Cryptocurrency Address: Data Point Intelligence Guide
A blockchain address is a pseudonymous account with a permanent, public and complete transaction history. That combination makes it the...
Cyber Crime
Password / Credential: Data Point Intelligence Guide
An exposed credential is a defensive workload, not an offensive opportunity. The only question worth asking is which of your...
Data Breach: Data Point Intelligence Guide
A breach is not a single event, it is a dataset with a life of its own. The incident ends...
Onion / Hidden Service: Data Point Intelligence Guide
An onion address is a public key, not a location. Everything you can learn about a hidden service comes from...
Email Address: Data Point Intelligence Guide
An email address is an account key, a routing instruction and a reputation record in one string. It is also...
URL: Data Point Intelligence Guide
A URL is the only artifact that carries the attacker instruction set in plain sight. Parse it properly and it...
IP Address: Data Point Intelligence Guide
An IP address tells you where traffic went, not who sent it. Treat it as a lead on infrastructure, never...
Domain Name: Data Point Intelligence Guide
A domain name is the cheapest thing an adversary buys and the most expensive thing for them to keep clean....
Criminal Intelligence (CRIMINT): Intelligence Discipline Guide
Criminal intelligence is not case notes with better formatting. It is the discipline that turns scattered incidents into an articulable...
Financial Intelligence (FININT): Intelligence Discipline Guide
Follow the money is a cliche because it works. Financial intelligence is the discipline of following value through the institutions...
Cryptocurrency Intelligence (CRYPTINT): Intelligence Discipline Guide
Public blockchains keep a permanent, complete record of every transfer. The hard part was never the data. It is knowing...
Threat Actor Intelligence (ACTORINT): Intelligence Discipline Guide
Infrastructure changes weekly and tooling changes quarterly, but habits almost never change. Actor intelligence is the discipline of tracking what...
Dark Web Intelligence (DARKINT): Intelligence Discipline Guide
The dark web is not a place, it is an access-control problem. Most of what matters happens in venues no...
Cyber Intelligence (CYBINT): Intelligence Discipline Guide
Cyber intelligence is what turns telemetry into a story about an adversary. Without it you have logs. With it you...
Breach Intelligence (BREACHINT): Intelligence Discipline Guide
Most intrusions begin with a password that already worked somewhere else. Breach intelligence is the discipline of knowing which of...
Fraud & Identity: Mission Domain Intelligence Guide
The synthetic identity that just passed your onboarding checks has a credit file, a utility bill and eighteen months of...
Financial Crime: Mission Domain Intelligence Guide
Most financial crime cases are not cracked by a clever trade reconstruction. They are cracked by an entity that should...
Operational Security: Mission Domain Intelligence Guide
Investigations are compromised by their own footprint far more often than by adversary brilliance. A referrer header, a reused persona,...
Threat Analysis: Mission Domain Intelligence Guide
An indicator list is not intelligence. Intelligence is a judgement, held to a stated confidence, that changes what a decision-maker...
Malware: Mission Domain Intelligence Guide
A hash tells you a file was seen. A configuration extraction tells you the campaign identifier, the operator's infrastructure and,...
Dark Web Intel: Mission Domain Intelligence Guide
Most of what is posted on a criminal forum is advertising. The intelligence value is not in the claim but...
Ransomware: Mission Domain Intelligence Guide
A leak site countdown is a negotiating instrument, not a report. Half the value of ransomware intelligence lies in knowing...
Cyber Crime: Mission Domain Intelligence Guide
A single business email compromise crew does not need malware. It needs a lookalike domain registered on a Tuesday, a...
APT / Espionage: Mission Domain Intelligence Guide
The median intrusion that matters is not loud. It is a valid credential, a legitimate administrative tool and eleven months...
