A man aged in his late teens to early 20s is believed to have been involved in the placement of an explosive device found in Craigavon, the PSNI have said.
Police said an eyewitness saw the person running away from the area of the security alert, which the PSNI have said was designed to kill officers.
On Friday night, police were called to the Tullygally Road in the area.
While there, they uncovered a "deadly booby-trap device" close to a public bus stop.
It is believed dissident republicans were behind the attack.
Police also said they believe the device was "manufactured somewhere", as the "metal tube that was designed to look like a mortar had to be made by someone".
Det Supt Richard Campbell said the police had heard from an eyewitness, who described a "suspicious male" in the area of bus stop at about 23:45 BST on Friday.
"He is described as being between 5ft 6in to 5ft 9in tall, slim to medium build," he added.
"The witness said he gave the impression of being in his late teens to early 20s and that the individual was wearing a beige or a light grey long-sleeve hooded top.
"The hood was up, his face was covered.
"He was seen running from the area the bus stop is in to an area of open ground that borders the Tullygally Road, Aldervale flats and Drumglass estate.
"The area has a number of pathways and some people would refer to it as the 'black path' area."
Discussing the construction of the device, Det Supt Campbell said it was designed to "detonate when it was moved".
He added that there was a concrete block, which had a cavity underneath, and "within that was the explosive booby-trap device".
"It would have exploded when lifted in any way, in a cynical attempt to kill police officer, military colleagues or anyone who attempted to lift that block," said Det Supt Campbell.
He added that the block would have had to have been "manufactured", possibly in "a garage or shed".
"Someone may have seen that happening, and it may not have seemed suspicious at the time, but if it now does, then anyone who saw anything should come forward."
Police also believe whoever was behind the attack is likely to have "carried out some form of preparation in that area".
"They may well have been in the area carrying out a reconnaissance a few days or weeks before the device was planted," said Det Supt Campbell.