Tracking Adversary Infrastructure

When to Use

• You have a set of suspected C2/staging hosts with attributes (JARM/JA3S, TLS cert fields, favicon hash, ASN, ports, registrar) and want to cluster them to find related infrastructure.
• You are expanding from a few known indicators to the adversary's broader footprint.

Do not use clustering as confirmed attribution — shared hosting/attributes can be coincidental. Corroborate before attributing.

Prerequisites

• Host records (CSV/JSON) with shared-attribute fields to cluster on.

Workflow

Step 1: Cluster on shared attributes

python scripts/analyst.py cluster hosts.json --attrs jarm,cert_cn,favicon_hash,asn

Groups hosts that share one or more pivot attributes into clusters, defanging host indicators.

Step 2: Score cluster cohesion

Rank clusters by how many distinct attributes the members share (more shared attributes → stronger relationship).

Step 3: Expand and confirm

Use the strongest shared attributes (e.g., a unique self-signed cert CN or favicon hash) to pivot in internet-scan data for more hosts; corroborate.

Step 4: Document

Record clusters, the shared pivots, and confidence; feed confirmed indicators to detection.

Validation

• Clustering keys on explicit shared attributes, not loose similarity.
• Cluster strength reflects the count of distinct shared attributes.
• Host indicators are defanged in output.

Pitfalls

• Common CDN/cloud JARM/ASN values creating huge false clusters — exclude generic pivots.
• Default certificates shared by unrelated servers.
• Treating one weak shared attribute as a strong link.

References

• See references/api-reference.md for the clustering tool.
• ATT&CK T1583 and JARM references (linked in frontmatter).