TLS / JA3 Fingerprint: Data Point Intelligence Guide
Encryption hides the payload, not the handshake. The way a client says hello is often enough to name the software...
TLS / JA3 Fingerprint
Signals Intelligence (SIGINT): Intelligence Discipline Guide
Signals intelligence is a state function with a warrant behind it. For everyone else, the discipline still matters, because you...
Vulnerability Intelligence (VULNINT): Intelligence Discipline Guide
There are more vulnerabilities than you will ever patch. Vulnerability intelligence exists to tell you which few hundred actually matter...
Malware Intelligence (MALINT): Intelligence Discipline Guide
A malware sample is a confession. It documents what its author wanted, how they build software, and where they expect...
Cyber Intelligence (CYBINT): Intelligence Discipline Guide
Cyber intelligence is what turns telemetry into a story about an adversary. Without it you have logs. With it you...
Certificate Intelligence (CERTINT): Intelligence Discipline Guide
Every publicly trusted TLS certificate is logged in public within seconds of issuance. That log is one of the richest...
Malware: Mission Domain Intelligence Guide
A hash tells you a file was seen. A configuration extraction tells you the campaign identifier, the operator's infrastructure and,...
APT / Espionage: Mission Domain Intelligence Guide
The median intrusion that matters is not loud. It is a valid credential, a legitimate administrative tool and eleven months...
Nation State: Mission Domain Intelligence Guide
State activity rarely arrives labelled. It surfaces as a procurement order routed through a third-country freight forwarder, a research institute...
