Investigative Deception

A subject knowingly attributes activity they performed or directed to an external attacker or external compromise in order to divert attribution, containment, or investigative attention. The false account may assert that credentials were stolen, an endpoint was remotely controlled, a vulnerability was exploited, or an unidentified external party performed the relevant actions. The subject presents this explanation as factual while knowing that it falsely describes responsibility for the activity.

The account may be introduced through a purported compromise report, an incident-response briefing, a written explanation of suspicious activity, or a communication impersonating an external attacker. A subject participating in the response may reinforce the account by supplying misleading technical interpretations or advocating an investigative scope that excludes their own involvement. The distinguishing behavior is the knowingly false attribution, not the use of an unfamiliar network address, compromised account, or malicious tool. Alteration of technical artifacts is not required, although separately evidenced concealment or evidence manipulation should be classified alongside the false attribution.

A subject knowingly provides materially false factual statements during an internal or external inquiry concerning the subject's activity or relevant evidence. The statements may be made to insider threat investigators, incident responders, auditors, Human Resources, Legal, regulators, or law enforcement. They may concern actions performed, access exercised, instructions received, communications exchanged, information retained, or the existence and location of relevant artifacts. The defining behavior is an affirmative factual representation that the subject knows is false and supplies to mislead the inquiry.

The false statement may deny an action, invent authorization, misrepresent the purpose of a transfer, or provide a false explanation for possession of information or use of a service. It may be provided verbally, in a written response, or through a record submitted for investigative review. Investigators should distinguish a demonstrably false statement from an unsupported statement, an incomplete recollection, or an account that changes following clarification. Establishing that a statement conflicts with a record is a starting point, classification also requires evidence that the subject knew the statement was false when it was made.