Overview of Crime Script Analysis
Security teams frequently rely on rigid linear models or complex graph-based frameworks to understand threat actor behavior. While frameworks such as Lockheed Martin’s Cyber Kill Chain and the MITRE ATT&CK framework provide essential technical depth, translating these technical artifacts for non-technical stakeholders remains challenging. As detailed by Talos Intelligence, crime script analysis (CSA) offers a complementary narrative-driven technique. Originally developed in criminology during the mid-1990s, CSA deconstructs malicious operations into discrete sequences of actions, decisions, and situational requirements using everyday language.
By framing attacks as human-readable stories, security professionals can effectively communicate risks to leadership, compliance teams, and operational personnel. This methodology bridges the gap between raw telemetry and strategic decision-making, allowing defenders to pinpoint precise operational chokepoints where intervention disrupts the adversary’s workflow.
Deconstructing Business Email Compromise Workflows
To illustrate the utility of this narrative methodology, analysts apply crime script analysis to business email compromise (BEC) campaigns. Historically, manual target research, organizational profiling, and context gathering limited BEC operators to high-value targets, as the labor-intensive preparation constrained operational scalability.
However, the integration of artificial intelligence into the threat landscape alters this economic model. Attackers now leverage automated tooling to conduct reconnaissance, profile smaller organizations, and scale operations toward previously unprofitable targets through lower-value, high-volume fraud.
Mapping the AI-Assisted Attack Lifecycle
A standard BEC crime script involves several distinct sequential stages:
- Reconnaissance and Target Selection: Automated scripts identify potential victims and harvest organizational data without manual overhead.
- Context Assembly: Attackers gather specific operational details to lend credibility to subsequent communications.
- Social Engineering Generation: Generative models draft context-aware, urgent payment requests tailored to specific victim organizations.
- Delivery and Execution: Messages bypass standard filters to reach personnel with financial authorization.
- Monetization and Laundering: Funds are quickly transferred and laundered to obscure their origins.
Actionable Mitigation Strategies and Intervention Points
Deconstructing operations into specific sequential steps reveals multiple strategic intervention points for defenders. Security teams can deploy targeted defenses at various stages of the crime script to thwart malicious campaigns.
- Seeding Canary Entities: Defenders can establish fictitious honeypot entities designed to be discovered by automated reconnaissance agents, enabling the identification and blocking of malicious sources early in the lifecycle.
- Provider-Level Detection: Large language model providers can monitor interaction patterns to detect repeated reconnaissance and automated social engineering generation.
- Email Gateway Controls: Implementing stringent rate-limiting, anomaly detection for outgoing mail volumes, and reputation-based blocks disrupts the delivery mechanism.
- Operational Process Controls: Establishing strict verification protocols, requiring verified purchase orders, and enforcing mandatory delays on financial transactions protect potential victims during the final stages of the attack.
Related: Zero-Click AI Browser Hacking Threatens Claude and ChatGPT Atlas, Adversary AI Weaponization: A Data-Driven Analysis by Talos