Attack Paths

These recipes take you from one flagged indicator to the infrastructure it shares with everything around it, and from a shared node to the choke point worth acting on. An external attack path is the chain of internet infrastructure that connects an attacker to a target: the lookalike domain, the address it resolves to, the prefix announcing that address, the network routing it, the data centre, the cable underneath. Each link is an edge in the graph, so the whole route is one traversal, and every edge is an observation about infrastructure — the graph shows you the chain, not who walked it.

Key concepts: Attack path analysis · Choke point analysis · Infrastructure pivoting.

What a path is made of

A path crosses layers that are already joined: naming and DNS, email, registration, routing, addressing, threat intelligence, and the physical estate. Each hop is a typed edge, named with its direction by Connection Types.

The hidden link is a shared node

Two indicators that look unrelated connect the moment you find the infrastructure they share. A shared address, a shared nameserver, a shared registration contact: each is one hop, and the hop that returns a row is the finding.

That row is a record, not an intent. A lookalike and the brand it imitates can share a registration contact because the brand registered its own typosquats, or because an adversary registered both; shared hosting and managed DNS put unrelated parties on one node by design. The pivot says where to look next, not which case you are in.

The choke point is the payoff

A choke point is the shared node that, severed, collapses the most paths: an address, a prefix, a network or a registrant you can block, sinkhole or report, where one action does the work of many. DNS usually makes a better one, because a nameserver answers for a whole estate.

Act on a choke point only when you can say why. explain() returns a scored, feed-by-feed verdict for an indicator, so the node arrives with a defensible reason rather than a bare number.

Read coverage before band. Only known-clean — coverage: known-clean. In coverage, no malicious evidence. licenses the word "clean"; no-data — coverage: no-data. Not in coverage. This is not a verdict — nothing was looked at. means unknown, which is a different thing again; malicious-evidenced — coverage: malicious-evidenced. In coverage, with positive evidence of malice. and ambiguous — coverage: ambiguous. In coverage, and the evidence points both ways. mean there is evidence, whatever the band says. whisper.explain does not return coverage at all. Full contract: Coverage — what we looked at.

Click to expand

Blast radius is the same question inverted

The choke-point question is what can reach this node. Inverted it becomes what depends on it: fan out along dependency edges only, and the result is an availability map, not a threat assessment. The dependent with one provider, not the asset, is where an outage becomes an incident.

Reading a path correctly

A route is an infrastructure finding, never an identification. The ATT&CK layer is a curated reference plane built from public reporting: it names the techniques an actor is documented to use, and no traversal joins an actor to infrastructure. Zero rows is not a finding either — a refused query comes back as an error with its reason, so zero rows means wrong labels or no observation, and an absence is not a clean verdict.

Related pages

• Tracing a Path — these ideas as five runnable steps.
• Attack-Surface Mapper and Supply-Chain Dependency Mapping — the guided versions of these two halves.
• Campaign Pivoting — one indicator, the whole campaign.