CONCEPT: Preparing cryptographic infrastructure for "Q-Day" — the point at which a cryptographically relevant quantum computer could break RSA/ECC via Shor's Algorithm.

ATTACKER MINDSET: Adversaries practice "harvest-now-decrypt-later" (HNDL) — exfiltrating encrypted traffic today, betting they can decrypt it once quantum capability matures. This makes long-shelf-life data (health records, state secrets) a priority target now.

DETECTION: Build a Cryptographic Bill of Materials (CBOM) to inventory every algorithm in use. Track migration progress against NIST's finalized standards.

LATEST:Verified NIST finalized ML-KEM (FIPS 203), ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) in 2024. On 22 June 2026 the White House signed Executive Order 14412, "Securing the Nation Against Advanced Cryptographic Attacks," setting hard federal deadlines: post-quantum key establishment by 31 Dec 2030 and post-quantum digital signatures by 31 Dec 2031, with contractors required to meet PQC FIPS by end of 2030. A companion order (EO 14413) covers quantum innovation. Agency migration plans were due to OMB by 22 Oct 2026.

WATCH THIS:Verified In July 2026 Anthropic reported that its Claude Mythos Preview model found a previously unknown weakness in HAWK, a lattice-based signature candidate under NIST consideration, in roughly 60 hours of work and about $100k of compute. The attack exploited a symmetry in HAWK's structure, cutting key recovery on the minimum parameter set from about 2⁶⁴ to 2³⁸ operations. HAWK had survived two years and two rounds of expert human review; its authors withdrew it from NIST consideration. A second result improved the best known attack on reduced-round (7-round) AES by 200–800×. Neither affects production systems — HAWK was never deployed and the AES work targets a deliberately weakened variant — but the implication for this syllabus is direct: the review process that certifies the crypto you will defend is now partly machine-driven, and its clock has sped up.

CONCEPT: Kernel-layer rootkits hide below where traditional user-space EDR looks.

ATTACKER MINDSET: A rootkit that hooks syscalls via eBPF doesn't spawn a new process — it just changes how existing ones behave, invisible to EDR.

LATEST:Verified VoidLink is the case study worth knowing. First documented by Check Point Research in January 2026 and analysed in depth by Elastic Security Labs in March 2026 after a source-code dump leaked, it is a cloud-native Linux framework written in Zig, attributed to a Chinese-speaking actor, with 30+ plugin modules and three interchangeable rootkit backends (LD_PRELOAD, LKM, eBPF) selected by target kernel version.

THE CLEVER PART: the LKM uses ftrace hooks on getdents64, vfs_read and do_send_sig_info for process/file hiding. Separately, an eBPF program hooks __sys_recvmsg and uses the bpf_probe_write_user() helper to rewrite Netlink socket-diagnostic responses in user memory — so ss simply never sees the hidden ports, without its output ever looking malformed. C2 rides on ICMP echo requests tagged with a magic ID (default 0xC0DE), single-byte XOR obfuscated, intercepted by Netfilter hooks — so there is no listening socket to find.

ALSO NOTABLE: Check Point presented evidence VoidLink was built largely through AI-assisted development by a single developer. Related in-the-wild eBPF rootkits include LinkPro and the Atomic Arch campaign; earlier research examples are TripleCross, Boopkit, and io_uring-based RingReaper.

DETECTION: treat BPF_PROG_LOAD as the highest-value telemetry point — a program's helper capabilities are knowable at load time, before it attaches and starts shaping what the host reports. Then cross-reference sources that should agree: ps vs /proc, ss vs /proc/net/tcp, lsmod vs /sys/module. Disagreement between two views of the same truth is the rootkit's signature. Enforce Secure Boot, kernel lockdown, and signed modules.

CONCEPT: Speculative-execution flaws (Spectre family) and DRAM physics flaws (Rowhammer) break security boundaries at the hardware level.

LATEST:Verified In September 2025, researchers at ETH Zürich and Google disclosed Phoenix (CVE-2025-6202, CVSS 7.1). They reverse-engineered SK Hynix's on-die Target Row Refresh (TRR) mitigation, then used that knowledge to build the first practical Rowhammer privilege-escalation exploit on a production DDR5 desktop — reaching root in about 109 seconds. All 15 tested SK Hynix modules manufactured between Jan 2021 and Dec 2024 were vulnerable, including modules with on-die ECC. The practical mitigation is tripling the DRAM refresh interval (tREFI), at a performance cost. A companion 2025 result, GPUHammer, demonstrated the same physics against GPU memory.

CONCEPT: Unified Extensible Firmware Interface (UEFI) lives on the motherboard's SPI flash chip. Bootkits patch the OS bootloader in memory. If you format the hard drive, the malware survives because it lives on the motherboard.

CONCEPT: Cyber-physical attacks cross the IT/OT boundary to cause physical-world effects. Air-gaps create false security. Real intrusions cross them via compromised engineering workstations or edge devices.

LATEST:Verified Joint advisory AA26-097A (FBI, CISA, NSA, EPA, DOE, CNMF, Treasury) was published 7 April 2026 and substantially updated 22 July 2026. It documents Iranian-affiliated APT actors — publicly tied to CyberAv3ngers / IRGC Cyber Electronic Command — exploiting internet-exposed PLCs across US water and wastewater, energy, and government facilities. Originally Rockwell Automation/Allen-Bradley; the July update expanded scope to Schneider Electric and Siemens, and added a new exfiltration technique: using the vendors' own legitimate engineering software to steal PLC project files (ATT&CK T1041).

THE LESSON: no zero-day was required. The actors found PLCs directly reachable from the internet with default or absent credentials. At one confirmed US victim they modified ladder logic to disable safety shutdown and alarm functions, and manipulated what HMI and SCADA displays showed operators — so the control room believed the process was nominal while it was not. The attack targets the operator's picture of reality, not just the equipment. This is the most important idea in OT security and it generalises well beyond ICS.

DETECTION: PLC firmware and logic-baseline hashing stored offline (this is both detection and recovery), protocol-aware ICS monitoring (Modbus/DNP3-specific IDS), IEC 62443 zone-and-conduit segmentation, and independent instrumentation you can cross-check the HMI against.

DETECTION: PLC firmware integrity hashing, protocol-aware ICS monitoring (Modbus/DNP3-specific IDS), and IEC 62443 zone-and-conduit segmentation.

CONCEPT: Baseline normal behavior — keystroke dynamics, login timing, spatio-temporal GPS drift. Stolen-but-valid credentials pass every authentication check; only behavior gives them away.

DETECTION: UEBA platforms score anomalies against peer groups rather than fixed thresholds, feeding risk-based alerting into the SIEM.

CONCEPT: Large-scale systems (Google's internal Zanzibar system, OpenFGA, SpiceDB) express permissions as relationship graphs rather than static access-control lists.

FORENSICS: The audit question shifts from "who has a role" to "what access paths does the relationship graph actually permit" — investigators trace privilege-escalation paths through the graph and hunt for stale relationship tuples.

THE KEY PRIMITIVE: A relation tuple asserts ⟨object⟩#⟨relation⟩@⟨user⟩, and putting a userset (object#relation) in the user position is what makes groups, nesting, and inheritance fall out of a single mechanism. Investigation centres on Expand (why was this permitted?) and reverse lookup (what can this subject reach?).

GO DEEPER: The Zero Trust & Authorization track covers the Zanzibar design in full — userset rewrite rules, the new enemy problem and zookies, the Leopard index, the open-source descendants, and a complete auditing methodology.

CONCEPT: Internal tools with broad data access are a recurring vector (e.g., the historical Uber "God View" misuses). Detection relies on immutable audit logging on internal tools and JIT (Just-In-Time) access.

CONCEPT: Cellular baseband processors run a separate, historically under-audited OS from the application processor, often with DMA access.

CONCEPT: EDRs inject DLLs to monitor Windows APIs. Modern malware dynamically resolves the Syscall ID (Hell's Gate) to bypass the API, or drops a signed but vulnerable driver (BYOVD) to gain Ring 0 access and kill the EDR callbacks.

CONCEPT: A backdoor hides inside a trained model's weights, utilizing neural backdoor latency to stay dormant through normal validation and activating only on a rare trigger pattern.

LATEST:Active research A line of research on bit-flip attacks shows that Rowhammer-induced flips in model weights can implant backdoor behaviour into an already-trained network, with no access to the training pipeline at all. This is the point where Phase 1's hardware content and Phase 3's ML content stop being separate subjects — verify the specific paper and its threat model before citing figures.

CONCEPT: Text steganography hides data by shifting next-token probability distributions during generation — utilizing stochastic variations in synonym choice and punctuation as a covert channel.

LATEST:Active research Recent work reports early signs that frontier language models can encode information steganographically without being explicitly trained to do so — see the arXiv paper linked in Resources, and treat the strength of the claim as contested rather than settled.

DETECTION: Uses LLMs themselves as detectors, comparing a suspect text's token-level probability distribution against what a clean model would generate in the same context.

CONCEPT: Small corruptions introduced early in a training pipeline compound into systemic downstream failures — informally a "dragon tail" risk.

DETECTION: Data provenance/lineage tracking, influence functions (identifying which training points most affect a prediction), dataset versioning with hash-based integrity checks.

CONCEPT: Perturbation tools like Fawkes and Nightshade subtly alter images so facial-recognition or classifier models misread them while looking normal to a human.

DETECTION: Investigators need to recognize when evidentiary images have been perturbed, since it affects the reliability of automated facial-recognition matches in casework.

CONCEPT: Structurally-equivalent-but-differently-shaped code — opaque predicates, visually-identical Unicode "confusable" characters (UTS #39) — slips past static analysis without changing code functionality.

CONCEPT: Bytecode reordering and resource-alignment manipulation can alter an APK's internal structure without changing its apparent runtime behavior to encode persistent bitstreams.

DETECTION: Dalvik bytecode integrity hashing, reproducible-build verification against known-good hashes, and mobile threat defense (MTD) platforms.

CONCEPT: Media files are the highest-capacity covert channel available on a normal network, and video is the richest of all — a single minute of 1080p carries enough redundancy to hide megabytes without a visible artifact. Data can be hidden in the container (unused MP4 atoms), in transform coefficients, in motion vectors, or in coding decisions the encoder makes thousands of times per second.

ATTACKER MINDSET: "Stegomalware" hides a payload inside an innocuous-looking media file so that neither the file's extension, its MIME type, nor a signature scan reveals anything. The file plays normally. Egress filtering sees a video upload, which is the single most unremarkable thing on a corporate network.

DETECTION: Container-level anomalies are cheap to spot (bitrate/duration/filesize mismatch, trailing data past the last atom). Codec-level embedding requires statistical steganalysis — see the dedicated STEGO_LAB track for the full treatment.

CONCEPT: Advanced malware encrypts itself ("packing") so if you look at the file on the hard drive, it just looks like random garbage.

CONCEPT: Data can be encoded in inter-packet timing jitter or protocol-header patterns, designed to statistically blend with normal traffic baseline.

DETECTION: Statistical regularity tests on packet timing, entropy analysis of header fields, and JA3/JA4 TLS-handshake fingerprinting (using Zeek/Suricata).

CONCEPT: Centralized policy-decision-point (PDP) bottlenecks, "authenticate once" assumptions, and static risk scoring create blind spots. A validated-but-malicious payload can walk straight through.

DETECTION: Continuous adaptive trust (CAT) models that re-score risk dynamically throughout a session, real-time risk engines, and active ZTA red-teaming.

THE DEEPER FAILURE: Every check can be perfect and still return yes for someone who should have lost access months ago, because the underlying permission was never revoked. Zero Trust verifies the requester rigorously, then asks the authorization model a question — and enforces whatever answer it gets.

GO DEEPER: The Zero Trust & Authorization track covers NIST SP 800-207's logical components, the CISA maturity model, each documented failure mode, and how relationship-based authorization supplies the structural half of the answer.

CONCEPT: Trusted Execution Environments (Intel TDX, AMD SEV-SNP, ARM CCA), remote attestation, Zero-Knowledge Proofs (ZKPs), and Cryptographic Information Flow Control (CIFC) let you prove code ran correctly, preventing runtime memory scraping.

LATEST: Confidential computing is extending across the CPU-GPU boundary for AI workloads (e.g., AMD SEV-SNP confidential VMs paired with NVIDIA confidential GPU compute). The open research problem is "composite attestation" across multiple hardware vendors.

CONCEPT: Coordinated Inauthentic Behavior (CIB) where bot and sockpuppet networks manipulate platform recommendation algorithms through synchronized, non-organic engagement to achieve narrative distortion.

DETECTION: Individual account analysis is obsolete. Analysts construct similarity-network graphs, track cross-platform coordination (X, Telegram, TikTok), and map graph-neural-network anomalies.

CONCEPT: Advanced defensive and intelligence teams deploy multi-threaded reconnaissance frameworks to navigate and parse the deep/dark web. Tools like the MEDÚSA suite act as active, cutting-edge AI-driven web mining platforms. They crawl, extract data, run automated facial recognition, and convert chaotic spaces into structured profiles.

DETECTION: Utilizing commercial dark-web monitoring platforms, enterprise credential-leak monitoring, and OSINT collection under chain-of-custody standards.

CONCEPT: To hide their origin and preposition inside critical infrastructure, Chinese APTs compromise thousands of Small Office/Home Office (SOHO) routers. They route their attacks through domestic internet connections to look like local traffic.

CONCEPT: Medusa is an active Ransomware-as-a-Service (RaaS) operation. They moved beyond simple encryption by running their own weaponized public intelligence node called "OSINT Without Borders" to broadcast exfiltrated target profiles, weaponizing OSINT principles against the victim to force payment.

DETECTION: Map observed activity to MITRE ATT&CK using the CISA/FBI #StopRansomware advisory (AA25-071A) IOCs. Forensics focuses on offline/immutable backups and tracking the specific unpatched-software vectors the syndicate relies on.

CONCEPT: Turla exploits unencrypted DVB-S (Digital Video Broadcasting—Satellite) links. They spoof the IP address of a legitimate satellite internet user in a remote location to hide C2 servers.

DETECTION: Law enforcement and threat hunters must trace BGP routing anomalies and physical signal triangulation, rather than relying on standard IP blocklists.

CONCEPT: Binary, hexadecimal, and why hex is the reverser's native language — one hex digit is exactly four bits, so a byte is always two clean hex characters. Two's complement for signed integers. Endianness: little-endian (x86/x64, ARM in its usual mode) stores the least-significant byte first; big-endian does the opposite.

WHY IT MATTERS: every address, opcode, and immediate value you will ever see in a disassembler is hex. Misreading endianness is the single most common beginner mistake when reconstructing a struct or an IP address by hand from raw bytes.

CONCEPT: Preprocessor → compiler (source to assembly) → assembler (assembly to machine code/object files) → linker (object files + libraries → final executable). Static linking folds library code directly into the binary; dynamic linking leaves it to be resolved at load time via the import table.

WHY IT MATTERS: a decompiler's output never looks like the original C because information is destroyed at every stage — variable names, comments, and type information don't survive compilation. Reverse engineering is, fundamentally, the business of reconstructing what the build pipeline threw away.

CONCEPT: General-purpose registers (RAX/RBX/RCX/RDX/RSI/RDI/RBP/RSP plus R8–R15 on x64), the instruction pointer (RIP), and the EFLAGS/RFLAGS condition bits that drive every conditional jump. The stack grows downward and is strictly LIFO; a function's prologue (push rbp; mov rbp, rsp; sub rsp, N) and epilogue define its stack frame.

CALLING CONVENTIONS: legacy 32-bit Windows used cdecl/stdcall/fastcall; modern 64-bit code uses the System V AMD64 ABI on Linux/macOS (arguments in RDI, RSI, RDX, RCX, R8, R9) or the Microsoft x64 convention on Windows (RCX, RDX, R8, R9). Knowing the convention lets you read a function's arguments straight off the registers before a single line of decompiled pseudocode exists.

PE (Windows): DOS header/stub → NT headers (COFF file header + optional header) → section table (.text/.data/.rdata/.rsrc) → Import Address Table (IAT) → export table.

ELF (Linux): ELF header → program headers (how the loader maps segments into memory) → section headers (symbols, relocations) → the dynamic section (.dynsym/.dynstr) used to resolve shared libraries at runtime.

MACH-O (macOS/iOS): load commands describing segments, and the LC_MAIN command marking the entry point — structurally different from PE/ELF but serving the same purpose.

WHY IT MATTERS: the import table alone tells you what a program can do before you disassemble a single instruction. A binary importing CreateRemoteThread and WriteProcessMemory is telling on itself.

CONCEPT: file to identify the format, strings -n 8 to surface hardcoded URLs/IOCs/error messages, hashing (MD5/SHA-256) to cross-reference against VirusTotal or MalwareBazaar, and signature scanners like Detect It Easy (DIE) to fingerprint the compiler and check for a packer before you invest hours in deeper analysis.

WHY IT MATTERS: most "what is this file" questions get answered in the first five minutes, before a disassembler is ever opened. Triage is a discipline, not a shortcut — skipping it is how analysts waste a day reversing something that a hash lookup would have identified in seconds.

CONCEPT: HxD (Windows, free), 010 Editor (paid, template-driven structure parsing), and ImHex (free, open-source, with a live pattern language for parsing binary formats as you scroll). A hex editor is where you internalize that "everything is bytes" — a JPEG header, a PE header, and an encrypted blob are indistinguishable to a computer except by the meaning a format spec assigns to the byte patterns.

PRACTICE: in a disposable copy of a binary inside an isolated analysis VM, use a hex editor to flip a single conditional-jump opcode byte (0x74 JE ↔ 0x75 JNE) and observe how the patched behavior changes — the smallest possible demonstration of what "patching" means.

CONCEPT: a disassembler maps raw opcode bytes back to assembly mnemonics. Linear sweep disassembly reads bytes straight through and breaks the moment it hits embedded data misread as code; recursive descent disassembly follows actual control flow (branches, calls) the way IDA and Ghidra do, which is far more accurate but still fooled by indirect jumps computed at runtime.

WHY IT MATTERS: perfect disassembly is undecidable in the general case — this is exactly why modern tools are interactive rather than fully automatic, and why the human in the loop (you) is still the most important part of the pipeline.

CONCEPT: the Functions window for navigating everything IDA has identified; Graph view (control-flow blocks and arrows) versus Text view (linear listing) of the same function; the Hex View pane synced to your cursor; the Strings window; and Xrefs — cross-references answering "who calls this function" or "who references this string," the single most-used feature for navigating a large unfamiliar binary. FLIRT signatures automatically recognize statically-linked standard-library functions so you never waste time reversing memcpy.

WORKFLOW HABIT: rename functions and variables the moment you understand what they do — sub_401020 becomes decrypt_config_blob — so your future self (and anyone reading your notes) inherits the work instead of re-deriving it.

CONCEPT: developed by the NSA and released under Apache-2.0, Ghidra centers on the CodeBrowser workspace and ships a built-in decompiler that rivals Hex-Rays for many architectures at zero cost. Version Tracking supports diffing binaries across builds, and the whole tool is scriptable via Python or Java.

GHIDRA VS. IDA: because it's free and scriptable, Ghidra is the default starting point for most students and the tool most CTFs assume you already have. IDA Pro tends to take over for professional work once decompiler polish and processor-module coverage start to matter for the job.

CONCEPT: a "crackme" is a small program deliberately built to be reverse-engineered — almost always a serial-number or password check with no real-world payload. Start with unpacked, non-obfuscated 32-bit crackmes on crackmes.one, picoCTF's Reverse Engineering category, and Root Me's beginner track.

GOAL AT THIS TIER: locate the comparison, understand what input makes it succeed, and explain why in your own words. You are reading code, not writing exploits — that distinction is what keeps this tier squarely educational.

CONCEPT: x64dbg (Windows, free, user-mode, spiritual successor to OllyDbg), WinDbg (Microsoft's kernel- and user-mode debugger with symbol-server integration for resolving Windows internals), gdb extended with pwndbg or GEF on Linux, and lldb on macOS. Breakpoints can be software (an injected INT3) or hardware (CPU debug registers, harder for a target to detect); stepping can go into or over calls; conditional breakpoints let you skip past thousands of loop iterations to the one that matters.

CONCEPT: Hex-Rays and Ghidra's decompiler both reconstruct C-like pseudocode from assembly — a reconstruction, not the original source. Learning to retype variables and structures (turning a1 + 0x18 into packet->header.length) is most of the actual skill. Recognize common compiler patterns: switch-statement jump tables, loop unrolling, stack-canary checks (__security_cookie), and tail-call optimization that can make control flow look deceptively linear.

CONCEPT: both tools expose their full object model to a scripting API — IDAPython for IDA, a Python/Jython or Java API for Ghidra. Common uses: batch-renaming thousands of functions from a symbol list, walking every string in a binary to auto-extract IOC-shaped data, or diffing the function list between two samples.

WHY IT MATTERS: the moment you're analyzing more than one sample of a family, scripting the repetitive parts is what separates a manual reverser from an efficient one.

CONCEPT: BinDiff (Google, free) and Diaphora compare two binaries function-by-function using structural and graph-based matching rather than a byte-for-byte comparison.

CONCEPT: a "packer" compresses or encrypts the real code and wraps it in a small stub that reconstructs it in memory at runtime — which is why the file on disk looks like noise (high entropy) even though it runs fine. UPX is the classic teaching packer because it's unencrypted and trivially reversible (upx -d), which makes it ideal for learning the underlying concept before facing custom packers.

METHOD: find the Original Entry Point (OEP) — the address execution jumps to once the real code is unpacked — by breakpointing on suspicious memory-write patterns, then dump the unpacked process image with Process Hacker or Scylla once you're sitting at OEP in a debugger.

CONCEPT: protected software checks whether it's being watched — IsDebuggerPresent/CheckRemoteDebuggerPresent, timing checks around RDTSC (code runs suspiciously slowly under a debugger), CPUID-based hypervisor-bit checks, and VM-specific artifacts (registry keys, MAC OUI ranges, driver names).

ANALYST'S JOB: recognize that a check is happening and where it branches, so you can patch the single conditional jump or adjust a register value in your own debugger and keep analysis moving — strictly inside a lab environment you control. This is analysis tradecraft for getting past a target's defenses during legitimate research, not a technique for use outside that context.

CONCEPT: opaque predicates (branches whose outcome is always the same but isn't obvious to a machine), control-flow flattening (collapsing normal structure into a giant switch-driven state machine), and full binary virtualization (VMProtect, Themida) that translates the original code into a custom bytecode run by an embedded VM interpreter.

CONNECTS TO: the SMT-solver and IR-lifting techniques from Phase 4 — angr/Z3 for resolving opaque predicates, Miasm/Triton for lifting mutated assembly into a reasoning-friendly intermediate representation. IDA Pro's built-in gooMBA plugin targets this exact class of problem for Mixed Boolean-Arithmetic obfuscation.

CONCEPT: Frida (scriptable, cross-platform, huge community), Intel Pin, and DynamoRIO inject instrumentation into a running process without modifying the binary on disk. Used for automated unpacking (dump memory the instant a decrypt routine finishes), full API-call tracing across an execution, and building repeatable analysis pipelines that don't need a human driving a debugger for every single sample.

CONCEPT: angr and Triton represent a program's execution as symbolic formulas instead of concrete values, letting an SMT solver like Z3 answer questions such as "what input reaches this code path" mathematically, across thousands of paths a human could never manually trace. The same machinery introduced for homoglyph/opaque-predicate deobfuscation in Phase 4 generalizes into a core advanced-tier skill here.

CONCEPT: connects directly to Phase 1's Ring -3/UEFI work and Phase 2's baseband auditing — JTAG/SWD for hardware debug access, Ghidra's processor modules covering MIPS/ARM/Xtensa/PowerPC (the architectures firmware actually runs on), and binwalk for carving filesystems and compressed blobs out of a raw firmware dump before anything gets loaded into a disassembler.

CONCEPT: how it comes together in a real workflow — sandbox detonation (CAPEv2 or Cuckoo Sandbox for automated behavioral reports) to triage volume quickly, manual static and dynamic analysis reserved for whatever the sandbox can't explain, YARA rule authoring to generalize a finding into a reusable detection signature, and reporting mapped to MITRE ATT&CK technique IDs so the work is actually consumable by a SOC.

THE LOOP: automate the easy 90%, reverse the hard 10% by hand, turn every finding into a detection. That loop is the actual day-to-day job.

CONCEPT: Simmons' Prisoners' Problem is the canonical framing: two prisoners plan an escape through messages that a warden reads. If the warden merely observes, they are a passive warden; if they alter messages in transit to destroy any hidden content, they are an active warden. The cover is the innocent carrier, the payload is the hidden data, the stego-object is the result.

THE TRADE-OFF TRIANGLE: capacity, imperceptibility, and robustness are in direct tension — you cannot maximize all three. Push capacity up and statistical detectability rises with it. Add robustness against re-encoding and you burn capacity on redundancy. Every real scheme picks a corner, and which corner it picked is itself a forensic clue.

WHY IT MATTERS: Kerckhoffs's principle applies here too — security must rest on the stegokey, not on the secrecy of the algorithm. Any scheme whose only defence is that you haven't heard of it fails the moment an analyst does.

SPATIAL DOMAIN: LSB substitution replaces the least-significant bit of pixel values; LSB matching (±1 embedding) increments or decrements instead, which avoids the structural pairing artifact that made naive LSB trivially detectable in the early 2000s.

TRANSFORM DOMAIN: in JPEG, embedding targets quantized DCT coefficients rather than pixels, since the pixels don't survive compression. JSteg, F5 (matrix encoding to reduce the number of changes) and OutGuess are the historically important schemes, and remain the standard teaching examples.

MODERN / CONTENT-ADAPTIVE: current schemes (HUGO, WOW, S-UNIWARD, HILL) assign a cost to changing each pixel and concentrate embedding in texturally complex regions where change is statistically cheap — edges, noise, foliage — while avoiding smooth gradients like skies where any modification screams. Syndrome-trellis codes (STC) then minimize total distortion for a given payload. This is the real state of the art, and why "just check the LSBs" stopped working two decades ago.

STRUCTURAL / STATISTICAL: the chi-square attack detects the frequency-histogram flattening caused by sequential LSB embedding; RS analysis and sample-pair analysis estimate the embedding rate rather than just flagging presence.

FEATURE-BASED (the workhorse era): SPAM features and the Spatial Rich Model (SRM) extract thousands of noise-residual co-occurrence features, then train an ensemble classifier to separate cover from stego. This is still a strong, interpretable baseline.

DEEP LEARNING: purpose-built CNNs — XuNet, YeNet, SRNet, ZhuNet — learn residual features directly and now dominate benchmark performance. The ALASKA2 competition brought this into the open in a realistic multi-source setting.

THE HARD PROBLEM: cover-source mismatch. A detector trained on one camera's sensor noise, one processing pipeline, or one JPEG quality factor degrades badly on another. This is the single biggest obstacle to deploying steganalysis operationally, and the reason academic accuracy figures rarely survive contact with real casework.

CONCEPT: video offers everything an attacker wants in a cover medium: enormous raw capacity, heavy spatial and temporal redundancy, and total ubiquity — video uploads are the least suspicious traffic on any modern network. It also offers something images don't: an entire layer of encoder decisions (motion estimation, partitioning, mode selection) that carry information yet have no single "correct" value, making them ideal places to hide data.

THE KEY INSIGHT: a video codec is a lossy compressor making millions of near-tie decisions per file. Whenever an encoder faces two nearly-equal-cost choices, a steganographic scheme can pick the one that encodes a bit. Detection therefore reduces to a sharp question: did this encoder make the choices a normal encoder would have made?

Video hiding happens at four distinct levels, in increasing order of sophistication and decreasing order of detectability by simple tooling:

CONCEPT: the crudest and by far the most common approach in the wild — append a payload after the final atom, or stuff it into a free/skip box the demuxer is contractually obliged to ignore. The video plays perfectly because no decoder ever reads those bytes.

DETECTION: this is a five-minute check and should be the first thing any analyst does. Parse the atom tree and confirm the sum of declared box sizes equals the actual file size; anything beyond the last atom is unaccounted-for data. Cross-check declared duration × bitrate against real filesize. Run binwalk for embedded archive/executable signatures and exiftool for metadata inconsistencies.

WHY IT STILL WORKS: because most detection stacks never parse container structure at all — they check extension, MIME type, and an AV signature, all three of which pass cleanly.

CONCEPT: I-frames are compressed much like JPEGs, so transform-domain image steganography carries over directly — embed in quantized DCT (H.264) or DCT/DST (HEVC) residual coefficients. Two codec-specific variants have no image equivalent: intra-prediction mode embedding, which encodes bits in the choice among directional prediction modes, and QP modulation, which encodes in per-block quantization parameter selection.

DETECTION: the distribution of prediction modes in natural video follows strong content-dependent regularities — mode selection correlates with actual edge orientation in the block. Embedding perturbs that correlation. Feature sets built on mode-transition statistics and coefficient histograms feed a trained classifier.

CONCEPT: the most-researched video steganography domain. Inter-predicted blocks reference a region of a previous frame via a motion vector; because the encoder's search is a heuristic rate-distortion optimization rather than an exact solution, a slightly different MV is often almost as good. Schemes embed in MV components, in the motion vector difference (MVD), or — in HEVC — in the MVP index selected from the AMVP candidate list. Related approaches embed in CU quadtree partition depth.

CONCEPT: below the codec's semantic layer sits the entropy coder (CABAC in H.264/HEVC main profiles, CAVLC in baseline). Data can ride in syntax-element choices, in optional SEI (Supplemental Enhancement Information) messages the decoder ignores, or in slice-header padding. Capacity is low and the techniques are tightly format-specific.

DETECTION: parse the bitstream and validate every NAL unit against the specification — unexpected SEI payload types, non-canonical padding, and emulation-prevention-byte anomalies are all directly observable without any statistical modelling.

CALIBRATION: the workhorse technique across all media. Re-encode the suspect file under known-good settings to produce an estimate of what the "clean" statistics should look like, then measure the divergence between suspect and calibrated reference.

FEATURE-BASED: MV local-optimality rates, MVD-domain features, prediction-mode transition statistics, CU partition-depth distributions — fed into an ensemble classifier.

DEEP LEARNING: selection-channel-aware networks that focus capacity on the regions most likely to carry payload, and detectors operating in MVD feature space.

THE ATTACKER'S REAL ENEMY: transcoding. Any platform that re-encodes on upload (which is nearly all of them) destroys codec-level payloads outright. This forces attackers toward container-level hiding or direct file transfer — which is precisely why the cheap triage in topic 3 catches so much real-world activity.

ORDER OF OPERATIONS: work cheapest-first — most real cases resolve long before you reach statistical steganalysis.

• Container integrity — parse the atom/element tree; reconcile declared sizes against actual filesize; flag trailing data.
• Metadata — exiftool and ffprobe for encoder strings inconsistent with the claimed source device or a re-encode that shouldn't have happened.
• Signature carving — binwalk for embedded archives, executables, or filesystem headers.
• Bitrate sanity — filesize wildly out of line with duration × resolution × codec efficiency.
• Entropy profile — uniformly high entropy in regions that should be structured suggests appended encrypted data.
• Statistical steganalysis — only once the above come back clean and suspicion remains.
• Context — the strongest signal is often behavioral, not statistical: who sent a 400 MB video to an endpoint that has never handled video before?

CONCEPT: LSB embedding in PCM samples; echo hiding (encoding bits in imperceptible echo delays); phase coding (exploiting human insensitivity to absolute phase); spread-spectrum embedding across the frequency band; and compressed-domain schemes such as MP3Stego operating during encoding.

DETECTION: spectrogram inspection catches a surprising amount — deliberately drawn spectrogram images and abrupt high-frequency energy bands are visible by eye in Audacity or Sonic Visualiser. Beyond that: statistical analysis of sample distributions, and format-specific detectors for known tools.

CONCEPT: NTFS alternate data streams, file slack space, and polyglot files (a single file that is validly both a JPEG and a ZIP, for instance) hide data at the storage layer rather than inside media content.

NETWORK: covert channels in protocol header fields, TCP initial sequence numbers, IPv6 extension headers, and DNS query patterns. Timing-based variants are covered in Phase 4; the storage-based ones here are a standard part of dead-box forensics.

DATASETS: BOSSbase and BOWS2 are the standard image steganalysis corpora; ALASKA2 (from the Kaggle competition) provides a realistic multi-source JPEG set specifically designed to expose cover-source mismatch; StegoAppDB covers mobile-app-generated stego images.

TOOLS: Aletheia (modern steganalysis toolkit), StegExpose (LSB detection), zsteg (PNG/BMP), StegSeek, stegsolve, plus the general-purpose binwalk / exiftool / ffprobe trio for triage.

CTF ON-RAMP: almost every CTF has a forensics/stego category, and the challenges are legal, purpose-built, and come with published writeups — the fastest way to build intuition for what "something is off about this file" actually feels like.

THESIS ANGLE: if you need a research topic, video steganalysis is unusually well-suited — the cat-and-mouse between local-optimality detectors and optimality-preserving embedding is active, the datasets are public, and the codec internals are fully specified in the H.264/H.265 standards.

VIRTUALBOX: free, cross-platform, fine for learning. Snapshots work well. Downside: its guest additions and device fingerprints are trivially detectable, so evasive malware will notice and may refuse to run.

VMWARE WORKSTATION PRO / FUSION: free for personal use since 2024. Better performance and better snapshot handling. Same detectability caveat, but broadly what most analysis courses assume.

PROXMOX / KVM: if you have spare hardware, a dedicated bare-metal hypervisor is the cleanest option — total network control, no host OS sharing a kernel with your analysis VMs.

WHAT TO AVOID: WSL, Docker on your daily driver, or "I'll just be careful." Containers share the host kernel; that is not an isolation boundary you want between you and a kernel rootkit.

DEFAULT POSTURE: host-only or internal networking. No NAT, no bridged adapter. The VM must not be able to reach your LAN, your router's admin page, your NAS, or the internet.

WHY NOT JUST NAT: NAT gives the sample real internet access. It will phone home, potentially attributing your IP to a threat actor's telemetry, pulling second-stage payloads, or joining a botnet from your home connection.

SIMULATED INTERNET: this is the trick that makes dynamic analysis actually work. Run INetSim (on REMnux) or FakeNet-NG to answer DNS for everything and serve plausible responses on common ports. The malware believes it has connectivity, beacons happily, and you capture the entire C2 conversation — while nothing leaves the lab.

ALSO DISABLE: shared folders, shared clipboard, drag-and-drop, and USB passthrough. These are guest-to-host bridges. Ransomware has historically encrypted host files through shared folders left mounted.

THE LOOP: build the VM → install tooling → update → snapshot clean → detonate → observe → revert to clean. Never analyse a second sample in a VM that has already run a first one; you will not be able to tell which artifacts came from which.

NAME SNAPSHOTS PROPERLY: clean-win10-flarevm-2026-08 beats Snapshot 3 when you come back in six weeks.

KEEP THE BASE OFFLINE: take the clean snapshot before the VM has ever touched a sample, and treat it as read-only ground truth.

WHAT IT IS: Mandiant's script that turns a clean Windows VM into a fully-equipped reverse engineering workstation — IDA Free, Ghidra, x64dbg, PEStudio, Detect It Easy, dnSpy, Wireshark, Sysinternals, and a few hundred more, installed and pathed.

INSTALL SHAPE: fresh Windows 10/11 VM, Windows Defender and Windows Update disabled (they will otherwise delete your samples and reboot mid-analysis), snapshot, then run the installer. It takes a while and reboots repeatedly. Snapshot again when finished — that is your clean base.

WHAT IT IS: Lenny Zeltser's Ubuntu-based distribution preloaded for malware analysis — INetSim, Volatility, YARA, oletools, pdf-parser, radare2, Ghidra, network capture tooling, and document/script analysis utilities.

THE CLASSIC PAIRING: REMnux as the network-services and analysis host on one virtual segment, a Windows FLARE-VM as the detonation target on the same segment, host-only. REMnux plays "the internet"; the Windows VM plays the victim; you watch everything.

MALWAREBAZAAR (abuse.ch): free, no-cost registration, well-tagged, API access. The standard starting point.

MALSHARE / VIRUSSHARE: large corpora; VirusShare requires requesting an account.

VX-UNDERGROUND: vast collection including source code and papers. Note that some material there is genuinely destructive.

THEZOO: curated teaching repository on GitHub, deliberately small and organised by family — good for a first sample.

SAFEST OF ALL: for learning workflow rather than analysing live threats, use purpose-built targets — crackmes.one, CTF binaries, the Practical Malware Analysis lab files, and the Volatility Foundation's public memory images. You get the skill without the risk.

WHY BOTHER: Phase 1's firmware work and Tier 3's embedded targets need real hardware. Virtualisation cannot give you an SPI flash chip.

CHEAP AND USEFUL: a CH341A SPI programmer with a SOIC-8 clip (for reading BIOS/router flash), a USB-to-UART adapter (serial consoles on routers and IoT devices), a second-hand router you are willing to brick, and an old laptop for bare-metal work. This is a small amount of money for a large amount of capability.

NEXT TIER: a logic analyser, a JTAG/SWD debug probe, and a Raspberry Pi as a controllable network gateway.

CONCEPT: evidence disappears at different rates. RFC 3227 formalises the ordering, and it drives every decision at a scene: CPU registers and cache → RAM → network state and running processes → disk → remote logs → physical config and archival media.

THE PRACTICAL CONSEQUENCE: capture memory before you pull the plug. Encryption keys, injected code, unpacked malware, network connections, and clipboard contents exist only in RAM. Pulling power to "preserve" the disk destroys all of it — and against fileless malware, RAM was the entire case.

THE TENSION: acquiring memory from a live system changes that system (your tool loads into the memory you're capturing). This is unavoidable and accepted — you document it. Document what you ran, when, and with what version. Defensible process beats an impossible standard of purity.

WRITE BLOCKERS: hardware devices that physically permit reads and refuse writes. Mounting evidence without one updates access timestamps and can trigger filesystem journal replay — you have altered evidence before you started. Software write-blocking exists but hardware is the defensible choice.

FORMATS: raw/dd (exact bytes, large, universally readable), E01/EWF (compressed, with embedded case metadata and per-block checksums — the forensic standard), and AFF4 for very large or cloud-scale acquisitions.

HASH BEFORE AND AFTER: hash the source, image it, hash the image, confirm they match, and record all of it. This is what lets you assert in a report — or in court — that the image is what you say it is. An image without a verified hash is an anecdote.

TOOLS: WinPMEM (Windows), AVML (Microsoft's Linux acquisition tool, works across kernels without compilation), LiME (Linux kernel module, needs matching headers). On a VM, pausing and copying the memory file is the cleanest capture available — zero footprint on the guest.

HIBERNATION AND SWAP: hiberfil.sys, pagefile.sys, and crash dumps contain memory contents too. On Linux, check swap. These persist across reboots and are frequently overlooked.

CONCEPT: a memory image is an unstructured blob until a framework imposes structure on it using knowledge of OS internals. Volatility walks kernel structures to reconstruct the process list, network connections, loaded modules, and injected regions.

THE CORE SEQUENCE: list processes, then scan for processes, then compare the two. pslist walks the kernel's linked list; psscan scans memory for process structure signatures. A process appearing in psscan but not pslist has been unlinked — that is Direct Kernel Object Manipulation, and it is a rootkit's fingerprint.

WHAT MALFIND ACTUALLY FINDS: memory regions that are executable, writable, and not backed by a file on disk. Legitimate code is normally mapped from a file. Anything executing from anonymous RW memory is either a JIT compiler or something injected — and you can tell which by looking at what's there.

NTFS: the $MFT is the master index — one record per file, holding four timestamps (created, modified, accessed, MFT-modified) in two attributes, $STANDARD_INFORMATION and $FILE_NAME. Timestomping tools typically alter only the first. Disagreement between $SI and $FN timestamps is a direct anti-forensics indicator. $LogFile and $UsnJrnl record filesystem transactions, often recovering deleted-file history.

EXT4: inodes carry crtime, mtime, atime, ctime. The journal can yield recently-overwritten metadata. Deleted-file recovery is harder than NTFS because extent pointers are zeroed.

APFS: copy-on-write with snapshots — snapshots are often a forensic gift, preserving prior states of the whole volume.

SLACK AND UNALLOCATED: file slack (between logical file end and cluster end) and unallocated space hold remnants. Carving tools (photorec, scalpel, foremost) recover files by header/footer signature with no filesystem metadata at all.

THE CLASSIC QUESTION: "did this program run on this machine, and when?" Several independent artifacts answer it, and the strength of a finding comes from how many of them agree.

PREFETCH (C:\Windows\Prefetch) — records execution, run count, and last-run timestamps for up to the last 8 runs. Strong execution evidence.

AMCACHE / SHIMCACHE — application compatibility data. Shimcache records presence and path (execution is not guaranteed); Amcache adds SHA-1 hashes. Read the semantics carefully; this trips up beginners constantly.

REGISTRY — SYSTEM, SOFTWARE, NTUSER.DAT: Run keys and Services for persistence, UserAssist for GUI program launches, ShellBags for folder access, MRU lists, USB device history in USBSTOR.

EVENT LOGS (.evtx) — 4624/4625 logon success/failure with logon type, 4688 process creation (with command line, if enabled), 7045 service installation, 1102 log cleared. That last one is a finding in itself.

ALSO: LNK files and Jump Lists (file access, including from removable media that is long gone), SRUM (per-application network usage), Recycle Bin $I/$R pairs, browser history and cache.

LINUX: /var/log/auth.log and secure for authentication; journalctl for systemd; auditd if configured (and it should be); ~/.bash_history (unreliable — trivially cleared, often not flushed); cron, systemd timers and units, /etc/rc.local, and ~/.bashrc for persistence; /proc on a live system for anything hiding.

MACOS: Unified Logs (dense, and log show has a steep learning curve), FSEvents for filesystem change history, LaunchAgents/LaunchDaemons for persistence, Spotlight metadata, quarantine extended attributes recording download provenance.

CONCEPT: individual artifacts are data points; a super timeline merges every timestamped artifact from every source into one chronological view. This is where an intrusion narrative actually appears — phishing email at 09:14, macro execution 09:15, service installed 09:17, lateral movement 09:41.

TOOLING: log2timeline/Plaso to parse and normalise, psort to filter and output, Timesketch for collaborative visual analysis.

THE PIVOT TECHNIQUE: find one confirmed malicious event, then examine everything within a tight window around it. Activity clusters. What happened in the sixty seconds either side of a known-bad event is nearly always the rest of the story.

OPEN SOURCE: Autopsy / The Sleuth Kit (full GUI examiner), Volatility 3, Plaso, Velociraptor (endpoint visibility and hunting at fleet scale — increasingly the centre of open-source DFIR), KAPE (fast targeted collection), Eric Zimmerman's tools (the reference parsers for most Windows artifacts).

COMMERCIAL: EnCase, Magnet AXIOM, X-Ways, Cellebrite. You will meet these in industry; you do not need them to learn.

PRACTICE DATA: Digital Corpora, NIST CFReDS reference sets, the Volatility Foundation's sample images, DFIR CTFs (Magnet, DFRWS). Real images, no legal risk, published answers.

THE RULE: do you have documented, specific, current permission from someone with the authority to grant it? If any of those four words is missing, you do not have authorisation.

WHAT DOESN'T COUNT: a verbal "yeah, go ahead" from someone who doesn't own the system. A bug bounty scope you skimmed. "It was publicly accessible." "I didn't cause damage." "I was going to report it." Curiosity is not a legal defence and courts have consistently declined to treat it as one.

WHAT GOOD AUTHORISATION LOOKS LIKE: written scope naming the specific systems, IP ranges, and domains; a defined time window; named contacts on both sides; an explicit statement of permitted techniques; and an agreed procedure for when something breaks. In pentesting this is often called a "get out of jail free letter," which is glib but conveys the point — carry it.

UNITED STATES: the Computer Fraud and Abuse Act (CFAA) turns on "without authorization" or "exceeding authorized access." Van Buren v. United States (2021) narrowed the second clause meaningfully, and DOJ policy since 2022 has said good-faith security research shouldn't be charged — but policy is not law, and state statutes apply independently. The DMCA §1201 anti-circumvention provisions matter for reverse engineering; there is a security-research exemption, renewed periodically, with conditions.

UNITED KINGDOM: the Computer Misuse Act 1990 criminalises unauthorised access with no statutory public-interest defence — a gap the UK security community has campaigned to change for years.

EUROPEAN UNION: the Directive on attacks against information systems, implemented variously by member states; Germany's §202c has historically raised concerns about tool possession. GDPR applies to any personal data in your evidence, including data you collected incidentally.

INDIA: the Information Technology Act 2000, particularly §43 (unauthorised access, damage) and §66 (computer-related offences), with §65 covering source code tampering.

THE PRACTICAL POINT: these differ substantially in whether intent matters, whether harm is required, and whether research is a defence. If you work across borders — and internet research always does — the strictest applicable law is the one that binds you.

CONCEPT: an unbroken, documented record of who had the evidence, when, what they did to it, and how it was secured — from seizure to presentation. Its purpose is to let anyone verify the evidence is what you claim, unaltered.

EACH ENTRY RECORDS: item identifier and description; date and time (with timezone — always with timezone); person receiving and person releasing, with signatures; reason for transfer; storage location and security; hash values at each handoff.

WHAT BREAKS IT: gaps in time, unlogged access, unsealed storage, missing hashes, and undocumented tool use. A defence expert's job includes finding exactly these gaps, and a single unexplained one can render an otherwise sound examination worthless.

US FEDERAL (DAUBERT): the court acts as gatekeeper for expert evidence, weighing whether the technique is testable and tested, peer-reviewed, has a known error rate, has standards controlling its operation, and is generally accepted. Some state courts still apply the older Frye "general acceptance" test.

WHY THIS SHAPES YOUR WORK: it is why you use validated tools, document versions, and prefer methods that another examiner could independently reproduce. "I wrote a script and it said so" is not a finding; a reproducible process with a documented error mode is.

REPORT WRITING: state what you did, what you found, and what it means — kept strictly separate. Distinguish observation ("the file was created at 09:14 UTC") from inference ("this is consistent with the macro executing"). Note limitations and alternative explanations. Write for an intelligent reader who is not technical, because that is who decides.

ON THE STAND: your job is to be accurate, not persuasive. "I don't know" is a complete and professional answer. Overclaiming is how expert witnesses are destroyed in cross-examination, and how findings that were actually correct get thrown out.

THE NORM: report privately to the vendor, agree a remediation window (90 days is the common default, from Project Zero's influence), coordinate publication, and credit fairly. CVD — coordinated vulnerability disclosure — is the formal name.

WHERE IT GETS HARD: unresponsive vendors, vendors who threaten legal action, active exploitation in the wild that argues for early warning, and safety-critical systems where a patch cycle is measured in years. There is no clean rule; there is judgement, and there is documenting your reasoning as you go.

PROTECT YOURSELF: use a vendor's published security contact or a bounty platform where one exists (that establishes authorisation), keep everything in writing, don't access more data than needed to demonstrate the issue, and never suggest payment in exchange for silence — that reads as extortion regardless of intent.

THE PROBLEM: Phase 6 covers OSINT techniques that are genuinely dual-use. The same capability that maps a threat actor's infrastructure maps a private individual's life. "It's all public" is a description of the data, not a justification for what you do with it.

QUESTIONS TO ASK: is the subject a legitimate investigative target or a private person? Would aggregating these public facts create a capability — a location pattern, a routine — that none of them held separately? Am I acting under an authorised engagement, or because I can? Would I be comfortable explaining this to the subject?

DATA PROTECTION: collecting personal data engages GDPR and similar regimes even when the source is public. Minimise, define retention, secure it, and be able to justify the purpose.

THE UNCOMFORTABLE TRUTH: essentially everything in this guide is dual-use. Understanding a UEFI bootkit to detect it is the same understanding needed to write one. The field cannot resolve this, and it does not pretend to — what it does instead is rely on norms, on documented purpose, and on people choosing.

WHAT THAT ASKS OF YOU: be able to state why you are learning something and what you intend to do with it. Keep your work inside authorised boundaries. Don't build things whose only use is harm. Don't sell capability to people who will use it against people who cannot defend themselves. These sound obvious in the abstract and are genuinely harder in a specific moment with a specific paycheque attached.

CODES WORTH READING: the ACM Code of Ethics, the IEEE Code of Ethics, and (ISC)²'s canons. They are short, non-binding, and more useful than their reputation suggests — mostly for giving you language when you need to explain a refusal.

EPHEMERALITY: the container that was compromised was destroyed and rescheduled four minutes later. There is no disk to image because there is no disk, and no host you're permitted to touch.

SHARED RESPONSIBILITY: you cannot image the hypervisor. The provider controls the layer beneath your workload, and their logs are your only visibility into it. Where that boundary sits is contractual, and you should know exactly where it is before an incident.

LOGS ARE THE PRIMARY EVIDENCE: in cloud, control-plane logs replace disk as the centre of an investigation. They are also on a retention clock — the default windows are shorter than most incidents take to discover. Preserving logs is the first action, not a later step.

SCALE AND API-DRIVEN CHANGE: an attacker with credentials doesn't move laterally through machines, they call APIs. The intrusion is a sequence of authorised-looking API calls, which is why identity is the real perimeter here.

CLOUDTRAIL: the spine of any AWS investigation — every API call, with identity, source IP, user agent, parameters, and response. Management events are on by default; data events (S3 object access, Lambda invocations) usually are not, and their absence is a common and painful discovery mid-incident.

VPC FLOW LOGS: network metadata (no payload). Enough to establish who talked to what, when, and how much left.

GUARDDUTY: managed detection producing findings worth pivoting from — particularly credential-exfiltration and crypto-mining detections.

EBS SNAPSHOT FORENSICS: the closest thing to classic imaging. Snapshot the volume, create a copy in an isolated forensics account, attach it read-only to a purpose-built analysis instance, then work it like a disk image. Snapshot before terminating anything.

IMDS: the instance metadata service at 169.254.169.254 serves role credentials to whatever can reach it — which historically meant any SSRF became credential theft. IMDSv2 requires a session token and hardens this substantially; check which version is enforced, because v1 still exists in plenty of estates.

AZURE: Activity Log (control plane), Entra ID sign-in and audit logs (identity — the critical one), Microsoft Defender for Cloud, and NSG flow logs. Entra sign-in logs are where token theft, impossible-travel, and consent-phishing show up.

GCP: Cloud Audit Logs split into Admin Activity (always on), Data Access (mostly off by default), System Event, and Policy Denied. Security Command Center aggregates findings. VPC Flow Logs mirror AWS.

CROSS-CUTTING: in every provider the highest-value questions are the same — which identities exist, what can they assume, what did they actually do, and what changed in the last 30 days that nobody approved.

IMAGE LAYERS: a container image is a stack of read-only layers plus a writable layer at runtime. docker diff shows what changed in the writable layer — often exactly the attacker's payload, cleanly separated from the base image. This is a genuine forensic advantage over a traditional host.

SUPPLY CHAIN: inspect image provenance — base image, registry, digest, and whether it matches the build you think you deployed. Malicious layers and typosquatted base images are a live problem.

RUNTIME CAPTURE: if the container still exists, docker commit or ctr/crictl to snapshot state, and capture process memory from the host side (containers are just namespaced processes — /proc/<pid> on the host still sees everything).

EPHEMERAL REALITY: if it's gone, you have logs, the image, the orchestrator's records, and whatever runtime security tooling captured. This is why runtime detection (Falco, Tetragon) is not optional in container estates — it is the only witness.

AUDIT LOGS: the K8s API server audit log is the CloudTrail of the cluster — every request, with user, verb, resource and response. Frequently not enabled at an adequate level, which is the first thing to check and the first thing to fix.

SERVICE ACCOUNT TOKENS: mounted into pods by default. A compromised pod yields a token; what that token can do is an RBAC question. Over-permissive RBAC is the single most common path from one pod to cluster-wide compromise.

ETCD: holds all cluster state, including Secrets — base64-encoded, which is encoding, not encryption. Unencrypted etcd is game over.

INVESTIGATION SEQUENCE: audit log for the offending request → which identity → what RBAC permitted → which pods and nodes were reachable → what secrets were exposed.

THE COMMON PATHS: privileged containers (--privileged essentially removes the boundary), a mounted Docker socket (/var/run/docker.sock — control of the socket is control of the host), excessive capabilities (CAP_SYS_ADMIN), host namespace sharing (hostPID, hostNetwork), writable hostPath mounts, and kernel exploits — because the kernel is shared, a kernel vulnerability is a container escape.

FORENSIC TRACES: unexpected mount events, processes with host PIDs originating in a container cgroup, cgroup writes, and unusual syscalls (mount, unshare, setns, pivot_root) from workload containers.

CONNECTS TO: Phase 1's eBPF material directly — VoidLink was explicitly cloud-native, detecting Docker/Kubernetes and adapting. Kernel-level rootkits and container escape are the same problem viewed from two directions.

THE PROBLEM: a Lambda or Cloud Function executes for milliseconds in an environment you cannot access, and then it is gone. There is no disk, no persistence, and often no memory capture path.

WHAT YOU ACTUALLY HAVE: invocation logs, the deployed function code and its version history, the execution role's permissions, environment variables (check for secrets), and downstream effects — what the function touched.

THE PRACTICAL POSTURE: for serverless, detection and prevention carry almost the entire load, because post-hoc investigation has so little to work with. Instrument heavily, log verbosely, keep function permissions minimal.

1. PRESERVE FIRST: export logs before retention expires. Snapshot volumes before anything is terminated. This is irreversible if skipped and reversible if over-done.

2. CONTAIN IDENTITY, NOT JUST COMPUTE: revoke sessions, rotate keys, and disable the role. Killing an instance while the credentials remain valid achieves nothing — the attacker just calls the API from somewhere else.

3. ISOLATE: move the workload to a quarantine security group with no egress rather than terminating it, so you keep the evidence and stop the bleeding at once.

4. SCOPE VIA THE CONTROL PLANE: reconstruct everything the identity did across every service and region. Attackers create persistence in regions nobody looks at.

5. HUNT FOR PERSISTENCE: new IAM users, access keys, roles with trust policies pointing at external accounts, Lambda functions, scheduled tasks, modified security groups, altered logging configuration.

CONCEPT: David Bianco's model ranks indicators by how much it costs an adversary when you detect on them. Hash values — trivial to change, recompile and it's a new hash. IP addresses — cheap, rotate the VPS. Domain names — slightly annoying. Network/host artifacts — annoying. Tools — challenging. TTPs — genuinely painful, because changing them means changing how the adversary operates.

WHY IT'S THE FOUNDATION: it explains why hash-based blocklists are near-worthless against a motivated actor, and why detecting behaviour ("a Word process spawned a PowerShell child that made a network connection") survives when indicators don't. Aim as high up the pyramid as you can afford to.

CONCEPT: YARA rules describe files by strings, byte patterns, and structural conditions. It's the standard for classifying malware families and hunting across a corpus.

ANATOMY: a meta block (author, date, reference — always fill this in, your future self needs it), a strings block defining patterns, and a condition combining them with boolean and structural logic.

WRITING GOOD RULES: anchor on things the author cannot trivially change — algorithmic constants, distinctive structures, unusual API combinations, encryption tables. Avoid compiler boilerplate and library strings (they match everything). Test against a clean corpus for false positives before deploying, always.

CONCEPT: Sigma is to logs what YARA is to files — a vendor-neutral YAML format for log-based detections, compiled to Splunk SPL, Elastic queries, KQL, or whatever your SIEM speaks. Write once, deploy anywhere, and share with the community.

THE FALSEPOSITIVES FIELD MATTERS: it isn't documentation garnish. A rule shipped without knowing its noise profile is how SOCs end up ignoring alerts, and an ignored alert is worse than no alert.

CONCEPT: treat detections as software — version controlled, peer reviewed, tested in CI, deployed through a pipeline. A rule change without review is a production change without review.

TESTING: Atomic Red Team provides small, safe, ATT&CK-mapped tests that execute a single technique so you can verify your detection actually fires. Caldera and Prelude automate longer adversary emulation chains.

THE DISCIPLINE: for every detection, know which ATT&CK technique it covers, what its false-positive rate is, what data source it needs, and whether it has ever actually fired on something real. Detections that have never fired are either perfect or broken, and you should find out which.

CAPTURE: tcpdump or dumpcap for acquisition; capture to rotating files rather than one enormous one. Full packet capture is expensive to store, which is why most organisations keep metadata longer than payload.

DISPLAY FILTERS WORTH MEMORISING: the difference between struggling and being fast in Wireshark is knowing about six filters cold.

THE WORKFLOW: Statistics → Conversations to find the heaviest or strangest talkers; Statistics → Protocol Hierarchy to spot protocols that shouldn't be there; then filter down and follow the stream.

CONCEPT: Zeek turns raw traffic into structured, queryable logs — conn.log, dns.log, http.log, ssl.log, files.log, notice.log. Instead of scrolling packets you query a dataset, which is the only approach that scales.

WHY ANALYSTS PREFER IT: "show me every TLS certificate with a validity under 7 days" is one command against ssl.log and effectively impossible by hand in Wireshark.

THE PROBLEM: you usually cannot decrypt, and increasingly should not try. Analysis has moved to metadata and handshake characteristics.

JA3 / JA4: fingerprints computed from the TLS Client Hello — cipher suites, extensions, and their ordering. Different TLS stacks produce different fingerprints, so a client claiming to be Chrome while presenting a Python-requests fingerprint is lying. JA4 is the newer, more robust successor and is worth learning directly.

CERTIFICATE ANOMALIES: self-signed certificates, absurd validity windows, default fields left as "Internet Widgits Pty Ltd," and mismatched SNI are all cheap, high-value signals.

CONNECTS TO: Phase 6's Volt Typhoon material — JARM fingerprinting the C2 server side is the mirror of JA3/JA4 on the client side.

CONCEPT: C2 implants check in on a schedule. Even with jitter, the timing distribution of machine-generated callbacks differs measurably from human browsing — humans are bursty and irregular; beacons are not, no matter how much randomness is added.

SIGNALS: low variance in inter-arrival times, consistent payload sizes, long-lived connections to a single destination with little data, and traffic continuing outside working hours to an endpoint with no other activity.

TOOLING: RITA (Real Intelligence Threat Analytics) consumes Zeek logs and scores beacon likelihood directly. This connects straight to Phase 4's covert timing channels — same statistics, opposite goal.

TUNNELING: data exfiltrated in query names. Signals: abnormally long subdomains, high entropy in labels, unusual record types (TXT, NULL) in volume, and one domain receiving vastly more unique queries than anything else.

DGA: algorithmically generated domains produce characteristic entropy and n-gram distributions, plus a distinctive burst of NXDOMAIN responses as the malware walks candidates looking for the registered one. That NXDOMAIN pattern is often the easiest catch in the whole kill chain.

NEWLY REGISTERED DOMAINS: traffic to a domain registered in the last 30 days is disproportionately malicious. It's a cheap enrichment with an excellent signal-to-noise ratio.

NIST SP 800-61: Preparation → Detection & Analysis → Containment, Eradication & Recovery → Post-Incident Activity. SANS teaches essentially the same thing as PICERL (Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned).

PREPARATION IS MOST OF IT: the phase that determines how an incident goes is the one that happens beforehand — logging enabled and retained, an asset inventory that's accurate, tested backups, contact lists, and people who have rehearsed. You cannot investigate what you never logged.

THE CONTAINMENT TENSION: isolate immediately and you stop damage but lose visibility into scope, and tip the adversary off. Observe longer and you learn the full extent but accept ongoing risk. There is no universally right answer — it depends on what's at stake and how confident you are that you've found everything. What matters is that it's a conscious decision, made by someone with authority to make it, and written down.

PLAYBOOKS: pre-written procedures for recurring scenarios — ransomware, BEC, credential compromise, insider data theft. They exist so that decisions get made calmly in advance rather than at 3am by someone who has been awake for twenty hours.

TABLETOPS: discussion-based walkthroughs of a scenario. Their real value is surfacing the unglamorous gaps: nobody knows who can authorise disconnecting the production network; the out-of-hours contact list is two years stale; the backups have never actually been restored from.

BLAMELESS POST-INCIDENT REVIEW: the goal is systemic improvement, not attribution of fault. If people fear the review, they will withhold the information that would prevent the next one. This is borrowed from aviation safety culture and it works for the same reasons.

MITRE ATT&CK: a catalogue of adversary tactics (the why) and techniques (the how), with sub-techniques. Its real utility is as shared vocabulary and as a coverage map — ATT&CK Navigator lets you visualise what you can and cannot currently detect.

KILL CHAIN vs DIAMOND MODEL: the Lockheed Martin Kill Chain is linear and good for describing progression. The Diamond Model (adversary, capability, infrastructure, victim) is relational and better for pivoting during analysis — find one vertex, pivot to the others. They answer different questions; use both.

ATTRIBUTION: genuinely hard, frequently overclaimed, and easy to get wrong. False flags are a documented technique. Use calibrated confidence language ("assessed with moderate confidence") and be explicit about what the assessment rests on. Attribution is usually less operationally useful than people expect — the detection matters more than the name.

SHARING: MISP and OpenCTI for platforms, STIX/TAXII for formats, sector ISACs for community.

CONCEPT: a process is a container for resources — an address space, handles, a token. A thread is what actually executes. A process with no threads is inert. This distinction is why "process injection" works: you can put code in one process and have a thread run it.

PEB / TEB: the Process Environment Block sits in user-space memory and holds the module list, heap pointers, and the BeingDebugged flag. The Thread Environment Block holds per-thread state and, at a fixed offset, a pointer back to the PEB — GS:[0x60] on x64.

WHY MALWARE CARES: because the PEB is reachable without calling any API. Malware walks PEB → Ldr → InMemoryOrderModuleList to find ntdll.dll's base address, parses its export table by hand, and resolves functions without ever touching GetProcAddress — which EDR is watching. This is exactly the technique in Phase 2's Hell's Gate material; it is just PEB traversal.

CONCEPT: Windows is object-based underneath. Files, processes, threads, mutexes, registry keys, and events are all kernel objects in a namespace you can browse (WinObj shows it). A handle is a per-process index into a table pointing at one of these objects, carrying an access mask.

FORENSIC VALUE: handles are enormously informative. A process holding a handle to another process with PROCESS_VM_WRITE is preparing to inject. Malware families frequently create a named mutex to avoid double-infecting a host — and that mutex name becomes a superb host-based IOC, because it must stay stable across the campaign.

TOOLING: Process Explorer and Process Hacker show handles live; Volatility's windows.handles recovers them from a memory image.

CONCEPT: every process carries an access token describing who it runs as: a user SID, group SIDs, an integrity level, and a privilege list. Access decisions compare the token against an object's security descriptor.

PRIVILEGES THAT MATTER: SeDebugPrivilege (open any process — the key to most injection), SeBackupPrivilege and SeRestorePrivilege (read or write any file regardless of ACL), SeImpersonatePrivilege (the basis of the entire "Potato" escalation family), SeLoadDriverPrivilege (load kernel code).

TOKEN THEFT: a process running as SYSTEM can duplicate its token and spawn a process as another user. This is what "token impersonation" means in post-exploitation tooling, and it's why privilege boundaries in Windows are token boundaries rather than process boundaries.

INTEGRITY LEVELS: Low / Medium / High / System. A Medium-integrity process cannot write to a High-integrity one. UAC elevation is a jump from Medium to High — which is why "UAC bypass" is a distinct technique category from privilege escalation proper.

CONCEPT: the Windows loader resolves imports at load time by searching a defined sequence of directories. If a required DLL isn't found where expected, an attacker who can write to an earlier directory in that order gets their code loaded into a trusted process.

THE ATTACK FAMILY: DLL search order hijacking (plant a DLL earlier in the path), DLL side-loading (ship a legitimate signed EXE alongside a malicious DLL it will load — extremely common in APT tradecraft because the running binary is genuinely signed), and phantom DLL hijacking (supply a DLL the program looks for but which doesn't exist).

DETECTION: a signed binary loading an unsigned DLL from a user-writable directory is the signature. Sysmon Event ID 7 (image loaded) is the telemetry; correlate signer status with load path.

CONCEPT: the registry is a hierarchical database stored in hive files on disk — SYSTEM, SOFTWARE, SAM, SECURITY in config\, and NTUSER.DAT per user. The familiar HKLM/HKCU roots are views assembled from these.

FORENSIC KEYS: Run/RunOnce and Services for persistence; UserAssist for GUI launches (ROT13-encoded, which surprises people); ShellBags for folder access, including folders that no longer exist; USBSTOR for device history; AppCompatCache for binary presence.

KEY TIMESTAMPS: registry keys carry a LastWrite timestamp; values do not. This means you can date the last modification of a key but not tell which value changed — a limitation worth stating explicitly in a report.

ETW: Event Tracing for Windows is the kernel's high-performance telemetry bus, and it's what most EDR products consume. Because providers can be manipulated in-process, ETW patching (overwriting EtwEventWrite with a return instruction) silently blinds a large amount of monitoring — the process keeps running, the events simply stop.

WMI: a management interface that is also a persistence mechanism. WMI event subscriptions (filter + consumer + binding) trigger code on system events and survive reboot while living in the WMI repository rather than as a file. Classic APT persistence and easy to miss.

AMSI: the Antimalware Scan Interface lets script engines submit content for scanning before execution. Patching it in-memory is the standard PowerShell evasion, which is why AMSI bypass attempts are themselves a high-value detection.

CONCEPT: /proc is a virtual filesystem exposing kernel state as readable files. It is the single most useful directory on a live Linux system under investigation.

THE DELETED-BINARY TRICK: malware commonly unlinks its own executable after starting. The file is gone from the filesystem but /proc/<pid>/exe still points to the inode — so you can recover the binary by copying that symlink target while the process lives. Do this before you kill anything.

NAMESPACES: isolate a process's view of resources — PID, mount, network, UTS, IPC, user, cgroup. A container is a normal process with a restricted view. This is why the host can see everything inside a container via /proc, but not vice versa.

CGROUPS: limit resource consumption. Namespaces control what you see; cgroups control what you can use. Together they are what "containerisation" actually means — there is no container object in the kernel.

CAPABILITIES: root's powers split into discrete units. CAP_SYS_ADMIN is so broad it's called "the new root"; CAP_SYS_PTRACE allows inspecting other processes; CAP_NET_RAW allows raw sockets. A container granted CAP_SYS_ADMIN is barely contained at all, which is the root of most escape paths in the Cloud track.

CONCEPT: the dynamic linker (ld.so) resolves shared library symbols at load time, usually lazily via the PLT/GOT indirection tables. Understanding this is what makes userland rootkits comprehensible.

LD_PRELOAD: forces a library to load before all others, so its symbols win resolution. Override readdir() and files vanish from every program that lists directories; override open() and you control what everything reads. This is the classic userland rootkit, and it's the third backend VoidLink ships (see Phase 1).

DETECTION: check /etc/ld.so.preload, inspect each process's environment for LD_PRELOAD, and compare a statically linked busybox's view of the filesystem against the system tools' view. Static binaries don't use the dynamic linker, so they can't be preloaded — that asymmetry is your cross-view check.

THE INVENTORY: systemd units (including user units in ~/.config/systemd/user/) and timers; cron and /etc/cron.d; shell rc files (.bashrc, .profile); /etc/ld.so.preload; kernel modules and /etc/modules-load.d; SSH authorized_keys; PAM modules; udev rules; and atd jobs.

MODERN ADDITIONS: io_uring based implants avoid conventional syscalls entirely, which defeats syscall-hooking monitors — the RingReaper research is the reference example. eBPF programs persist as pinned objects under /sys/fs/bpf/.

AUDITING: systemctl list-timers, systemctl --user list-units, crontab -l for every user, bpftool prog list, and lsmod compared against /sys/module.

TECHNIQUE: falsifying file timestamps so malicious files blend into the OS install date, or so a timeline shows a misleading order of events.

WHY IT USUALLY FAILS ON NTFS: every file has two timestamp sets — $STANDARD_INFORMATION (what tools display and what the common APIs modify) and $FILE_NAME (maintained by the kernel, much harder to set). Most tooling alters only $SI. Disagreement between $SI and $FN is a direct tampering indicator, and so is a timestamp with zeroed sub-second precision, since genuine NTFS timestamps carry 100-nanosecond granularity while forged ones frequently land on a whole second.

OTHER SURVIVORS: $UsnJrnl and $LogFile record the change activity independently, and the MFT record number itself roughly correlates with creation order — a file claiming to be from 2019 sitting in a high MFT entry surrounded by last-week's files is lying.

TECHNIQUE: clearing event logs, selectively deleting records, stopping the logging service, or disabling telemetry providers.

WHAT IT LEAVES: clearing a Windows log generates Event ID 1102 (Security) or 104 (System) — the act of erasure is itself logged. Selective record deletion breaks the monotonic record-number sequence, leaving a gap that is trivially detectable. Stopping a service generates its own events. On Linux, journald sequence numbers and the systemd journal's FSS (Forward Secure Sealing), where enabled, serve the same role.

THE STRONGEST DEFENCE: ship logs off-host in real time. An adversary can control the endpoint; they cannot retroactively edit what already left it. This single control defeats most log tampering outright.

DETECTION SIGNAL: a silent interval. A host that normally emits a steady event rate and then produces nothing for forty minutes has told you exactly where to look, even though the logs from that window are gone.

TECHNIQUE: overwriting file contents rather than unlinking them — shred, sdelete, or a purpose-built wiper.

WHAT SURVIVES ANYWAY: filesystem metadata frequently outlives file content. The MFT entry, journal records, LNK files, Jump Lists, prefetch, registry MRU lists, and thumbnail caches all reference a file that no longer exists. You may not recover the document, but you can often prove it existed, when it was accessed, and what it was called.

SSD COMPLICATION: wear levelling and TRIM mean the physical blocks holding old data may be inaccessible to overwriting and to recovery. On SSDs, secure deletion is less reliable for the adversary and recovery is less reliable for you — the flash translation layer sits between both of you and the actual cells.

CLOUD & BACKUP: the most common failure of secure deletion is that the data was synced, backed up, or emailed. Deletion is local; copies are not.

CONCEPT: the most effective anti-forensics isn't destroying evidence — it's never generating distinctive evidence in the first place. Using certutil, bitsadmin, rundll32, mshta, PowerShell, WMI, or (on Linux) curl, base64, and bash means every binary on disk is legitimate and signed.

WHY IT DEFEATS FILE-BASED DETECTION: there is no malicious file to hash, quarantine, or write a YARA rule against. The malice is entirely in the arguments and the sequence.

DETECTION: this is precisely where command-line logging earns its cost. Event ID 4688 with command line enabled, or Sysmon Event ID 1, turns invisible activity into a clean detection — certutil -urlcache -f http://... file.exe is unmistakable. Reference lists: LOLBAS for Windows, GTFOBins for Unix.

CONNECTS TO: Phase 6's Volt Typhoon material, which is LOTL applied at nation-state scale.

TECHNIQUE: never writing the payload to disk — reflective DLL loading, process hollowing, .NET assembly loading from memory, PowerShell downloading and executing in-process, or persistence stored in the registry or a WMI subscription rather than a file.

THE COUNTER: memory forensics, which is why DFIR Core insists on capturing RAM first. malfind locating executable-writable-unbacked memory regions is the direct answer to this entire category.

AND THE LIMIT: fileless malware still has to survive reboot somehow, and every persistence mechanism touches something durable — a registry value, a WMI binding, a scheduled task. "Fileless" describes the payload, not the foothold. Hunt the foothold.

TECHNIQUE: full-disk encryption to defeat dead-box acquisition; packed or virtualised payloads to defeat static analysis; encrypted C2 to defeat network inspection.

RESPONSE: against FDE, the decisive factor is capturing the system while running — keys live in RAM, and this is a large part of why order of volatility matters so much. Against packing, the Reverse Engineering track's unpacking material applies directly. Against encrypted C2, metadata analysis (JA3/JA4, beacon timing, volume) works without decryption.

THE HIGH-ENTROPY TELL: encryption and packing produce a statistically distinctive uniform entropy. A "document" with the entropy profile of random data is a finding in itself, even before you know what it contains.

TECHNIQUE: NTFS alternate data streams, file slack, unallocated space, hidden partitions and volumes, polyglot files, and media steganography.

DETECTION: ADS are enumerable (dir /R, Get-Item -Stream *); slack and unallocated space are carved as a routine step; container/partition arithmetic exposes hidden volumes when declared sizes don't reconcile with physical capacity.

SEE ALSO: the Stego Lab track covers the media side in depth — and note that the cheap container-level triage there catches far more real-world activity than statistical steganalysis does.

CONCEPT: the most sophisticated tier targets the analysis process itself — sandbox detection and delayed execution, anti-VM and anti-debug checks, forensic-tool-specific evasion, deliberate false flags (planted foreign-language strings, borrowed code, timezone manipulation) to misdirect attribution, and log poisoning to create a plausible innocent narrative.

THE DISCIPLINE THIS DEMANDS: hold hypotheses loosely. Corroborate across independent artifact sources. Be explicit in reports about what is observed versus inferred, and use calibrated confidence language. An adversary who knows how you think can feed you a story — and a confident, well-written, wrong report does more damage than an uncertain one.

THE LOOP: Direction (what do we need to know, and who's asking) → Collection → Processing → Analysis → Dissemination → Feedback. Borrowed wholesale from traditional intelligence practice, and the first step is the one most often skipped.

WHY DIRECTION MATTERS: intelligence without a consumer and a question is a hobby. "Which ransomware groups target mid-size healthcare in our region, and what initial access do they use" is a requirement. "Send me threat feeds" is not.

THE THREE TIERS: strategic (board-level: risk trends, geopolitics, sector targeting), operational (campaign-level: who is targeting us, how, and when), tactical (analyst-level: IOCs, TTPs, detection content). They serve different readers and shouldn't be mixed in one document.

CONCEPT: every intrusion event has four vertices — adversary, capability (their malware/tooling), infrastructure (C2, domains, hosting), and victim — connected by edges. Meta-features add timestamp, phase, result, and confidence.

WHY IT'S USEFUL: it formalises pivoting. Know the infrastructure, pivot to other victims sharing it. Know the capability, pivot to other infrastructure that malware family calls home. Each vertex is a query against your data and against public sources.

VS. KILL CHAIN: the Kill Chain is linear and describes progression through an intrusion. The Diamond Model is relational and describes connection between events. They answer different questions — use the Kill Chain to explain what happened, the Diamond Model to find what else is related.

CONCEPT: tactics are the adversary's goals (Initial Access, Persistence, Exfiltration); techniques are how they achieve them; sub-techniques are specific variants. Also included: groups, software, campaigns, and mitigations.

THE REAL USE — COVERAGE MAPPING: ATT&CK Navigator lets you colour the matrix by detection coverage. The output is an honest picture of where you are blind, which is far more actionable than a list of what you can catch.

THE COMMON MISUSE: tagging a report with technique IDs after the fact and calling it "ATT&CK-mapped." That's labelling, not analysis. The value comes from using the framework to ask what else an adversary at this stage typically does next, and whether you'd see it.

THE LAYERS: attribution to a cluster of activity is achievable and useful. Attribution to an organisation is harder. Attribution to a named individual is generally beyond private-sector capability and usually requires signals intelligence or law enforcement powers.

WHAT ANALYSTS USE: code reuse and shared development artifacts, infrastructure overlap, operational patterns (working hours, holidays observed), targeting consistent with a state's interests, language and encoding artifacts, and OPSEC failures.

WHY EACH IS WEAK ALONE: code is stolen, leaked, and shared between groups. Infrastructure is rented and reused. Working hours are trivially shifted. Language artifacts are the easiest thing in the world to plant deliberately — see Anti-Forensics.

CONFIDENCE LANGUAGE: use calibrated terms and mean them: low / moderate / high confidence, with an explicit statement of what the assessment rests on and what would change it. "We assess with moderate confidence, based on infrastructure overlap with previously reported activity, that…" is a defensible sentence. "This was Russia" is not.

THE PROBLEM: every vendor names groups differently. The same activity may be APT29, Cozy Bear, Midnight Blizzard, Nobelium, UNC2452, and The Dukes, depending on who is writing. Names also don't map cleanly — vendors cluster on different evidence, so two "equivalent" names may cover overlapping but non-identical activity.

CONVENTIONS: CrowdStrike uses animal suffixes by nation (Bear=Russia, Panda=China, Kitten=Iran); Microsoft uses weather (Blizzard=Russia, Typhoon=China, Sandstorm=Iran); Mandiant uses APT/UNC/FIN numbers, where UNC means "uncategorised" — a cluster not yet promoted to a named group.

PRACTICAL ADVICE: track the behaviour, not the name. When writing, give the name you use plus common aliases once, then be consistent. Never assume two vendor reports about "the same group" describe the same intrusion set.

MISP: open-source threat intelligence platform for storing, correlating, and sharing indicators and events. Correlation across submissions is its real strength.

STIX / TAXII: STIX is the structured data format for describing threat information; TAXII is the transport protocol for exchanging it. Together they make machine-to-machine sharing possible.

TLP: the Traffic Light Protocol governs redistribution — CLEAR (public), GREEN (community), AMBER (organisation, need-to-know), AMBER+STRICT (organisation only), RED (named recipients only). Violating TLP is how organisations get removed from sharing groups; treat it as binding.

ISACs: sector-specific sharing communities (FS-ISAC for finance, H-ISAC for health, WaterISAC, and so on). Often the fastest route to relevant, contextual warning — the AA26-097A advisory in Phase 1 reached water utilities through exactly this channel.

BLUF: Bottom Line Up Front. State the assessment and the recommended action in the first paragraph. Analysts who bury the conclusion on page four are writing for themselves.

SEPARATE THE LAYERS: what was observed, what is assessed, and what is recommended, clearly delineated. A reader must be able to accept your observations while disagreeing with your assessment.

MAKE IT ACTIONABLE: every report should answer "so what do I do differently on Monday?" — a detection to deploy, a configuration to change, a system to prioritise for patching. Intelligence that ends in "stay vigilant" has failed.

STATE YOUR GAPS: explicitly note what you couldn't determine and what evidence would resolve it. This is what distinguishes analysis from marketing.

MANUAL: scrolling through the device and photographing what's on screen. Sounds primitive; is sometimes all you have, and is legitimate if documented properly.

LOGICAL: what the device's own backup/sync APIs will hand over — an iTunes/Finder backup, or Android ADB backup. Fast and well-supported, but it only contains what the OS chooses to export. Missing: deleted records, most app sandboxes, and system logs.

FILESYSTEM: a fuller copy of the file tree, typically requiring an exploit, an agent, or a developer/jailbroken state. Includes app sandbox data and SQLite write-ahead logs — which is where deleted records survive.

PHYSICAL: a bit-for-bit image of flash storage. Largely historical on modern devices: even with the image, the data is encrypted with hardware-bound keys, so without those keys you have a very large file of noise.

DATA PROTECTION: files are assigned protection classes determining when their keys are available — some only after first unlock, some whenever the device is booted. This granularity is why AFU extraction yields substantially more than BFU.

SECURE ENCLAVE: a separate coprocessor holding key material and enforcing passcode attempt limits with escalating delays. It is the reason brute force is impractical on current hardware.

CHECKM8: a BootROM vulnerability affecting A5–A11 devices (roughly iPhone 4S through X). Because it's in read-only boot code it cannot be patched by software update, making those devices permanently more accessible. It does not defeat encryption — it enables code execution to attack the passcode, which still takes time.

ARTIFACTS OF INTEREST: KnowledgeC.db and the biome/segb stores (device usage, app launches, connections), CallHistory.storedata, sms.db, Photos.sqlite, Health data (a surprisingly good movement timeline), and the Unified Logs.

FRAGMENTATION: the defining difficulty. Hundreds of vendors, chipsets, and Android versions, each with different bootloaders, recovery implementations, and exploit availability. There is no single Android procedure.

ENCRYPTION: File-Based Encryption (FBE) replaced Full-Disk Encryption from Android 7, with Credential Encrypted and Device Encrypted storage classes — the direct analogue of iOS protection classes and the same BFU/AFU consequence.

ROUTES IN: ADB with USB debugging (rarely enabled); vendor download/recovery modes such as EDL on Qualcomm, sometimes requiring signed programmer files; bootloader unlocking, which on most devices triggers a factory reset and therefore destroys the evidence you came for.

ARTIFACTS: /data/data/<package>/ app sandboxes, /data/system/, usagestats, logcat while live, and the Wi-Fi/Bluetooth connection history.

WHY IT DOMINATES: almost every app on both platforms stores its data in SQLite. Messages, call logs, browser history, location caches, app state — SQLite. If you can only learn one mobile skill, learn this one.

WHERE DELETED DATA LIVES: deleting a row typically marks it free rather than overwriting it. Recoverable from: freelist pages, unallocated space within pages, the WAL (write-ahead log) holding recent transactions not yet checkpointed, and the journal file. A logical extraction that copies only the .db and omits -wal and -shm loses recent activity — a genuinely common and costly mistake.

TIMESTAMP TRAPS: Unix seconds, Unix milliseconds, Apple Cocoa epoch (2001-01-01), Mac absolute time, Chrome/WebKit epoch (1601-01-01), and Android's mixture of all of the above. Misreading an epoch shifts a timeline by three decades. Always validate against a known event.

THE PRAGMATIC TRUTH: when the device is locked and unexploitable, the data is often obtainable elsewhere. iCloud and Google account backups, with lawful process or documented consent, frequently contain messages, photos, location history, and device backups.

CAVEATS: coverage varies by what the user enabled; end-to-end encrypted categories (iCloud Advanced Data Protection, for instance) are not accessible to the provider; and retention windows are finite. Preserve early.

LEGAL WEIGHT: this is squarely a legal-process question, not a technical one. Cross-border cloud data raises jurisdictional issues that are well beyond what any technical guide can resolve — involve counsel.

THE LANDSCAPE: Cellebrite, Magnet GRAYKEY, and MSAB dominate law enforcement mobile forensics, relying on undisclosed exploit chains and priced accordingly.

OPEN ALTERNATIVES: ALEAPP and iLEAPP (artifact parsers for Android and iOS), libimobiledevice, Andriller, and plain SQLite tooling. These parse what you already have rather than obtaining it — but parsing is most of the analysis.

THE ETHICAL DIMENSION: the same capability that solves serious crime has been sold to states that use it against journalists and dissidents, and commercial spyware (Pegasus and its successors) has repeatedly been found on the phones of civil-society targets. If you work in this area, you will eventually face a question about who your capability serves. Read the Legal & Ethics page before you need it.

THE UNDERLYING BUG: data crosses into a context where it is interpreted as instructions. SQL injection, command injection, LDAP injection, XPath injection, and template injection are all the same mistake in different interpreters.

THE FIX (always the same shape): keep data and code in separate channels. Parameterised queries for SQL; argument arrays rather than shell strings for commands. Escaping is a fallback, not a strategy — every escaping scheme eventually meets an encoding it didn't anticipate.

FORENSIC SIGNATURE: in web logs, look for SQL keywords, quote characters, comment markers (--, /*), UNION SELECT, and time-delay functions (SLEEP, WAITFOR) in parameters. Blind injection shows as many near-identical requests with small variations and, for time-based variants, a distinctive response-time pattern.

WHAT AN ATTACKER DOES NEXT: enumerate schema, dump credentials, then attempt file write or command execution. If you find injection in logs, assume data access occurred and scope accordingly.

CONCEPT: Server-Side Request Forgery: the application fetches a URL an attacker controls, so requests originate from inside the network with the server's identity and network position.

WHY IT'S CRITICAL IN CLOUD: the instance metadata service at 169.254.169.254 serves role credentials to anything that can reach it. Under IMDSv1 no authentication was required, so SSRF became direct credential theft — this is the mechanism behind several of the largest cloud breaches on record. IMDSv2's session-token requirement closes it, which is why the Cloud track tells you to check which version is enforced.

DEFENCES: enforce IMDSv2, allowlist outbound destinations rather than blocklisting, resolve and validate the destination IP after DNS resolution (to defeat DNS rebinding), and block link-local ranges at the egress layer.

FORENSIC SIGNATURE: outbound requests from application servers to internal RFC1918 or link-local addresses; parameters containing URLs, especially with file://, gopher://, or decimal/octal-encoded IPs.

CONCEPT: consistently ranked the number one web risk. The application checks who you are but not whether you may touch this object.

VARIANTS: IDOR (change the ID in the request and get someone else's record), forced browsing to admin endpoints, method tampering, and mass assignment (send role=admin in a JSON body the model binds blindly).

WHY IT'S HARD TO CATCH: the requests are perfectly well-formed and authenticated. There's no payload, no anomaly at the WAF, nothing to signature. This is where the ReBAC/Zanzibar material in Phase 2 becomes relevant — the question shifts to whether the authorisation graph actually permits the path taken.

FORENSIC SIGNATURE: one session enumerating sequential object IDs; a user accessing an unusual volume or breadth of records. This is a UEBA problem, not a signature problem.

CONCEPT: deserialising attacker-controlled data can instantiate arbitrary objects and, via "gadget chains" of existing library code, reach code execution — without the attacker supplying any code at all.

WHERE IT BITES: Java (ObjectInputStream, and the ysoserial gadget catalogue), .NET (BinaryFormatter, now deprecated for this reason), Python pickle (never unpickle untrusted data — it's documented as unsafe), PHP unserialize().

PROTOTYPE POLLUTION: the JavaScript analogue — injecting __proto__ properties modifies the prototype chain and thereby the behaviour of objects elsewhere in the program. Escalates to XSS or RCE depending on what consumes the polluted property.

FORENSIC SIGNATURE: base64 blobs beginning rO0 (Java) or AAEAAAD (.NET) in parameters, cookies, or headers.

XSS: attacker script executes in the victim's browser under the site's origin. Stored (persisted server-side), reflected (in the response to a crafted request), and DOM-based (entirely client-side, so it may never appear in server logs at all — worth remembering during investigation).

IMPACT: session token theft, request forgery as the user, and credential capture via injected forms. HttpOnly cookies mitigate theft but not action.

CSRF: the attacker's site causes the victim's browser to make an authenticated request to yours. Mitigated by anti-CSRF tokens and SameSite cookie attributes.

DEFENCE IN DEPTH: Content Security Policy, output encoding appropriate to context, HttpOnly + Secure + SameSite cookies, and Subresource Integrity for third-party scripts.

THE MODERN REALITY: attackers no longer need your password. Session token theft — via infostealer malware, XSS, or an adversary-in-the-middle phishing kit like Evilginx — bypasses MFA entirely, because a stolen valid session was already authenticated.

JWT PITFALLS: alg: none acceptance, algorithm confusion (RS256 verified as HS256 using the public key as the HMAC secret), missing expiry validation, and secrets that are guessable.

DEFENCES THAT ACTUALLY HELP: phishing-resistant MFA (FIDO2/WebAuthn, which binds to origin and cannot be relayed), token binding, short-lived tokens with refresh, and re-authentication for sensitive actions.

FORENSIC SIGNATURE: the same session token presenting from a new IP, ASN, or device fingerprint; impossible travel; a successful login with no preceding MFA challenge event.

THE SURFACE: a typical application is mostly other people's code. Typosquatted packages, dependency confusion (a public package shadowing an internal name), compromised maintainer accounts, and malicious post-install scripts are all live, recurring problems.

DEFENCES: lockfiles with integrity hashes, an internal registry proxy with explicit allowlisting, SBOM generation, and dependency scanning in CI. Pin versions; audit before upgrading.

CONNECTS TO: the AUR/Atomic Arch incident in Phase 1 and the data-poisoning material in Phase 3 — same attack shape, different artifact.

WHAT TO PULL: access logs (URI, status, bytes, referrer, user-agent), application logs, WAF logs, and reverse-proxy logs. Correlate on timestamp, source IP, and session identifier.

PATTERNS THAT MATTER: a burst of 404s (directory enumeration) followed by a 200 on something unusual; 500s clustered on one parameter (injection probing); a single large 200 response after many small ones (data extraction); requests to .php/.jsp in an upload directory (web shell); and unusual user-agents, though these are trivially spoofed.

WEB SHELLS: the most common post-exploitation persistence on web servers. Hunt for recently modified files in web roots, files whose timestamps differ from their siblings, high-entropy PHP/ASPX, and the classic dangerous functions (eval, system, passthru, base64_decode chains).

CONFIDENTIALITY: only the intended party can read it. Encryption provides this.

INTEGRITY: tampering is detectable. Hashes and MACs provide this.

AUTHENTICITY: it genuinely came from who it claims. Signatures and MACs provide this.

THE CLASSIC ERROR: assuming encryption gives you all three. It does not. Unauthenticated encryption is malleable — an attacker who cannot read your ciphertext may still be able to modify it predictably. This is why modern practice uses AEAD modes (AES-GCM, ChaCha20-Poly1305) that provide confidentiality and integrity together, and why CBC without a MAC is a persistent source of vulnerabilities.

CONCEPT: one shared key encrypts and decrypts. Fast, and what actually protects bulk data everywhere.

THE STANDARD: AES (128/192/256-bit keys). ChaCha20 is the leading alternative, notably faster on hardware without AES acceleration.

MODES MATTER MORE THAN THE CIPHER: ECB encrypts each block independently, so identical plaintext blocks produce identical ciphertext — the famous "ECB penguin" remains visible through its own encryption. Never use it. CBC chains blocks and needs a random IV, and without a MAC is vulnerable to padding-oracle attacks. GCM is authenticated and the current default — but never reuse a nonce with the same key, which breaks it catastrophically rather than gracefully.

FORENSIC RELEVANCE: in a memory image, AES key schedules have recognisable structure. Tools such as aeskeyfind and Volatility plugins exploit this — another argument for capturing RAM before shutdown.

CONCEPT: a keypair — public key shared freely, private key kept secret. Encrypt to the public key, decrypt with the private. Sign with the private, verify with the public.

RSA: security rests on the difficulty of factoring large integers. Simple to understand, easy to implement badly (padding is where it goes wrong — use OAEP, not PKCS#1 v1.5).

ELLIPTIC CURVE: equivalent security with far smaller keys (a 256-bit EC key roughly matches 3072-bit RSA). Ed25519 for signatures and X25519 for key exchange are the modern defaults.

THE PERFORMANCE REALITY: asymmetric crypto is slow, so it is almost never used on bulk data. TLS uses it to agree a symmetric key, then switches to AES. Understanding this hybrid structure explains most of what a TLS handshake is doing.

WHY QUANTUM BREAKS IT: Shor's algorithm solves both factoring and discrete logarithms efficiently — so RSA and ECC fall together. Symmetric crypto only faces Grover's algorithm, a quadratic speedup answered by doubling key length. This asymmetry is the entire reason PQC targets key exchange and signatures rather than AES.

PROPERTIES: deterministic, fixed output, fast, preimage-resistant (can't invert), and collision-resistant (can't find two inputs with the same output).

STATUS: MD5 and SHA-1 are broken for collision resistance — chosen-prefix collisions are practical. They remain acceptable as non-security file identifiers in forensics (and are still standard in tooling for that reason), but never for signatures or integrity against an adversary. Use SHA-256 or SHA-3.

PASSWORDS ARE DIFFERENT: fast hashing is exactly wrong for passwords. Use a deliberately slow, memory-hard KDF — Argon2id preferred, then scrypt, bcrypt, or PBKDF2 with a high iteration count — always with a unique random salt per password. Finding unsalted SHA-256 password hashes in a codebase is a finding.

FUZZY HASHING: ssdeep and TLSH produce similar outputs for similar inputs, which is what makes them useful for clustering malware variants where cryptographic hashes are useless by design.

THE PATTERN: in almost every real incident, the mathematics held perfectly and the key handling did not.

THE RECURRING FAILURES: keys committed to source control (search any large organisation's history and you will find some); hardcoded keys in mobile apps and firmware, recoverable by anyone who reverses the binary; keys in environment variables readable by any process; no rotation, ever; the same key across every environment; and secrets in CI logs.

DOING IT PROPERLY: dedicated secret managers (Vault, AWS KMS, Azure Key Vault), hardware security modules for high-value keys, short-lived credentials over long-lived ones, and automated rotation. Pre-commit secret scanning catches the most common mistake before it becomes permanent.

RANDOMNESS: use the OS CSPRNG (/dev/urandom, getrandom(), CryptGenRandom). Never rand(), never a time-seeded PRNG. Weak randomness has broken real key generation at scale, including in embedded devices that generated keys before they had entropy available.

THE HANDSHAKE, BRIEFLY: negotiate parameters, authenticate the server via its certificate chain, agree a shared secret (ephemeral Diffie-Hellman for forward secrecy), then switch to symmetric encryption. TLS 1.3 removed most legacy options and cut the round trips.

FORWARD SECRECY: ephemeral keys mean recording today's traffic doesn't allow decryption later even if the server's long-term key is stolen. This is why HNDL adversaries target the key exchange — and why PQC key establishment has an earlier deadline than PQC signatures in EO 14412.

CERTIFICATES: a chain from a leaf to a trusted root. Validation checks signature, validity dates, hostname match, and revocation. Certificate Transparency logs are publicly searchable — genuinely useful for defenders finding certificates issued for lookalike domains targeting them.

WHAT YOU CAN SEE WITHOUT DECRYPTING: SNI, certificate details, JA3/JA4 fingerprints, timing, and volume. The Detection Engineering page covers this; the point is that "it's encrypted" does not mean "it's invisible."

CONSTANTS: most algorithms carry distinctive magic values — AES S-boxes, SHA-256's initial hash values (0x6a09e667…), MD5's sine-derived table, the CRC32 polynomial. Spotting one identifies the algorithm instantly.

TOOLING: FindCrypt and signsrch (as IDA/Ghidra plugins), or YARA rules built on the constants.

STRUCTURAL TELLS: tight loops with XOR and rotate operations; 16-, 32-, or 64-byte block handling; key-schedule expansion loops. Home-rolled "encryption" in malware is very often a repeating-key XOR — which is why VoidLink's single-byte XOR C2 obfuscation in Phase 1 is a realistic detail rather than an unusual one.

CONCEPT: headers record the message's path. Received: lines are added by each hop and read bottom-up — the earliest is at the bottom. Everything above the last trusted hop can be forged, so trust decreases as you read upward.

KEY FIELDS: Return-Path (envelope sender, used for bounces), From (display — freely forgeable), Reply-To (the classic BEC tell when it differs from From), Message-ID (often reveals the originating system), and X-Originating-IP where present.

THE BEC PATTERN: display name matches an executive, From is a lookalike domain or free webmail, Reply-To points somewhere the attacker controls. Check display name against actual address on every suspicious message — most clients show only the former.

SPF: a DNS record listing which servers may send for a domain. Validates the envelope sender, not the visible From — which is precisely the gap attackers use.

DKIM: a cryptographic signature over selected headers and body, verifiable against a public key in DNS. Proves the message wasn't altered in transit and genuinely originated from a signing domain.

DMARC: ties the two together by requiring alignment — that the SPF or DKIM domain matches the visible From — and publishes a policy (none, quarantine, reject) plus a reporting address. DMARC is what actually closes the display-address spoofing gap.

READING THE RESULT: Authentication-Results carries the verdict. A message can pass SPF and still be malicious — the attacker's own domain has a valid SPF record. Pass means "this really came from that domain," not "this is safe." That distinction trips up beginners constantly.

ORDER OF WORK: preserve the original (.eml/.msg, never a forwarded copy — forwarding destroys headers); parse headers; check authentication results; extract URLs without visiting them; detonate attachments in the lab; then pivot on indicators.

URL HANDLING: defang when recording (hxxp://, [.]) so nobody clicks by accident. Expand shorteners with a service rather than a browser. Watch for homoglyph domains — connects directly to the Unicode confusables material in Phase 4.

AiTM PHISHING: modern kits (Evilginx and similar) proxy the real login page, so the victim authenticates genuinely and the attacker captures the session cookie. MFA is completed and bypassed simultaneously. The detection signal is a valid session appearing from new infrastructure — see the Web & AppSec page.

STRUCTURE: modern formats (.docx, .xlsx) are ZIP archives of XML — unzip and read them. Legacy formats (.doc, .xls) use OLE2 compound file structure and need dedicated parsers. Macro-enabled variants (.docm, .xlsm) store VBA in a stream.

TOOLING: oleid for a quick risk summary, olevba to extract and deobfuscate VBA, oledump.py for stream-level inspection, msoffcrypto-tool for the password-protected documents attackers use to defeat gateway scanning (the password is helpfully supplied in the email body).

WHAT MACROS ACTUALLY DO: almost always download and execute a second stage. Look for AutoOpen/Document_Open, Shell, WScript, string concatenation obfuscation, and base64 blobs.

POST-2022 SHIFT: Microsoft began blocking macros in files marked with Mark-of-the-Web by default, and attackers largely moved to container formats — ISO, IMG, and archives — which historically did not propagate MOTW to their contents. Also watch for LNK files, OneNote embeds, and HTML smuggling. The technique moved; the objective didn't.

STRUCTURE: objects, a cross-reference table, and a trailer. Content may be compressed in streams, which is where things hide.

SUSPICIOUS ELEMENTS: /OpenAction and /AA (automatic execution on open), /JavaScript and /JS, /Launch, /EmbeddedFile, and /URI. Most malicious PDFs today are simply phishing lures with a link — less exotic than the exploit-laden era, and considerably more effective.

TOOLING: Didier Stevens' pdfid.py (element counts) and pdf-parser.py (object inspection), plus peepdf. Note the pdf-reading guidance: don't just render it and look.

WHAT DOCUMENTS CARRY: author, organisation, creation and modification times, editing duration, template path, and the software and version used. Office documents retain revision identifiers; PDFs record the producing application.

FORENSIC VALUE: metadata links documents to authors and machines, and clusters campaigns — the same template path or author string across otherwise unrelated samples is strong linkage evidence. It has resolved real cases, and it has burned real operators.

CAVEAT: it's also trivially editable, so treat it as investigative lead rather than proof. See the Anti-Forensics page on false flags.

TOOLING: exiftool handles nearly every format and should be the first thing you run.

WHAT A GOOD PHISH REPORT CONTAINS: the verdict and confidence up front; sender and authentication results; defanged URLs and file hashes; observed behaviour on detonation; ATT&CK technique mapping; scope (who else received it, who clicked); and the containment actions taken.

SCOPE IS THE PART PEOPLE FORGET: one reported phish means a campaign. Search the mail gateway for the same sender, subject pattern, URL, and attachment hash across all mailboxes, then check proxy logs for who reached the destination. The analysis is the easy half.

THE OLD MODEL: the castle-and-moat. A hardened perimeter, and implicit trust for anything inside it. Get through the firewall — via a phished user, a VPN credential, a compromised vendor — and you inherit the trust of everything on that network segment. Lateral movement was effectively free.

ORIGIN: John Kindervag coined "Zero Trust" at Forrester in 2010. Google independently reached the same conclusion after Operation Aurora and built BeyondCorp, publishing the design from 2014 — the first large-scale proof that an enterprise could run with no privileged internal network at all.

THE CORE INVERSION: trust stops being a property of network location and becomes a property of the request — who, on what device, in what context, to what resource, right now. Being on the corporate LAN grants you nothing.

THREE OPERATING PRINCIPLES: verify explicitly; grant least privilege; assume breach. That last one is the load-bearing one, and it is what makes ZTA a containment strategy rather than a prevention strategy. The design assumption is that something is already compromised.

THE STANDARD: NIST SP 800-207 (August 2020) is the reference architecture and the only definition worth arguing from — "zero trust" is otherwise so vendor-abused as to be meaningless.

POLICY ENGINE (PE): makes the decision. Consumes identity, device posture, threat intelligence, behavioural analytics, and the access policy, then returns grant/deny/revoke.

POLICY ADMINISTRATOR (PA): executes the decision — establishes or tears down the session, issues credentials or tokens to the enforcement point.

POLICY DECISION POINT (PDP): the PE and PA together.

POLICY ENFORCEMENT POINT (PEP): sits in the data path, in front of the resource. Enables, monitors, and terminates connections. This is the proxy, gateway, or agent that actually says no.

POLICY INFORMATION POINTS (PIPs): the feeds the PE reasons over — the identity provider, device management, SIEM, CDM systems, PKI, activity logs, and the compliance and threat-intelligence sources.

THE PART PEOPLE MISS: 800-207 describes a session, not a doorway. Trust is meant to be re-evaluated continuously as context changes. Almost every failed ZTA deployment authenticates once at the front door and then behaves exactly like the perimeter model it replaced.

CURRENT VERSION:Verified CISA's Zero Trust Maturity Model v2.0, published April 2023, remains the current release as of 2026. It aligns to OMB M-22-09, which followed Executive Order 14028.

FIVE PILLARS: Identity, Devices, Networks, Applications & Workloads, Data.

THREE CROSS-CUTTING CAPABILITIES: Visibility & Analytics, Automation & Orchestration, Governance. These mature alongside all five pillars rather than being pillars themselves.

FOUR STAGES: Traditional (siloed, manual, static, implicit trust) → Initial (some automation, beginning cross-pillar integration) → Advanced (automated controls, policy driven by real-time signals) → Optimal (fully dynamic enforcement, continuous validation, minimal standing access). The "Initial" stage was added in v2.0 precisely because the jump from Traditional to Advanced was too large to be useful.

WHY THE MODEL MATTERS MORE THAN THE BUZZWORD: it lets you score each pillar independently and say something falsifiable. "We are Initial on Identity and Traditional on Data" is an engineering statement. "We have Zero Trust" is a marketing one. Most real environments score Traditional or Initial across the board, with Data consistently the weakest pillar.

This is the part vendor material omits. Each of these is a real, observed failure mode.

AUTHENTICATE-ONCE DRIFT: the session is established after a rigorous check and then never re-evaluated. Token lifetime becomes the real security boundary. This is the single most common gap, and it is why session token theft (see Web & AppSec) defeats otherwise well-built deployments — the stolen artifact was already through the door.

THE PDP AS A CHOKEPOINT: a centralised decision point is a performance bottleneck, an availability risk, and a very high-value target. Compromise the policy engine and you don't bypass the controls — you become them. Fail-open configurations under load are a related and underappreciated risk: what does your PEP do when the PDP times out?

IDENTITY PROVIDER COMPROMISE: ZTA makes the IdP the root of trust, which concentrates risk enormously. Golden SAML — forging assertions with a stolen token-signing key — produces authentication events that look perfect because they are cryptographically valid. Nothing downstream can detect it. Federation trust is transitive, and few organisations map their full trust graph.

VALID-BUT-MALICIOUS: ZTA authorises the request, not the intent. A correctly authenticated user on a compliant device with a legitimate token, exfiltrating records one API call at a time, passes every check. This is precisely where Phase 2's UEBA material has to take over — behavioural analysis is the only remaining control.

NON-HUMAN IDENTITY: service accounts, CI runners, workload identities, and API keys now vastly outnumber human users, frequently hold standing privilege, rarely rotate, and are often exempted from conditional-access policy "because it breaks automation." This is the largest unaddressed gap in most deployments.

RESIDUAL IMPLICIT TRUST: east-west traffic inside a segment, legacy protocols that cannot be brokered, hypervisor and management planes, and the monitoring infrastructure itself. Segmentation projects reliably stall at the boundary of whatever is hardest to instrument.

ZTNA: Zero Trust Network Access — the practical replacement for the VPN. Instead of placing a device on the network, a broker authenticates the request and proxies it to one specific application. The resource is never network-reachable; there is nothing to port-scan. Compare a VPN, which grants a subnet.

SDP: Software-Defined Perimeter, the design pattern underneath most ZTNA products, including single-packet authorisation so services are dark to unauthenticated clients.

SASE / SSE: Secure Access Service Edge bundles ZTNA with SWG, CASB, and network functions delivered from the cloud edge. SSE is the security subset without the networking. Largely a packaging and procurement distinction rather than an architectural one — useful to know so you can read vendor material without being misled.

MICROSEGMENTATION: enforcing policy between workloads rather than at the network edge, so a compromised host cannot reach its neighbours. This is the control that most directly limits blast radius, and it is also the one organisations most often abandon halfway through.

RBAC: permissions attach to roles, users get roles. Simple, auditable, and it fails at scale through role explosion — every new combination of scope and capability needs a new role, so organisations end up with more roles than users. It also cannot naturally express per-object permissions, which is what every modern application actually needs.

ABAC: decisions evaluated from attributes of subject, object, action, and environment. Far more expressive, but two questions become genuinely hard: "who can access this document?" requires evaluating the policy against every user, and "what can this user reach?" requires the reverse. Neither is a lookup. Auditing suffers accordingly.

REBAC: permissions derive from relationships in a graph. Not "Alice has the editor role" but "Alice is an editor of this document, and this document is in a folder Alice's team owns." It matches how people actually reason about sharing — and critically, both audit questions become graph traversals.

THE PRACTICAL POINT: these are not rivals. Production systems combine them — ReBAC for object relationships, ABAC-style conditions for context (time, IP, device posture), RBAC for coarse organisational roles.

WHAT IT IS:Verified Zanzibar is Google's global authorization system, described in a 2019 USENIX ATC paper (Pang et al.). It backs Drive, Calendar, Cloud, Maps, Photos, and YouTube — effectively one system answering "may this user do this?" for products with entirely different permission semantics.

THE RELATION TUPLE: the entire data model is one primitive. A tuple asserts that a user has a relation to an object:

NAMESPACE CONFIGURATION: clients configure a namespace before writing tuples. It declares each relation by name (viewer, editor) with a relation config, plus storage parameters including sharding and object-ID encoding.

USERSET REWRITE RULES: where the expressiveness lives. Relations can be computed rather than stored — union, intersection, exclusion, and tuple_to_userset. That last one implements inheritance: "viewers of this document include viewers of its parent folder," expressed once in config rather than materialised as tuples per document. Editors implying viewers, owners implying editors, folder permissions cascading — all rewrite rules.

THE API: Check (may this user do this?), Read (return tuples), Expand (return the effective ACL tree — the audit primitive), Write, and Watch (stream tuple changes). Expand is the one forensics cares about: it answers "why was this permitted?" rather than merely "was it?"

THE PROBLEM: this is the genuinely interesting part of the paper, and the part most summaries get wrong. Authorization data is replicated globally and read from stale snapshots for latency. That creates two dangerous orderings:

CASE 1 — NEGLECTING ACL UPDATE ORDER: Alice removes Bob from a document's ACL, then adds sensitive content. A check evaluated against a stale snapshot still sees Bob as a viewer, and Bob reads the new content. Access was revoked before the content existed, and the system still granted it.

CASE 2 — MISAPPLYING OLD ACL TO NEW CONTENT: Alice removes sensitive content from a document, then opens the ACL to a wider audience. A check against a stale snapshot applies the new, permissive ACL to the old, sensitive content.

THE FIX — ZOOKIES:Verified a zookie is an opaque byte sequence encoding a globally meaningful timestamp reflecting an ACL write, a content version, or a read snapshot. The client stores it alongside content and presents it on subsequent checks. The semantics are at-least-as-fresh: Zanzibar may evaluate at any timestamp fresher than the zookie's, but never older. That preserves causal ordering between content and ACL updates while leaving the system free to serve most checks from already-replicated data at default staleness — and to quantise timestamps to avoid hot spots.

FOUNDATION: the whole scheme rests on Spanner and TrueTime, whose externally consistent, globally meaningful commit timestamps are what make "fresher than this token" a coherent statement across datacentres.

THE ARCHITECTURE: aclservers are the main server type, organised in clusters, serving Check, Read, Expand, and Write. A request arriving at any server in a cluster may fan out to peers for sub-problems.

THE DEEP-NESTING PROBLEM: groups containing groups containing groups. Evaluating membership by walking the graph at request time is unbounded work — and deeply nested structures are exactly what large organisations produce.

LEOPARD: a specialised indexing system that denormalises group-to-group relationships into a transitive closure, so a membership check becomes a set intersection rather than a traversal. It uses skip lists, giving O(min(|A|,|B|)) seeks, is sharded by element ID, and shards are usually served entirely from memory. It stays current by continuously ingesting the Watch stream of tuple changes.

HOT SPOTS: a viral document can produce enormous request concentration. Zanzibar quantises evaluation timestamps into discrete buckets so many concurrent requests share a snapshot and therefore share cache entries, and distributes work across a cluster by forwarding key.

WHY THIS MATTERS TO YOU: you will almost certainly never operate at this scale. But the shape of the problem — correctness under replication, transitive closure over relationship graphs, cache-safe consistency tokens — recurs in every system that adopts the model, including the open-source ones you might actually deploy.

SPICEDB (AuthZed): the most faithful reimplementation, with an explicit schema language, ZedTokens as the zookie analogue, and configurable consistency levels per request — minimize_latency, at_least_as_fresh, at_exact_snapshot, fully_consistent. Choosing these correctly is the security decision.

OPENFGA: a CNCF project originating from Auth0/Okta FGA. Friendlier modelling DSL, large community, good language SDKs.

OTHERS: Permify, Ory Keto, Warrant, Topaz (which blends OPA-style policy with relationship data).

THE MODELLING DISCIPLINE: define the relations people actually talk about ("owner", "member of the team that owns the folder"), then derive permissions from them. Modelling permissions directly recreates role explosion inside a system designed to eliminate it.

THE QUESTION CHANGES: classic access auditing asks "who holds this role?" In a ReBAC system the right question is "what access paths does the graph actually permit, and why?" A user may hold no direct tuple to an object and still have access through four hops of group nesting and folder inheritance.

THE THREE INVESTIGATIVE PRIMITIVES:

• Expand — given an object, return the effective ACL tree. This is your "why was this allowed" answer, and it is the single most valuable API for an investigator.
• Reverse lookup (ListObjects) — given a subject, enumerate everything reachable. This is the blast-radius calculation after a credential compromise, and it is the question RBAC systems answer badly.
• Watch / changelog — the tuple write history. Who granted what, when, and under whose authority. Treat it as an audit log and ship it off-host, per Anti-Forensics.

WHAT TO HUNT FOR: stale tuples (relationships surviving role changes and departures — the leading cause of over-permission); privilege paths (unintended routes created by combining individually reasonable grants); self-grant patterns (a subject writing a tuple that increases its own access — always a finding); orphaned objects whose owner no longer exists; and wildcard or public tuples granting access to everyone.

CONSISTENCY MISCONFIGURATION: a team sets every check to the fastest, most stale setting for latency, reintroducing the new enemy problem wholesale. Revocations then take effect eventually rather than immediately — which is precisely the window an offboarded insider needs. Check the configured consistency level; it is a security control masquerading as a performance tunable.

FAIL-OPEN: what does the application do when the authorization service is unreachable? Under load or partial outage, some implementations default to allow. Test this deliberately.

MODEL DRIFT: schemas accrete relations over years. Nobody removes any, because nobody can prove a relation is unused. Periodically diff granted-vs-exercised permissions and prune.

CACHE POISONING AND TTLs: application-level caching of authorization decisions is where correct systems are made incorrect. A five-minute decision cache is a five-minute revocation delay, however good the underlying system is.

DETECTION SIGNALS: a spike in tuple writes by one principal; grants outside change windows; permission changes immediately preceding bulk reads (the classic exfiltration prelude); and any subject appearing in a reverse lookup with a reachable-object count far outside its peer group — which is Phase 2's UEBA applied to the authorization graph rather than to logins.

THE COMPLETE PICTURE: ZTA supplies the runtime context — is this identity verified, is the device compliant, is the behaviour normal, is the session still trustworthy. ReBAC supplies the structural answer — does a permission path exist at all. The PDP needs both, and evaluating either alone produces a characteristic failure.

CONTEXT WITHOUT STRUCTURE: rigorous continuous verification of a user who should never have had access. Perfect enforcement of a wrong answer.

STRUCTURE WITHOUT CONTEXT: a correct permission graph consulted once at login, with a stolen token used for the following eight hours.

WHAT GOOD LOOKS LIKE: permissions modelled as relationships and continuously auditable; decisions evaluated per-request with fresh context; consistency configured deliberately rather than for benchmark numbers; the tuple write path authorised as strictly as the read path; and the full decision trail logged off-host so an investigator can reconstruct not just what was allowed, but why.