Ambiguous Techniques

May 13, 2025

Project Summary

Building upon the research of Summiting the Pyramid, Ambiguous Techniques is a methodology to determine malicious intent behind seemingly benign behavior by applying contextual analysis to ATT&CK techniques. Reduce false positives and uncover adversarial use of living-off-the-land activity.

Problem

Many ATT&CK techniques, especially those used in living-off-the-land activity, produce observables that are indistinguishable from benign behavior, making it difficult for defenders to determine malicious intent and resulting in unreliable or overly noisy detections.

Solution

Create a methodology that uses the surrounding context of a detection event to infer the intent of the actor, thus removing the ambiguity.

Impact

Reduce false positives and improve detection accuracy so defenders can prioritize the alerts that truly matter.

Project Resources:

Project Announcement Project Website GitHub

---

Funding Research Participants

---