How to Read an Indictment for Technique Evidence

Federal criminal indictments in computer fraud cases represent some of the highest-fidelity technical documentation available to cybersecurity professionals. Unlike vendor threat reports or marketing whitepapers, every statement in a grand jury indictment has undergone scrutiny by federal prosecutors, digital forensics agents, and legal counsel.

Understanding how to extract actionable adversary tactics from an indictment requires knowing how prosecutors structure these documents and where technical facts reside.

The Structure of a Cyber Indictment

Most federal speaking indictments follow a predictable structure:

1. The Grand Jury Charges: The jurisdictional preamble identifying the defendants and relevant statutory sections. 2. The Scheme and Artifice: General background on the defendant syndicate, operational infrastructure, and conspiratorial agreements. 3. Manner and Means: The core technical section. This is where prosecutors describe the specific methods used to gain access, escalate privileges, move laterally, and exfiltrate data. 4. Overt Acts: A chronological catalog of specific actions taken in furtherance of the conspiracy, often with precise dates, IP addresses, email subjects, and transaction identifiers.

Locating ATT&CK Techniques in Manner and Means

When reading the Manner and Means section, look for specific verbs and forensic artifacts:

• Initial Access: Look for mentions of spearphishing attachments, spoofed login portals, or exploitation of specific public-facing CVEs. Indictments typically quote the exact subjects of lure emails and provide file hashes or attachment naming conventions.
• Credential Access: Federal agents frequently describe how attackers harvested passwords using tools like Mimikatz or through memory scraping on point-of-sale systems.
• Command and Control: Indictments frequently detail domains purchased with prepaid credit cards, rented virtual private servers (VPS), or encrypted tunneling services like SSH or reverse socks proxies.

Verifying Primary Locators

When mapping an indictment passage to a MITRE ATT&CK technique, always record the precise locator: the page number or paragraph number. Legal filings are cited by page and paragraph so that any analyst can independently verify whether the cited evidence meets the technique definition.

By relying on verified court records rather than secondary news reports, security teams gain unambiguous insight into real attacker operations.