1486 describes the encryption itself, and the contractor VPN access in E2 can be mapped to valid-account use. Members comparing that profile with published group reports can see whether the behaviour fits, while the write-up avoids naming a group on the strength of one similarity. In Lucía's matrix, the T1486 label sits beside E1 as a description of what was observed; it is not treated as evidence for any particular group.

Worked example

A CPSG member suffers a ransomware incident. Lucía, as a seminar exercise, builds the matrix and writes: "We assess it is likely (55–80%) that a criminal ransomware crew conducted this intrusion; an insider role cannot be excluded. Evidence of data sale without a ransom demand would lower this assessment."

Synthetic case. The incident and evidence items are invented.

Errors and limits

ACH depends on the hypotheses considered; a missing hypothesis cannot win. Counting inconsistencies is a heuristic, not a probability calculation.

Exercises

Synthesis

List rivals, seek inconsistencies, report survivors with calibrated words, and write what would change your mind.

Continue studying — chapter 04 of 08

← Chapter 03 (draft) · Course chapter index · Chapter 05 (draft) →