Profiling is a forensic technique for analyzing evidence. After a system is compromised, which factor would be most important in forming a profile of the incident?

• A. The nature of the attack
• B. The manufacturer of the system compromised
• C. The logic, formatting and elegance of the code used in the attack
• D. The vulnerability exploited in the incident

Answer: (C)

Profiling a breach hinges on the attacker’s artifacts—the toolset and the code they wrote or used. The logic, structure, and even the formatting of the attack code can act as a distinctive fingerprint, revealing patterns about the attacker’s preferences, level of sophistication, and coding style. These characteristics help investigators link incidents to the same actor or campaign, offering clues about attribution and behavior that aren’t as clearly reflected by the breach’s entry method. The vulnerability exploited tells you how the breach happened, but not who caused it or how they typically operate across incidents. Likewise, the system’s manufacturer is irrelevant to profiling the attacker. So the code’s design and style provide the strongest signal for forming a profile of the incident.