何时该放弃：威胁行为者别名弃用管理框架.pdf

1、 Security Alliance Limited 2026.Not for distribution.Commercial in Confidence.Knowing When to Quit:A Framework for Managing the Deprecation of Threat Actor AliasesJanuary 2026Nicholas VidalSenior Strategic CTI Analyst Security Alliance Limited 2026.Not for distribution.Commercial in Confidence.2The

2、Issue(s)of AttributionProblem Statement:Current industry approaches to threat actor naming,deconfliction,and retirement reflect structural constraints that limit consistency and long-term analytic clarity.Security Alliance Limited 2026.Not for distribution.Commercial in Confidence.3 Security Allianc

3、e Limited 2026.Not for distribution.Commercial in Confidence.4 Security Alliance Limited 2026.Not for distribution.Commercial in Confidence.5 Security Alliance Limited 2026.Not for distribution.Commercial in Confidence.6 Security Alliance Limited 2026.Not for distribution.Commercial in Confidence.7

4、Security Alliance Limited 2026.Not for distribution.Commercial in Confidence.8Attribution as Cartography Security Alliance Limited 2026.Not for distribution.Commercial in Confidence.9Attribution as Cartography Security Alliance Limited 2026.Not for distribution.Commercial in Confidence.101.Challenge

5、s of Comparative AttributionProblem StatementSourcesConsequences 2.Case StudiesAPT28APT173.FrameworkBest practices for defendersOverview Security Alliance Limited 2026.Not for distribution.Commercial in Confidence.Challenges of Comparative AttributionSection 111 Security Alliance Limited 2026.Not fo

6、r distribution.Commercial in Confidence.12Clustering FundamentalsWhat is a Cluster?Collection of observable artifacts that can be viewed singularly as a composite object Artifacts of interest include:Indicators of Compromise(IOCs)Tactics,Techniques and Procedure(TTPs)Strategic motivationsWhy a Clust