Credential / API Token: Data Point Intelligence Guide
An exposed credential is not a curiosity to explore. It is an incident with a clock running, and the only...
Detection Signature
Detection Signature: Data Point Intelligence Guide
A detection signature is intelligence written in executable form. Read as a document, it tells you exactly what its author...
Vulnerability Intelligence (VULNINT): Intelligence Discipline Guide
There are more vulnerabilities than you will ever patch. Vulnerability intelligence exists to tell you which few hundred actually matter...
Malware Intelligence (MALINT): Intelligence Discipline Guide
A malware sample is a confession. It documents what its author wanted, how they build software, and where they expect...
Domain Intelligence (DOMINT): Intelligence Discipline Guide
Domains are the cheapest and most disposable part of an attack, and the most revealing. Registration and DNS leave a...
Certificate Intelligence (CERTINT): Intelligence Discipline Guide
Every publicly trusted TLS certificate is logged in public within seconds of issuance. That log is one of the richest...
Malware: Mission Domain Intelligence Guide
A hash tells you a file was seen. A configuration extraction tells you the campaign identifier, the operator's infrastructure and,...
Ransomware: Mission Domain Intelligence Guide
A leak site countdown is a negotiating instrument, not a report. Half the value of ransomware intelligence lies in knowing...
APT / Espionage: Mission Domain Intelligence Guide
The median intrusion that matters is not loud. It is a valid credential, a legitimate administrative tool and eleven months...
