Counterattack

When to Choose It

Choose counterattack when contact is confirmed or strongly hypothesised and you can complete eviction inside the adversary’s dwell budget. The judgment is timing rather than appetite: evicting early on partial understanding tips the adversary, burns the collection, and buys a second intrusion by an adversary who now knows what you can see. Evicting late is worse. The scheme should state, before contact, which of those errors the agency prefers.

Precondition

A hypothesis. Hunting without one is sampling, and sampling an estate of this size returns whatever the analyst already expected to find.

What It Costs

The scarcest currency on the list — people. Hunt capacity is a small number of experienced analysts who cannot be procured at short notice, and every hour of hunting is an hour not spent on detection engineering. Automated containment converts that cost into availability risk instead, which is a real trade rather than a free one.

Rules of Engagement

Hunting is always authorized — it is observation. Containment is where the line sits: host isolation and credential reset on confirmed compromise belong in the pre-authorized set, because their cost is bounded and their value decays in minutes. Anything that degrades a mission service, or that touches a system outside the agency’s boundary, needs the AO.

T1 · Identity — 1 technique

• M7.05

  Credential Reset Sweep

  Execute a scoped, ordered reset of credentials and tokens across the compromised blast radius.

  IndicatorThe reset completes without leaving a re-entry credential.

  Phases

  • III
  Assessed by

  • TA-4
  • SM-5

T2 · Devices — 2 techniques

• M7.04

  Host Isolation on Confirmation

  Sever a host from the network on confirmed compromise while preserving it for analysis.

  IndicatorConfirmed hosts are isolated inside the stated interval.

  Phases

  • III
  Assessed by

  • TA-4
  • TA-1
  • SM-4
• M7.07

  Persistence Sweep

  Sweep systematically for persistence across identity, endpoint, cloud and application layers before declaring eradication.

  IndicatorEradication is declared on evidence across every layer.

  Phases

  • III
  • IV
  Assessed by

  • SM-6
  • CG-4
  • EN-5

T3 · Networks — 1 technique

• M7.08

  Lateral Path Audit

  Recompute what the adversary could reach from where they stand, and close the paths ahead of them.

  IndicatorReachability from the foothold is reduced during the engagement.

  Phases

  • II
  • III
  Assessed by

  • KT-4
  • KT-5

T4 · Applications and Workloads — 2 techniques

• M7.06

  Build Pipeline Integrity Hunt

  Hunt the build pipeline specifically, because poisoning it envelops everything downstream.

  IndicatorPipeline integrity is verified rather than assumed after contact.

  Phases

  • III
  Assessed by

  • KT-1
  • SM-6
• M7.17

  Malicious Message Eviction

  Remove a delivered malicious message from every mailbox it reached, including forwards and delegated copies, rather than only from the originally reported one.

  IndicatorA reported message is removed estate-wide, not only where it was reported.

  Phases

  • III
  Assessed by

  • EN-5
  • TA-4
  • DV-3

T6 · Operational Technology — 1 technique

• M7.14

  Process Anomaly Hunting

  Hunt for deviation in the physical process itself, not only in the network, because a competent adversary will look correct on the wire.

  IndicatorProcess behavior outside its engineering envelope is investigated as a security event.

  Phases

  • II
  • III
  Assessed by

  • CE-2
  • FO-4

T7 · Workforce — 1 technique

• M7.15

  Insider Risk Investigation

  Run a defined, rights-respecting process to resolve an insider indication, rather than improvising one under pressure.

  IndicatorInsider indications reach a documented disposition within a stated period.

  Phases

  • III
  Assessed by

  • WF-4
  • CG-4

T9 · Supply Chain — 1 technique

• M7.16

  Supply Chain Compromise Hunting

  Hunt for the specific behaviors a compromised supplier or component would produce, on the assumption that it is already inside.

  IndicatorSupplier-origin behaviors are hunted on a stated cadence, not only on advisory.

  Phases

  • III
  Assessed by

  • LC-2
  • LC-4
  • CE-2

TX · Cross-Cutting — 8 techniques

• M7.01

  Hypothesis-Driven Hunting

  Hunt against stated hypotheses drawn from the intelligence requirements, not against whatever the queue surfaced.

  IndicatorEvery hunt traces to a priority intelligence requirement.

  Phases

  • II
  • III
  Assessed by

  • CE-2
  • CE-3
• M7.02

  Fusion-Fed Hunt Backlog

  Convert fused assessments into a ranked, worked hunt backlog with explicit confidence on each entry.

  IndicatorFusion output becomes hunt work rather than a report.

  Phases

  • II
  • III
  Assessed by

  • CE-3
  • CE-5
  • EN-1
• M7.03

  Automated Containment Playbooks

  Encode containment as tested automation so the decision, not the execution, is the slow step.

  IndicatorContainment executes in seconds once the decision is made.

  Phases

  • III
  Assessed by

  • TA-4
  • SM-5
  • EN-4
• M7.09

  Detection Engineering from Hunt

  Convert every hunt finding into a durable detection with an owner and a test.

  IndicatorNo hunt finding is left as tribal knowledge.

  Phases

  • III
  • V
  Assessed by

  • SM-6
  • CE-5
• M7.10

  Purple-Team Validation

  Test whether each emplaced maneuver actually performs, using the cell success indicator as the pass condition.

  IndicatorEvery claimed maneuver has been demonstrated, not asserted.

  Phases

  • 0
  • V
  Assessed by

  • SM-6
  • CE-4
• M7.11

  Eviction Sequencing

  Plan eviction as a single sequenced action, so the adversary cannot re-enter through what is evicted last.

  IndicatorEviction happens once, not in rounds.

  Phases

  • III
  Assessed by

  • SM-5
  • TA-3
  • EN-5
• M7.12

  Adversary Dwell Reconstruction

  Reconstruct how long the adversary held the ground, so temporal advantage is computed rather than estimated.

  IndicatorDwell is measured from evidence for every engagement.

  Phases

  • III
  • IV
  Assessed by

  • TA-2
  • CE-6
  • EN-2
• M7.13

  Hunt Coverage Accounting

  Track which terrain has been hunted, how recently, and against which hypotheses.

  IndicatorUnhunted terrain is visible and dispositioned.

  Phases

  • V
  Assessed by

  • CE-4
  • CE-6

By Family

• CECycle Execution and Assurance5 controls · reaches 8 of 17 techniques
• SMScheme of Maneuver3 controls · reaches 8 of 17 techniques
• ENEngagement and Pursuit4 controls · reaches 6 of 17 techniques
• TATempo and Temporal Advantage4 controls · reaches 6 of 17 techniques
• CGCommand and Governance1 control · reaches 2 of 17 techniques
• KTKey Terrain and Decisive Points3 controls · reaches 2 of 17 techniques
• DVDevices Terrain1 control · reaches 1 of 17 techniques
• FOFederal Obligations1 control · reaches 1 of 17 techniques
• LCLines of Communication2 controls · reaches 1 of 17 techniques
• WFWorkforce Terrain1 control · reaches 1 of 17 techniques

By Control

• SM-6 Maneuver Effectiveness Validation4 techniques — To replace assumed effectiveness with demonstrated effectiveness, so the coverage figure reflects what controls do rather than what was assumed of them.
• TA-4 Pre-authorized Response4 techniques — To remove authority latency from the decision loop, so that the segment most programs cannot shorten with tooling is shortened by governance.
• CE-2 Priority Intelligence Requirements3 techniques — To direct analytic effort at named questions, so that collection and hunting answer what the accountable authority needs rather than processing what arrives.
• EN-5 Eradication and Transition to Recovery3 techniques — To ensure the adversary is actually gone before the mission is restored, and that the transition is a decision rather than a drift.
• SM-5 Branches and Sequels3 techniques — To decide contingency responses before contact, so that the decision loop under pressure is a selection rather than a design exercise.
• CE-3 Fusion and Confidence2 techniques — To distinguish assessment from assertion, so that decisions taken on analytic conclusions carry the uncertainty of those conclusions with them.
• CE-4 Coverage and Residual Risk Computation2 techniques — To produce a posture figure that can be reproduced and challenged rather than asserted, so that the number carries authority beyond the tool that generated it.
• CE-5 Remediation Backlog Prioritization2 techniques — To make the backlog answer where the next hour of work goes, rather than enumerate everything wrong.
• CE-6 Cycle Record and Trend2 techniques — To answer whether the program is improving — a question no point-in-time assessment can address.
• CG-4 Findings Disposition2 techniques — To ensure every finding reaches a decision, so that the open set reflects work in progress rather than accumulated neglect.
• DV-3 Endpoint Sensor Coverage and Liveness1 technique — To know what the estate can actually see, and to detect the loss of that visibility as an event rather than at the next assessment.
• EN-1 Event Declaration and Triage1 technique — To convert raw events into a decided position quickly, since this is the segment of the decision loop that most often binds.
• EN-2 Engagement Reconstruction1 technique — To establish what actually happened, since every consolidation activity depends on a reconstruction and none of them can be performed without one.
• EN-4 Escalation and Engagement Authority1 technique — To remove the search for a decision-maker from the decision loop, which is where the decide segment is usually spent.
• FO-4 Operational Technology Terrain1 technique — To stop operational technology being scored as though it were a server estate, and to make the connections between the two declarable.
• KT-1 Decisive Point Identification1 technique — To concentrate defensive effort on the small number of elements whose loss is decisive, so that priority is a stated judgment rather than an emergent property of the asset register.
• KT-4 Adversary Reachability Assessment1 technique — To produce a computed, repeatable answer to the question a control catalog cannot ask — can they get there from here — and to record the answer as a trend rather than a one-time finding.
• KT-5 Barrier Sufficiency1 technique — To make the barriers on which negative reachability results depend into named, owned, monitored controls, so that the assurance KT-4 provides cannot be silently withdrawn.
• LC-2 Component Provenance1 technique — To know where deployed components came from and what is inside them, so that a compromise disclosed anywhere can be located here.
• LC-4 Update Integrity and Staging1 technique — To limit the blast radius of a compromised trusted update, so that supply chain compromise reaches a ring rather than the estate.
• SM-4 Main Effort Designation1 technique — To concentrate defensive priority at a declared point, so that subordinate decisions follow from it without referral.
• TA-1 Decision Loop Measurement1 technique — To make the defender's tempo a measured quantity rather than an impression, so that the numerator of temporal advantage exists at all.
• TA-2 Adversary Dwell Estimation1 technique — To establish the denominator of temporal advantage with an explicit, challengeable basis, so the comparison the framework rests on can be argued with.
• TA-3 Temporal Advantage Threshold1 technique — To convert the temporal advantage figure into a governed condition with an escalation consequence, so that being behind is a decision the organization has to make rather than a number it can note.
• WF-4 Insider Risk Position1 technique — To be able to resolve an indication proportionately and lawfully, so that the organization is neither unable to act nor acting without safeguards.