Lab 13 · threat intelligence · the human layer

The Lantern Rotation.

The classic kill chain tracks an actor. But a six-month intrusion is not one person — it's a shift rotation. The operator tires; his tooling becomes known even to his own team; his position goes dark. So he passes the access shell to a teammate and steps out of the vigil, and a fresh hand picks up the lantern and carries the campaign on. The access persists; the human is the variable. And the human has a pulse — working hours, habits, discipline, tooling — that changes when the hand changes. That change is a seam, and a seam is something you can see.

01 — the psychological kill chain

The operator's arc, and what each stage leaks

Overlay a human lifecycle on the intrusion. Each state of the operator leaves a different tell in the logs — and the last one, the rotation, is the loudest.

Fresh entry

A new hand on the keyboard is careful and slow, minimizing noise while learning unfamiliar terrain.

tell: low error rate, heavy reconnaissance of the environment

Establishment

Persistence and C2 go in; the operator settles into a toolset.

tell: a stable tooling / C2 fingerprint forms

Routine

Steady cadence, consistent working hours — a human rhythm you can baseline.

tell: a predictable active-hours window (their timezone)

Fatigue

Boredom and overfamiliarity breed shortcuts; discipline slips.

tell: OPSEC error rate climbs, tooling reused carelessly

Exposure

The tradecraft is now known — to defenders, and to the operator's own team, which is the cue to rotate.

tell: over-used indicators, signatures catching up

Handoff — the Lantern Rotation

The access shell passes to a fresh operator. A new human inherits the terrain and starts the arc over.

tell: a discontinuity — working hours jump (new timezone), OPSEC snaps back to careful, the “known” environment gets re-reconned, tooling swaps

02 — spot the rotation

One access, twenty-four weeks, two hands

Behavioural telemetry for a single persistent access over six months: the operator's active-hours window, OPSEC error rate, and re-reconnaissance volume, week by week. Somewhere in here the lantern was passed. Run the drift analysis — it scores week-over-week discontinuity and marks the seam.

Run the analysis to find the handoff.

03 — the payoff & the hard part

Your “actor” is a relay

The reason this matters isn't trivia — it corrects a mistake defenders make constantly: collapsing a long campaign into one persona.

Attribution honesty. A six-month “APT29 operator” in your timeline is almost certainly several humans. Treating them as one averages away the very discontinuities that are your best evidence — and your best detection windows. This sharpens Lab 7: an actor vertex is a team, not a person.
The seam is where mistakes live. A fresh operator re-learns the environment and makes the errors a veteran wouldn't. The handoff is the single best moment to catch the campaign — if you're watching for the discontinuity instead of smoothing over it.
Drift is not always a handoff. The same operator learns the network, automates, and shifts hours too. Benign drift is gradual; a rotation is a step. One discontinuity is a lead, not a conviction.
Hands can be hidden. A disciplined team standardizes tooling and hours to erase the seam, and timezones can be spoofed. Behavioural biometrics are noisy and ethically fraught. You weight this signal; you never rest a case on it alone.

On the name. “The Lantern Rotation” and this “psychological kill chain” framing are an original synthesis of this lab — a lens laid over the established Cyber Kill Chain and Diamond Model, not a standard industry framework. Offered to the Vulpes Vigil journal as a contribution, cited honestly as new. — 3XC

04 — provenance & citations

Where this comes from

foundations extended Hutchins, Cloppert & Amin (2011). Intelligence-Driven Computer Network Defense (the Cyber Kill Chain). Lockheed Martin.
Caltagirone, Pendergast & Betz (2013). The Diamond Model of Intrusion Analysis — the adversary vertex (operator vs. persona).
MITRE ATT&CK — the behaviours a rotating team expresses over a campaign.

this lab The Lantern Rotation / psychological kill chain — a BlueKit BlueChain synthesis for the Vulpes Vigil journal.
github.com/Mik3XC/BlueTeamLab
Refines Lab 7 (attribution) and reads the human layer under Lab 4's rhythm.

Next: Lab 14 — threat-intel pivots: turning one indicator into the adversary's whole infrastructure.