Fabricated External-Attacker Attribution

A subject knowingly attributes activity they performed or directed to an external attacker or external compromise in order to divert attribution, containment, or investigative attention. The false account may assert that credentials were stolen, an endpoint was remotely controlled, a vulnerability was exploited, or an unidentified external party performed the relevant actions. The subject presents this explanation as factual while knowing that it falsely describes responsibility for the activity.

The account may be introduced through a purported compromise report, an incident-response briefing, a written explanation of suspicious activity, or a communication impersonating an external attacker. A subject participating in the response may reinforce the account by supplying misleading technical interpretations or advocating an investigative scope that excludes their own involvement. The distinguishing behavior is the knowingly false attribution, not the use of an unfamiliar network address, compromised account, or malicious tool. Alteration of technical artifacts is not required, although separately evidenced concealment or evidence manipulation should be classified alongside the false attribution.