Crime script analysis (CSA), a technique originally developed in criminology in the mid-1990s, is being proposed as a narrative-driven method to describe cyberattacks, offering a human-readable alternative or complement to existing models like Lockheed Martin’s Cyber Kill Chain or MITRE ATT&CK. This approach aims to make attack descriptions accessible to non-technical audiences and facilitate the identification of "choke points" where attacks can be disrupted.
While models like the Cyber Kill Chain offer a rigid, seven-step linear sequence and MITRE ATT&CK’s Attack Flow diagrams provide comprehensive, but potentially daunting, graphs of tactics, techniques, and procedures (TTPs), CSA focuses on decomposing an attack into a sequence of actions, decisions, and situational requirements using everyday language. This narrative format helps defenders understand the attacker’s workflow and pinpoint effective intervention points.
A business email compromise (BEC) scam serves as a case study to illustrate the application of CSA. In a typical BEC scenario, an individual with financial authority receives an urgent payment request purporting to be from a superior. If successful, the payment is released to the scammer, who then rapidly launders the money. A recent incident involving a small community sports club, where a treasurer’s suspicions were raised by an unusual email tone despite a plausible request amount, highlighted the potential for such attacks against smaller entities.
Historically, the preparatory work for BEC attacks—identifying targets, spoofed individuals, and social engineering lures—has been time-consuming, limiting scalability and typically targeting larger businesses. However, the advent of artificial intelligence (AI) is changing this dynamic. AI can automate these initial steps, making it feasible for attackers to target a greater number of victims with lower-value frauds. AI can also personalize social engineering messages, generating urgent payment requests that appear credible and relevant to the target organization.
A general BEC crime script can be broken down into several steps, with the initial four steps (reconnaissance and target identification) being particularly amenable to AI automation. The personalization of social engineering in a subsequent step can also be AI-driven. This increased efficiency allows attackers to shift from high-value frauds against a few targets to lower-value frauds against many.
Considering the attack narrative helps in identifying disruption points. Steps involving AI-driven reconnaissance can be disrupted by seeding AI systems with "canary organizations"—fictitious honeypot entities with public personas discoverable by AI agents. Messages sent to these honeypots can then be blocked, disrupting the delivery mechanism. AI providers also have a potential role in detecting repeated patterns of reconnaissance and social engineering message generation, as interactions with large language models (LLMs) leave identifiable traces.
The delivery mechanism (e.g., email) remains a critical intervention point. Email service providers can implement immediate rate-limiting or reputation-based blocks for anomalous account behavior or high volumes of outgoing mail from a single source. Finally, educating potential victims about BEC scams and implementing strict internal processes, such as requiring verified purchase orders and payment delays, can prevent losses even if an attack reaches the victim.
CSA is not intended to replace existing frameworks like ATT&CK but rather to provide an alternative narrative format for documenting attacks. By describing threat actor activity in natural language, CSA broadens the understanding of attacks to a wider audience, fosters collaboration across teams, and helps defenders identify where AI tools might be used by attackers, sparking ideas for countermeasures.
