In this section
Constraint Analysis — Budget, Time, and Capability
You've seen incident reports that attribute attacks to threat groups with varying levels of sophistication. You know that a script kiddie with Cobalt Strike behaves differently from a nation-state operator with custom tooling. This section formalizes that intuition into a constraint framework you can apply during investigations to classify the adversary from their operational behavior. The constraints are observable in your telemetry. You don't need threat intelligence attribution to assess them.
Scenario
You find evidence of credential access via Kerberoasting. A junior analyst says: "They're dumping credentials, this is serious." A senior analyst asks: "Why Kerberoasting instead of LSASS dump? Kerberoasting is noisier with lower yield per attempt, unless the attacker doesn't have local admin on the endpoint." The senior analyst just identified a constraint. The attacker didn't choose Kerberoasting from a menu. They chose it because they lacked the privilege level required for their preferred technique. The constraint is visible in the technique selection.
Budget determines tooling
An attacker's budget determines what tools they can afford and what infrastructure they can sustain. This relationship is directly observable in your investigation evidence.
A low-budget attacker uses commodity tools: leaked copies of Cobalt Strike, open-source C2 frameworks like Sliver or Mythic, publicly available exploit code, free cloud infrastructure provisioned with stolen credentials or trial accounts. The tooling is functional but recognizable. Your detection rules probably cover default configurations because the same tools have appeared in thousands of previous incidents.
A high-budget attacker uses custom tools: purpose-built implants with unique communication protocols, zero-day exploits acquired from vulnerability researchers or developed in-house, dedicated infrastructure on commercial hosting registered through legitimate business entities. The tooling is designed specifically to evade the detection rules that catch commodity tools.
There is a nuance that matters for investigation: commodity tools used skillfully can be as effective as custom tools. A Cobalt Strike beacon with a carefully crafted malleable C2 profile, domain-fronted through a legitimate CDN, and operating on a named pipe with a non-default sleep interval is harder to detect than a custom implant with sloppy operational security. Budget correlates with capability but does not determine it. What the tool selection tells you reliably is the lower bound of the attacker's resources.
Figure 1.3 — The four constraint dimensions. Each is independently observable in investigation telemetry. The combination produces an adversary profile that predicts operational behavior.
Time determines pace
The timeline constraint is the most visible in telemetry because it directly controls the spacing between events.
Short-timeline attackers move fast. Ransomware affiliates run discovery commands in rapid succession within minutes of landing: whoami, net group "Domain Admins", nltest /dclist:, systeminfo. They dump credentials aggressively, move laterally to as many systems as they can reach quickly, and begin staging ransomware before the SOC has finished triaging the initial access alert. CrowdStrike measured a median eCrime breakout time of 62 minutes in 2025, meaning the attacker reaches a second system within an hour of initial access.
Long-timeline attackers space their actions across days. Espionage operators run one discovery command, analyze the output, wait 48 hours, then run the next. They schedule activity during business hours to blend with legitimate traffic. Their persistence mechanisms are designed for months of operation: scheduled tasks with innocuous names, OAuth applications with broad permissions, dormant accounts with minimal privileges.
The time between events in your telemetry is one of the most reliable classification signals because it is the hardest thing for an attacker to fake. A ransomware affiliate cannot afford to wait three days between steps because every hour increases detection risk. An espionage operator does not need to rush because patience is cheaper than discovery.
The telemetry signature of the time constraint is directly observable. Compare two process creation sequences from the same environment, both starting from compromised user accounts:
The short-timeline pattern produces a dense cluster of process creation events within minutes on a single endpoint. The long-timeline pattern spreads individual commands across days, often on different systems, making each event appear routine in isolation. Temporal correlation catches the first pattern. Time-series behavioral analysis catches the second.
Capability determines adaptation
Capability is the attacker's technical depth: what they can build, modify, and execute under pressure.
Low-capability attackers follow documented procedures. They use tools with default configurations, execute techniques as described in blog posts and GitHub READMEs, and struggle when something unexpected happens. If their primary tool is blocked by EDR, they don't adapt. They either abandon the operation or move to a different target where the tool works.
Medium-capability attackers can modify existing tools but cannot develop new ones. The RaaS ecosystem has made medium capability the most common profile in 2025-2026. An affiliate receives a ransomware binary, an operations playbook, and access to infrastructure maintained by the RaaS operator. The affiliate handles execution. Revenue sharing typically gives affiliates 60-80% of ransom payments, with the operator keeping the rest. The affiliate may be skilled at social engineering and initial access but relies entirely on the operator's tooling for the encryption payload. TRM identified 93 new ransomware variants in 2025 alone, a 94% increase from the prior year, reflecting how the RaaS model multiplies the impact of a small number of capable developers across a large number of less capable affiliates.
High-capability attackers adapt in real time. They modify tools to evade specific defenses, develop new techniques when existing ones fail, and understand the target's security architecture well enough to route around monitored paths. When a detection rule fires on their activity, they analyze the detection logic and adjust their approach. The adaptation itself is observable: a change in technique mid-campaign, especially after a detection event, indicates an attacker who is watching your response and counteracting it.
Technique novelty is the primary indicator. If every observed technique maps cleanly to known ATT&CK entries with documented detections, you are facing a low-to-medium capability adversary. If you observe techniques that don't map cleanly, or known techniques with novel evasion methods, you are facing higher capability. Against high-capability adversaries, your detection rules need continuous adaptation because the adversary is adapting to them in real time.
Risk tolerance determines noise
Risk tolerance is the attacker's willingness to accept the possibility of detection in exchange for operational speed.
High risk tolerance means the attacker accepts noise. Ransomware operators in the final deployment stages don't care if they trigger alerts because the encryption will finish before the SOC can respond. Destructive operators accept detection because the damage is irreversible before containment completes. Access brokers accept some noise during the initial compromise because they plan to sell the access and disappear before the buyer activates it.
Low risk tolerance means stealth takes priority over speed. Espionage operators abort at the first sign of detection. Supply chain operators protect their access because it took months to establish and represents significant investment. State-sponsored actors protect their custom tools because each tool represents months of development that would be lost if the tool is captured and analyzed by defenders.
How constraints interact
No single constraint is diagnostic in isolation. Budget without time context is misleading: a state-sponsored operator might use a commodity tool for a low-priority collection task, not because they lack budget, but because a commodity tool draws less attention than a custom implant. Time without capability context is equally misleading: a fast-moving attacker might be a skilled operator under deadline pressure rather than a low-capability affiliate following a playbook.
The constraint interaction produces the operational signature. A low-budget, short-timeline, high-risk-tolerance attacker with medium capability is the ransomware affiliate pattern. A high-budget, long-timeline, low-risk-tolerance attacker with high capability is the state-sponsored espionage pattern. The combinations are finite and recognizable. During an investigation, assessing all four from the available evidence produces a profile that predicts the attacker's objective, their likely next actions, and whether they will return after eviction.
Five constraint profiles in practice
The constraint combinations produce five recognizable profiles. Each predicts specific operational behaviors that you can verify against your investigation evidence.
Applying constraints during a live investigation
At Northgate Engineering, the SOC receives three alerts within 20 minutes: a suspicious sign-in from an unusual location, a process creation event for nltest.exe on a workstation, and a lateral authentication to SRV-NGE-DC01. The analyst's first question should not be "what malware is this?" but "what constraint profile am I seeing?"
The evidence so far: the attacker is moving fast (short timeline), using native Windows binaries for discovery (medium budget, living-off-the-land), and has already reached the domain controller within 20 minutes (high risk tolerance). No evasion techniques observed. The profile matches a ransomware affiliate: expect backup targeting next, prepare containment for the backup infrastructure, and assume encryption is imminent.
Compare this to an alternative scenario where the SOC discovers, during a routine OAuth app audit, that an application granted Mail.Read permissions six weeks ago has been accessing the CFO's mailbox every Tuesday and Thursday at 09:15. No alerts fired. No endpoint artifacts exist.
The constraint profile is completely different: long timeline (six weeks), high capability (operating through legitimate APIs), low risk tolerance (zero alerts triggered), and medium-to-high budget (no commodity tools, no detectable infrastructure). This is an intelligence operation. The response priority is silent scoping, not aggressive containment.
The constraint framework gives you classification within minutes of your first evidence, before you have attribution, before you have a malware sample, before you have a complete timeline. The classification drives the response strategy.
An investigation finds a custom Go-based implant communicating over DNS. The team classifies the attacker as "advanced" and escalates to an expensive third-party IR firm. Analysis reveals the implant is a publicly available open-source tool with minimal modification. The attacker's other techniques are standard: Mimikatz for credentials, PsExec for lateral movement, no operational security measures. The custom implant fooled the initial assessment. The full constraint profile (low budget, short timeline, no adaptation, high noise) correctly classifies this as a medium-capability financial operator. Tool sophistication in isolation is not adversary sophistication. The full constraint profile is the classification.
Offensive Operations Principle
Attackers don't choose techniques from a menu. They choose techniques within constraints: budget, time, capability, and risk tolerance. The technique an attacker uses tells you as much about what they can't do as what they can. Constraints are diagnostic. Assess all four from the evidence before classifying the adversary.
Get weekly detection and investigation techniques
KQL queries, detection rules, and investigation methods — the same depth as this course, delivered every Tuesday.
No spam. Unsubscribe anytime. ~2,000 security practitioners.