Forest Global Training Partners

Cyber Risks · Cisco Talos

Describing attacks with crime script analysis

Summary: Cisco Talos describes crime script analysis (CSA), a criminology technique developed in the mid-1990s, as a way to break an attack into a sequence of actions, decisions and situational requirements told in everyday language. Using a business email compromise attempt against a small community sports club as the example, the article maps the attack into steps and notes that AI can automate the time-consuming preparatory work, shifting attacks from higher-value fraud against a few targets to lower-value fraud against many.

What's compelling: The preparatory work that once limited BEC to larger businesses can now be automated, so a small club with a plausible-sounding payment request is a realistic target. The article names the delivery step as the most effective disruption point, where anomalous account behavior or high volumes of outgoing mail from a single source should trigger rate-limiting or reputation-based blocks.

Read the original at Cisco Talos ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026