Attack Path Reconstruction

Description

Reconstruct the complete path an adversary took through the deception environment: which assets they interacted with, in what order, what they searched for at each stop, and how long they spent at each stage. This reconstruction reveals adversary objectives, priorities, and decision-making patterns.

Rationale

Attack path reconstruction provides the fullest picture of adversary intent and methodology. Understanding not just what they did at each system, but the sequence and timing of their movement, reveals their operational playbook. This is intelligence that cannot be obtained from any single alert or log entry. It requires synthesizing data across the entire deception environment.

ATT&CK provides an adversary-behavior vocabulary, while the proposed attack-path reconstruction activity is an author-defined lifecycle step.

• Strom, B.E. et al. MITRE ATT&CK: Design and Philosophy. The MITRE Corporation, revised 2020.Technical report

These sources establish design lineage and scope. They do not validate this record's operational effectiveness, planning estimates, environment labels, or ATT&CK relationships.

Implementation Steps

Technical Implementation Examples(1)

{
  "_comment": "Reconstruct attack path through deception assets by source IP",
  "query": {
    "bool": {
      "must": [
        { "term": { "shadow_cdf": true } },
        { "term": { "source.ip": "10.0.5.42" } },
        { "range": {
            "@timestamp": { "gte": "2026-03-20", "lte": "2026-03-21" }
        }}
      ]
    }
  },
  "sort": [{ "@timestamp": "asc" }],
  "aggs": {
    "attack_timeline": {
      "auto_date_histogram": {
        "field": "@timestamp",
        "buckets": 50
      },
      "aggs": {
        "targets": {
          "terms": { "field": "destination.ip" }
        },
        "actions": {
          "terms": { "field": "event.action" }
        },
        "services": {
          "terms": { "field": "network.protocol" }
        }
      }
    },
    "dwell_time": {
      "stats": { "field": "@timestamp" }
    },
    "unique_hosts_touched": {
      "cardinality": { "field": "destination.ip" }
    },
    "techniques_used": {
      "terms": {
        "field": "event.action",
        "size": 50
      }
    }
  },
  "size": 1000
}

Considerations

• Multiple adversaries may interact with deception assets simultaneously. Ensure your correlation logic can distinguish between independent actors.
• Dwell time analysis reveals adversary intent. Quick visits suggest reconnaissance, while extended sessions indicate exploitation or data collection.
• Consider publishing sanitized attack path reconstructions as case studies for the security community.