Vulnerability Intelligence (VULNINT): Intelligence Discipline Guide
There are more vulnerabilities than you will ever patch. Vulnerability intelligence exists to tell you which few hundred actually matter...
APT / Espionage
Threat Actor Intelligence (ACTORINT): Intelligence Discipline Guide
Infrastructure changes weekly and tooling changes quarterly, but habits almost never change. Actor intelligence is the discipline of tracking what...
Malware Intelligence (MALINT): Intelligence Discipline Guide
A malware sample is a confession. It documents what its author wanted, how they build software, and where they expect...
Domain Intelligence (DOMINT): Intelligence Discipline Guide
Domains are the cheapest and most disposable part of an attack, and the most revealing. Registration and DNS leave a...
Cyber Intelligence (CYBINT): Intelligence Discipline Guide
Cyber intelligence is what turns telemetry into a story about an adversary. Without it you have logs. With it you...
Certificate Intelligence (CERTINT): Intelligence Discipline Guide
Every publicly trusted TLS certificate is logged in public within seconds of issuance. That log is one of the richest...
Economic Espionage: Mission Domain Intelligence Guide
Industrial espionage rarely looks like a break-in. It looks like a departing researcher, a joint venture with an unusual data...
Operational Security: Mission Domain Intelligence Guide
Investigations are compromised by their own footprint far more often than by adversary brilliance. A referrer header, a reused persona,...
Threat Analysis: Mission Domain Intelligence Guide
An indicator list is not intelligence. Intelligence is a judgement, held to a stated confidence, that changes what a decision-maker...
Malware: Mission Domain Intelligence Guide
A hash tells you a file was seen. A configuration extraction tells you the campaign identifier, the operator's infrastructure and,...
