Field
Field
Tools, the cycle, protocols, techniques, worked cases, and reference.
Tools
ToolLikelihood WordsEstimative lexicon and percentage bandsToolSource GradeAdmiralty source and information, scored apartToolCompeting HypothesesA matrix you fill yourselfToolBase RateFigures you enter
Cycle
Stage 1CommissionWhat exactly is being asked, and what would answer it?Stage 2BaselineWhat is already established, and what am I carrying in?Stage 3Hypothesis SetWhat are all the explanations, including the ones I dislike?Stage 4CollectionWhat may I lawfully take, and how do I keep it intact?Stage 5VerificationIs this what it claims to be?Stage 6ReconstructionIn what order did this happen, and who is connected to whom?Stage 7FindingWhat do I know, how sure am I, and what would change it?
Protocols
P-01Scoping a CaseBefore anything is collectedP-02Collect and PreserveArchive before you analyzeP-03Verify a Piece of ContentProvenance, source, date, locationP-04Geolocate and ChronolocateWhere, then whenP-05Test Competing HypothesesDisprove, do not confirmP-06Handle Digital EvidenceVolatile first, chain intactP-07Build a Defensible TimelineUTC, offsets, independent sourcesP-08Attribute with DisciplineMachine, operator, sponsorP-09Work the RecordPublic filings before private theoriesP-10Interview to Gather, Not to WinAccount first, challenge laterP-11Check the Harm and the LawRun this before you publish anythingP-12Write the FindingLikelihood, confidence, falsifierP-13Key Assumptions CheckWhat you are carrying in
Techniques
TechniqueAnalysis of Competing HypothesesA matrix scoring each item of evidence for inconsistency against every hypothesis at once.TechniqueKey Assumptions CheckWrite out every assumption the judgment rests on and stress-test each in turn.TechniquePremortemAssume the conclusion has been proven wrong and work backward to how it happened.TechniqueRed Team and Devil’s AdvocateSomeone independent argues the opposing case as strongly as they can, or plays the adversary.TechniqueDeception Check — MOM, POP, MOSES, EVEMotive, opportunity, and means; past opposition practices; my own sources and their vulnerability; evaluation of the evidence itself.TechniqueQuality of Information CheckSystematic review of each source’s access, reliability and motive, and of how far items corroborate independently.TechniqueIndicators and SignpostsObservable events defined in advance that would confirm or refute each hypothesis over time.TechniqueSource and Information GradingA letter for source reliability, A to F, and a number for information credibility, 1 to 6, assigned separately.TechniqueEstimative Likelihood LexiconA fixed mapping from words of probability to percentage bands, so “likely” means the same thing to writer and reader.TechniqueBase-Rate DisciplineInterpreting any test, match or alert against how common the thing is in the population being searched.TechniquePyramid of PainRanks indicators by how much it costs an adversary to change them: hash values, addresses, domain names, network and host artifacts, tools, and tradecraft at the top.TechniqueDiamond Model of Intrusion AnalysisEvery intrusion event has four features — adversary, capability, infrastructure, victim — and analysis proceeds by pivoting from one to another.TechniqueMITRE ATT&CKA catalog of adversary behavior: tactics as the objective, techniques as the method, procedures as a specific actor’s implementation.TechniqueIntrusion Kill ChainSeven phases from reconnaissance through weaponization, delivery, exploitation, installation, command and control, and actions on objectives.
Worked Cases
Worked caseWhen the Presumption Ate the EvidenceA prior belief that hardened into a starting assumptionWorked caseThe ConceptionOne dominant frame that survived every warning
Reference
ReferenceConfidenceSeparate from likelihoodReferenceOrder of VolatilityWhat disappears firstReferencePyramid of PainCost to change an indicatorReferenceDiamondFour features of an intrusionReferenceATT&CK TacticsThe catalog headingsReferenceKill ChainSeven phasesReferencePassive LookupsWhat each lookup returns