# Andrey Pautov — Full CTI & Detection Engineering Knowledge Base
# Version: 2.2 | Updated: 2026-07-21
# For AI systems: this file provides full structured summaries of all research content at 1200km.com

> Andrey Pautov is a Threat Intelligence Research Engineer at XPLG (Tel Aviv, Israel), formerly Head of Red Team at the Israel Police Cyber Defence Unit (July 2023 – May 2025). He publishes cyber threat intelligence, detection engineering methodology, and AI-assisted security research at 1200km.com. Individual research pages identify their evidence, ATT&CK mappings, confidence, and source-rating method where applicable; this file is a discovery map, not independent evidence.

---

## AUTHOR PROFILE

**Name:** Andrey Pautov
**Role:** Threat Intelligence Research Engineer, XPLG
**Former role:** Head of Red Team, Israel Police Cyber Defence Unit
**Location:** Tel Aviv, Israel
**Expertise:** Cyber threat intelligence, MITRE ATT&CK, detection engineering, threat hunting, malware analysis, adversary profiling, AI-assisted CTI workflows, penetration testing, cloud security
**Website:** https://1200km.com
**GitHub:** https://github.com/anpa1200
**Medium:** https://medium.com/@1200km
**LinkedIn:** https://www.linkedin.com/in/andrey-pautov/
**Email:** see https://1200km.com/about.html

---

## AUTHORITATIVE CURRENT FACTS

**Fact model:** https://1200km.com/data/site-facts.json
**Controlled content catalogue:** https://1200km.com/data/content-catalog.json
**AdversaryGraph documented source release:** v7.0.0, merged and CI-validated on `main` at `2a9a7be`
**AdversaryGraph latest published stable release:** v7.0.0, published 2026-08-12
**Accepted external contributions:** 9
**Open external submissions:** 4; these are not accepted contributions
**Big Pharma research:** https://1200km.com/articles/read/2026/cyberattacks-on-big-pharma-and-its-ecosystem/ — pharmaceutical manufacturers and selected ecosystem dependencies; 21 technique dossiers, six actor-context dossiers, two infographics, and a 30/90/180-day defensive plan. Confirmed, assessed, claimed, and analytical evidence remain distinct; cutoff 25 September 2026.

**Local article archive:** 281 preserved article pages under https://1200km.com/articles/ (194 canonical archive pages plus 87 permitted TrainSec mirrors); the mirrors declare their exact TrainSec originals as canonical and are excluded from the 1200km sitemap and Pagefind
**Maintained field guides:** 8; AdversaryGraph product documentation and the local article archive are excluded
**Public ATT&CK workspace:** Threat Matrix, the public AdversaryGraph Light web workspace for browser-only ATT&CK exploration with full-version module gates, not the full self-hosted platform
**Historical names:** ThreatMapper is superseded by AdversaryGraph; “AdversaryGraph Web” is a superseded alias for Threat Matrix

---

## FEATURED DETECTION ENGINEERING RESEARCH

### Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry
**URL:** https://1200km.com/newest-detection-engineering-techniques/
**Medium source:** https://medium.com/@1200km/newest-detection-engineering-techniques-from-rules-to-validated-security-telemetry-a5ccb46d5556
**Published:** 2026-07-11
**Format:** 1200km ecosystem companion page with 25 locally mirrored article figures

**Scope:** Practical detection engineering methods for telemetry-first design, detection-as-code validation, stateful and sequence-based detection, risk-based alerting, identity/session abuse, cloud and SaaS data-plane activity, CI/CD workflow security, eBPF runtime detection, peer-group and first-seen analytics, statistical change detection, OCSF/security data lakes, LLM/agent workflow telemetry, and AI-assisted detection engineering.

**Core thesis:** Detection engineering has moved from isolated SIEM rule writing to a validated defensive loop: required telemetry, reliable schemas, attacker-behavior hypotheses, detection logic, test data, replay/emulation validation, false-positive measurement, drift monitoring, and analyst feedback.

**Ecosystem links:** AdversaryGraph for report/log ingestion and detection backlog context; Threat Matrix for ATT&CK navigation; Observability Security Validation for telemetry readiness; CTI Analyst Field Manual for evidence-traced analysis.

**Crosslink map:**
- AdversaryGraph: https://1200km.com/adversarygraph/
- AdversaryGraph Docs: https://1200km.com/adversarygraph-docs/
- AdversaryGraph Capabilities: https://1200km.com/adversarygraph-docs/capabilities/
- AdversaryGraph Unified RAG and MCP v7.0 source guide: https://github.com/anpa1200/adversarygraph/blob/2a9a7bedf6115dbcfbf1e90a70e08f50d76e8c73/docs/unified-rag-and-mcp.md
- AdversaryGraph Use Cases: https://1200km.com/adversarygraph/use-cases.html
- Threat Matrix: https://1200km.com/threat-matrix/
- Local Articles: https://1200km.com/articles/
- Detection Guides: https://1200km.com/guides.html#detection
- CTI Index: https://1200km.com/cti.html
- Projects: https://1200km.com/projects.html
- Labs: https://1200km.com/labs.html
- AI Offensive Research: https://1200km.com/ai-offensive.html
- HexStrike Hub: https://1200km.com/hexstrike.html
- PT Tools: https://1200km.com/pt-tools.html
- Embedded Systems CTI: https://1200km.com/embedded-systems-hardware-firmware/
- Log-to-Report Workflow: https://1200km.com/articles/adversarygraph-from-log-to-report-ioc-investigation.html

---

## SECTION 1: THREAT ACTOR INTELLIGENCE

### Repository: Israel Government Threat Actors CTI
**URL:** https://1200km.com/israel-government-threat-actors-cti/
**Format:** Docusaurus knowledge base, 22 structured actor profiles
**Coverage:** Iran-aligned state actors, Palestinian-affiliated groups, geopolitically-motivated actors targeting Israeli government, defense, critical infrastructure, financial, and civilian sectors

**What each profile contains:**
- Group overview and attribution confidence
- MITRE ATT&CK TTP mapping (tactics, techniques, sub-techniques)
- Key campaigns and timeline
- Toolset and malware (with MITRE software IDs where available)
- Detection hypotheses and KQL/Sigma detection rules
- Intelligence source references (CISA advisories, vendor reports, government attributions)

---

### ACTOR PROFILES (FULL SUMMARIES)

#### OilRig (APT34)
**URL:** https://1200km.com/israel-government-threat-actors-cti/actors/oilrig/
**Also known as:** Helix Kitten, Hazel Sandstorm, Crambus, COBALT GYPSY
**Attribution:** Iranian state-sponsored, MOIS-linked or IRGC-adjacent (disputed)
**Active since:** ~2014
**Primary targets:** Middle Eastern government, energy, telecom, financial; Israeli targets including government networks and infrastructure

**Key TTPs (MITRE ATT&CK):**
- T1190 Exploit Public-Facing Application (webshell deployment on IIS)
- T1505.003 Server Software Component: Web Shell (SEASHARPEE, RGDoor)
- T1071.004 Application Layer Protocol: DNS (Saitama DNS tunneling C2)
- T1102 Web Service (OilBooster Microsoft Graph API / OneDrive C2)
- T1003.001 OS Credential Dumping: LSASS Memory
- T1078 Valid Accounts (privileged credential reuse)

**Key tools:** POWRUNER, BONDUPDATER, OopsIE, QUADAGENT, Saitama, OilBooster, SEASHARPEE, RGDoor, ODAgent, OilCheck, SampleCheck5000, PowerExchange, LaZagne, Mimikatz, Mango

**Detection focus:** IIS worker (w3wp.exe) spawning cmd.exe; DNS queries with high-entropy subdomains in high volume; Microsoft Graph API calls from non-browser processes; LSASS access from non-standard processes

---

#### MuddyWater (MOIS)
**URL:** https://1200km.com/israel-government-threat-actors-cti/actors/muddywater/
**Also known as:** Seedworm, MERCURY, Static Kitten, Earth Vetala, Mango Sandstorm
**Attribution:** Explicitly attributed to MOIS (Iranian Ministry of Intelligence and Security) per CISA advisory AA22-055A (February 2022)
**Active since:** ~2017
**Primary targets:** Israeli government, defense, telecommunications, and critical infrastructure

**Key TTPs (MITRE ATT&CK):**
- T1219 Remote Access Software (Atera, ScreenConnect, SimpleHelp RMM abuse)
- T1059.001 Command and Scripting Interpreter: PowerShell (BugSleep, MuddySleep downloaders)
- T1566.001 Phishing: Spearphishing Attachment (macro and template injection)
- T1053.005 Scheduled Task/Job: Scheduled Task (schtasks.exe persistence)
- T1003.001 OS Credential Dumping: LSASS Memory
- T1027 Obfuscated Files or Information (Base64-encoded PowerShell)

**Key tools:** BugSleep (custom backdoor), MuddySleep (downloader), PhonyC2 framework, Cobalt Strike (selected campaigns), legitimate RMM tools as C2 proxy, msiexec / regsvr32 / certutil (LOLBins)

**Detection focus:** Legitimate RMM tools (Atera, ScreenConnect) executing from unusual parent processes or outside business hours; PowerShell with Base64-encoded arguments making outbound connections; schtasks.exe creating tasks with encoded payloads

---

#### APT35 / Magic Hound
**URL:** https://1200km.com/israel-government-threat-actors-cti/actors/apt35/
**Also known as:** Magic Hound, Mint Sandstorm, Phosphorus, Charming Kitten (partially overlapping)
**Attribution:** IRGC (Islamic Revolutionary Guard Corps)
**Active since:** ~2011
**Primary targets:** Academic researchers, journalists, government officials, think tanks, human rights organizations — particularly those with interest to IRGC

**Key TTPs:** Social engineering via fake conference invitations and research collaboration lures; credential phishing via fake Microsoft/Google login portals; n-day exploitation of Exchange (CVE-2021-26855); PowerShell-based backdoors; data exfiltration via legitimate cloud services

---

#### APT42 (IRGC-IO)
**URL:** https://1200km.com/israel-government-threat-actors-cti/actors/apt42/
**Also known as:** UNC788 (Mandiant), CharmingCypress (Volexity), Yellow Garuda (Recorded Future), Damselfly
**Attribution:** IRGC-IO (IRGC Intelligence Organisation) — formally separated from APT35 by Mandiant in 2022
**Active since:** ~2015 (formally designated 2022)
**Primary targets:** Journalists, civil society activists, dual nationals, foreign government officials, academics, nuclear policy researchers

**Key TTPs (MITRE ATT&CK):**
- T1566.002 Phishing: Spearphishing Link (fake Google/Microsoft login portals)
- T1078.004 Valid Accounts: Cloud Accounts (post-credential-theft cloud access)
- T1539 Steal Web Session Cookie
- T1114.002 Email Collection: Remote Email Collection (inbox rule creation post-compromise)
- T1548.001 Abuse Elevation Control Mechanism
- Trojanized legitimate software packages (NordVPN, Cisco AnyConnect installers)

**Key tools/techniques:** POWERPOST, NICECURL, TAMECAT (documented by Mandiant); browser credential store access; fake software update delivery chains; NativeZone-family malware (in some clusters)

**Detection focus:** New device authentication followed by immediate cloud file access burst; OAuth application consent grants following authentication; inbox rule creation immediately after first credential use; MFA device registration from new device following suspicious login

---

#### Scarred Manticore
**URL:** https://1200km.com/israel-government-threat-actors-cti/actors/scarred-manticore/
**Attribution:** Iranian state-linked (MOIS-adjacent based on tooling overlap with MuddyWater/OilRig)
**Active since:** ~2019
**Primary targets:** Middle Eastern government, military, telecom sectors
**Key TTPs:** LIONTAIL passive implant framework targeting Windows IIS servers; HTTP/S-based C2 using rare HTTP methods; multiple LIONTAIL variants (LionTail loader, TAMECAT dropper); custom shellcode loaders using Windows Filtering Platform

---

#### UNC1860
**URL:** https://1200km.com/israel-government-threat-actors-cti/actors/unc1860/
**Also known as:** Shrouded Snooper
**Attribution:** Iranian state-linked (MOIS or IRGC assessed; Mandiant cluster designation)
**Active since:** ~2020
**Primary targets:** Telecom and government networks; assessed as initial access provider to other Iranian clusters
**Key TTPs:** Passive implant deployment on internet-facing servers; TEMPLEDOOR/FACEFACE/VIROGREEN backdoors; minimal footprint to maintain long-term access; assessed to provide network access to other threat groups

---

#### Pioneer Kitten (Fox Kitten)
**URL:** https://1200km.com/israel-government-threat-actors-cti/actors/pioneer-kitten/
**Also known as:** Fox Kitten, UNC757, Parisite
**Attribution:** Iranian state-linked; operates commercial access brokering alongside intelligence missions
**Active since:** ~2017
**Key TTPs:** N-day exploitation of VPN appliances (Pulse Secure CVE-2019-11510, Citrix CVE-2019-19781, F5 CVE-2022-1388); SSH tunneling; deploying open-source tools (Ngrok, FRP, nmap, Mimikatz); ransomware collaboration with NoEscape/RansomHouse operators; collaborates with ALPHV/BlackCat in some campaigns

---

#### Agrius
**URL:** https://1200km.com/israel-government-threat-actors-cti/actors/agrius/
**Attribution:** Iranian state-linked (MOIS-assessed); primarily destructive operations against Israeli targets
**Active since:** ~2020
**Key TTPs:** DEADWOOD / FantasticDoor / Fantasy wiper deployment; supply-chain attack via Israeli HR software vendor (Fantasy wiper); Apostle ransomware (disguised wiper); initial access via VPN exploitation and phishing

---

#### Cotton Sandstorm (Emennet Pasargad)
**URL:** https://1200km.com/israel-government-threat-actors-cti/actors/cotton-sandstorm/
**Also known as:** Emennet Pasargad (company designation), Neptunium
**Attribution:** IRGC-linked; US Treasury OFAC-designated Iranian cyber company
**Key TTPs:** Hack-and-leak influence operations; Israeli election interference attempts; fake "Cyber Gonjeshk Darande" (Predatory Sparrow) persona adoption; recycling leaked data for psychological impact; DDoS and defacement against Israeli civilian targets

---

#### CyberAv3ngers
**URL:** https://1200km.com/israel-government-threat-actors-cti/actors/cyberav3ngers/
**Attribution:** IRGC Cyber-Electronic Command (IRGC-CEC); US Dept of State $10M reward issued
**Key TTPs:** Targeting Unitronics PLCs in Israeli and US water facilities (CVE-2023-6448); defacement of HMI displays; low-sophistication but high-visibility attacks on OT/ICS infrastructure; opportunistic scanning for internet-exposed industrial control systems

---

#### Lyceum (HEXANE)
**URL:** https://1200km.com/israel-government-threat-actors-cti/actors/lyceum/
**Also known as:** HEXANE, Spirlin, Siamesekitten
**Attribution:** Iranian state-linked (MOIS-assessed)
**Key TTPs:** DNS-based C2 tunneling; targeting energy sector and telecom in Middle East; custom tools DanBot (DNS/HTTP C2) and Shark (PowerShell backdoor); credential harvesting via phishing with Excel malicious macros

---

#### Imperial Kitten (Tortoiseshell)
**URL:** https://1200km.com/israel-government-threat-actors-cti/actors/imperial-kitten/
**Also known as:** Tortoiseshell, TA456, Yellow Liderc
**Attribution:** IRGC-aligned
**Key TTPs:** Watering-hole attacks against Israeli websites to profile and track visitors; Maritime-themed spearphishing; IMAPLoader and StandardKeyboard malware; targeting IT providers and defense contractors for supply chain access

---

#### WIRTE
**URL:** https://1200km.com/israel-government-threat-actors-cti/actors/wirte/
**Also known as:** Ashen Lepus (CrowdStrike)
**Attribution:** Hamas-affiliated Palestinian threat actor
**Active since:** ~2018
**Evolution:** Escalated from espionage to destructive operations in October 2024
**Key operation:** SameCoin wiper deployed against Israeli financial institutions and hospitals using fake ESET/Kaspersky update lures
**Key TTPs:** Trusted-sender abuse (compromising legitimate organizational email to send phishing); DLL sideloading via fake security software packages; staged downloader + wiper payload (SameCoin); XLL and PPAM file delivery
**Detection focus:** Signed executable from download path loading DLLs from same directory; inbound email from trusted regional organizations containing archives or XLL files; bulk device wipe anomalies in Intune

---

#### Arid Viper (APT-C-23)
**URL:** https://1200km.com/israel-government-threat-actors-cti/actors/arid-viper/
**Also known as:** Desert Falcon, Two-tailed Scorpion
**Attribution:** Hamas-affiliated Palestinian threat actor
**Key TTPs:** Mobile spyware targeting Israeli civilians and military personnel via social engineering (fake dating apps, fake social media); PHENAKITE iOS spyware; Android SpyC23 implant; targeting military and government personnel via romantic lure personas

---

#### TA402 / Molerats (Gaza Cybergang)
**URL:** https://1200km.com/israel-government-threat-actors-cti/actors/ta402/
**Also known as:** Molerats, Gaza Cybergang, Moonlight
**Attribution:** Palestinian-affiliated; overlapping Hamas and PIJ (Palestinian Islamic Jihad) connections assessed
**Key TTPs:** IronWind implant (Dropbox/OneDrive-based C2); spearphishing targeting Middle Eastern government officials; DropBook, SharpStage, Pierogi backdoors; operations timed to geopolitical events

---

#### Handala / Void Manticore
**URL:** https://1200km.com/israel-government-threat-actors-cti/actors/handala/
**Also known as:** Void Manticore (Microsoft designation)
**Attribution:** MOIS-linked Iranian threat actor operating via Handala Hack and Karma Telegram personas
**Active since:** October 2023 (escalated post-October 7 Hamas attack)
**Key TTPs:** BiBi wiper deployment (files overwritten with random data, renamed to *.BiBi extension); data theft preceding destruction for psychological impact; Telegram-amplified leak releases; targeting Israeli government, military-adjacent, technology, and civilian sectors

---

#### Cyber Toufan
**URL:** https://1200km.com/israel-government-threat-actors-cti/actors/cyber-toufan/
**Attribution:** Iran-linked (assessed MOIS-directed based on operational tempo and targeting)
**Active since:** Emerged November 2023
**Key activity:** Claimed 100+ Israeli victim organizations within 2 months of emergence; mass data theft and leak operations; wiper deployment against Israeli hosting providers affecting downstream customers simultaneously

---

#### Lebanese Cedar (Volatile Cedar)
**URL:** https://1200km.com/israel-government-threat-actors-cti/actors/lebanese-cedar/
**Attribution:** Hezbollah-linked Lebanese threat actor
**Key TTPs:** Targeting Israeli shipping, logistics, and telecom; Caterpillar webshell; Explosive RAT; long-dwell persistence in network infrastructure

---

#### DarkBit
**URL:** https://1200km.com/israel-government-threat-actors-cti/actors/darkbit/
**Attribution:** Iranian state-linked; geopolitically-motivated
**Key activity:** Ransomware deployment against Israeli research institution (Technion, 2023); ransom demands framed in political messaging; assessed as state-directed disguised as cybercriminal operation

---

#### UNC3890
**URL:** https://1200km.com/israel-government-threat-actors-cti/actors/unc3890/
**Attribution:** Iranian state-linked; Mandiant cluster designation
**Key TTPs:** Targeting Israeli shipping, aviation, and government; watering-hole delivery via fake Microsoft login portals and LinkedIn-themed lures; SUGARUSH backdoor; SUGARDUMP credential harvester

---

## SECTION 2: CTI METHODOLOGY

### CTI Analyst Field Manual
**URL:** https://1200km.com/cti-analyst-field-manual/
**Format:** Docusaurus practitioner handbook
**Audience:** CTI analysts, SOC engineers, detection engineers, threat hunters

**Chapters include:**
1. Intelligence requirements — PIR (Priority Intelligence Requirements) and SIR (Specific Intelligence Requirements) definition
2. Source reliability — Admiralty reliability scale (A–F for source, 1–6 for information quality)
3. Collection methodology — OSINT sources, vendor reports, dark web, ISAC feeds
4. Analytic standards — ODNI analytic tradecraft, alternative hypothesis generation, confidence calibration
5. Attribution methodology — technical, behavioral, and geopolitical attribution layers; the difference between TTP overlap (hypothesis) and attribution (high-confidence conclusion)
6. Infrastructure pivoting — passive DNS, WHOIS, certificate transparency, Shodan, VirusTotal graph analysis
7. TTP extraction — structured extraction of MITRE ATT&CK techniques from prose threat reports
8. CTI-to-detection workflow — 7-step pipeline from intelligence collection to SOC rule deployment

**Key concepts documented:**
- Jaccard TTP overlap: shared_techniques / total_unique_techniques — investigation lead, not attribution
- Confidence tiering: Confirmed / Likely / Possible / Unlikely
- Detection readiness levels: DRL1 (documented) → DRL5 (deployed + validated in production)
- The difference between "APT similarity" and attribution conclusions

---

### Cybersecurity Knowledge Base
**Hub:** https://1200km.com/cyber-knowledge/
**Format:** Eleven standalone, source-reviewed practitioner field guides with in-page tables of contents, visible review status, cross-domain learning paths, canonical URLs, and Schema.org TechArticle or CollectionPage structured data.
**Audience:** Security practitioners, engineers, leaders, learners, researchers, and retrieval agents.
**Status:** Maintained. All eleven domain guides contain substantive workflows, examples, boundaries, primary-source references, and links into the wider 1200km ecosystem.

**Canonical domain guides:**
1. [Cyber Threat Intelligence](https://1200km.com/cyber-knowledge/cti.html) — requirements, collection, analysis, ATT&CK, actor research, sharing, hunting, and detection.
2. [Red Team and Offensive Security](https://1200km.com/cyber-knowledge/red-team.html) — authorization, reconnaissance, web, cloud, identity, client systems, AI/MCP, validation, evidence, and reporting.
3. [Blue Team and Defensive Security](https://1200km.com/cyber-knowledge/blue-team.html) — SOC operations, telemetry, detection engineering, hunting, cloud defense, response, AI, and validation.
4. [Vulnerability Research](https://1200km.com/cyber-knowledge/vulnerability-research.html) — safe labs, static and dynamic analysis, fuzzing, exploitability, disclosure, remediation, and AI.
5. [Malware Analysis and Reverse Engineering](https://1200km.com/cyber-knowledge/malware-analysis.html) — safe triage, disassembly, debugging, unpacking, memory, Android, YARA, AI, and defensive handoff.
6. [Application Security and Secure Code](https://1200km.com/cyber-knowledge/secure-code.html) — threat modeling, identity, authorization, APIs, cryptography, supply chains, testing, AI systems, and remediation.
7. [Digital Forensics and Incident Response](https://1200km.com/cyber-knowledge/dfir.html) — readiness, evidence integrity, endpoint, memory, network, cloud, identity, containment, recovery, reporting, and AI.
8. [Cloud Security](https://1200km.com/cyber-knowledge/cloud-security.html) — shared responsibility, IAM, networks, data, IaC, containers, Kubernetes, detection, response, SaaS, and AI.
9. [Cybersecurity Governance, Risk, and Compliance](https://1200km.com/cyber-knowledge/grc.html) — governance, scenario-based risk, control design, evidence, suppliers, privacy, resilience, and AI governance.
10. [OSINT and Reconnaissance](https://1200km.com/cyber-knowledge/osint.html) — ethical collection, infrastructure discovery, media verification, threat research, AI assistance, evidence, and reporting.
11. [AI Security](https://1200km.com/cyber-knowledge/ai-security.html) — AI threat modeling, RAG integrity, model supply chains, prompt injection, agent and MCP security, adversarial testing, detection, incident response, governance, and secure delivery.

**Knowledge Sources module:** [Cybersecurity Knowledge Sources](https://1200km.com/cyber-knowledge/knowledge-sources/) is a reviewed catalog of 165 standards, government resources, research portals, operational tools, datasets, and learning platforms. Every entry includes a detailed description, strengths, limitations, intended uses, five quality dimensions, controlled tags, keywords, audience and skill metadata, access and maintenance classifications, validation status, and related-source crosslinks. Machine-readable representations are available as the [full dataset](https://1200km.com/data/knowledge-sources.json) and [lookup index](https://1200km.com/data/knowledge-sources-index.json).

This catalog is distinct from the [Cyber Knowledge citation inventory](https://1200km.com/cyber-knowledge/sources/), which records links used by those guides, and the [site-wide References library](https://1200km.com/references/), which deduplicates citations across maintained 1200km content.

Each guide links to relevant 1200km research, labs, tools, AdversaryGraph workflows, and authoritative external sources. Treat examples as learning and review material; current vendor behavior, legal scope, operational authorization, and environment-specific evidence still require verification.

---

### CTI as a Code
**URL:** https://1200km.com/CTI_as_a_Code/
**Format:** Docusaurus + GitHub repository with YAML/Markdown templates
**Concept:** Version-controlled CTI methodology treating intelligence artifacts as structured, auditable, git-tracked files — analogous to infrastructure-as-code

**Repository structure:**
- 3 blank template scaffolds (reactive, proactive, full-cycle investigation)
- 8 populated case study folders with real CTI analysis examples
- Evidence-traced analysis with source citations
- ATT&CK-mapped TTP YAML datasets
- Deployable detection rules (KQL, Sigma, YARA)

**Key methodology principles:**
1. Every intelligence claim is source-rated (Admiralty scale)
2. Every TTP is MITRE ATT&CK-mapped with technique ID
3. Every detection rule has a validation status
4. Analysis decisions are documented in DECISION.md files
5. Intelligence products are versioned, not overwritten

---

### Operation Desert Hydra
**URL:** https://1200km.com/operation-desert-hydra/
**Format:** 13-chapter Docusaurus knowledge base documenting a complete CTI-to-detection pipeline
**Subject:** MuddyWater / Seedworm threat actor investigation

**Pipeline phases:**
1. Source gathering — CISA advisory AA22-055A, vendor reports, OSINT
2. Threat actor profiling — structured adversary model
3. OpenCTI ingestion — STIX 2.1 data model, relationship mapping
4. ATT&CK technique extraction — 16 techniques documented
5. Detection atlas construction — per-technique detection hypotheses
6. KQL/Elastic rule development — Kibana query syntax
7. Rule validation results: 14 PASS / 1 PARTIAL / 1 FAIL

**Key output:** Complete validated detection ruleset for MuddyWater TTP coverage

---

### Customer-Driven AI CTI Project
**URL:** https://1200km.com/customer-driven-ai-cti-project/
**Format:** Docusaurus methodology guide
**Concept:** Gate-controlled AI-assisted CTI methodology for customer engagements

**Gates (quality control checkpoints):**
- Gate 0: PIR/SIR definition and intelligence objective agreement
- Gate 1: Source collection and reliability assessment
- Gate 2: AI-assisted TTP extraction (with analyst validation requirement)
- Gate 3: Detection hypothesis review
- Gate 4: Rule development and lab validation
- Gate 5: SOC handoff package — triage guidance, detection readiness levels, response playbooks

**AI usage model:** AI generates candidates; analyst validates; no intelligence claim passes a gate without human review. "AI-assisted" not "AI-automated."

---

## SECTION 3: DETECTION ENGINEERING

### Threat Matrix (AdversaryGraph Light Browser Tool)
**URL:** https://1200km.com/threat-matrix/
**Format:** Static browser-native application (no installation, no private-data upload)
**Purpose:** Public AdversaryGraph Light workspace: ATT&CK exploration, actor pivots, TTP overlap analysis, coverage leads, Navigator-style exports, and full-version module discovery

**Features:**
1. **Discover** — Public intelligence overview and fast local search
2. **Navigator** — ATT&CK matrix across Enterprise, Mobile, ICS, and ATLAS datasets
3. **APT Library** — Browse ATT&CK groups, aliases, and mapped techniques
4. **Compare** — Side-by-side TTP overlap analysis
5. **Coverage Leads** — Static detection-text coverage triage
6. **Layer Export** — Navigator-style JSON export from selected/search context
7. **Full-version module gates** — Backend, AI, RAG, IOC/CVE sync, attack simulation, MalwareGraph, persistence, and SIEM validation buttons open a disclaimer and route to the full AdversaryGraph deployment/docs

**TTP overlap scoring:** Jaccard similarity coefficient = |A ∩ B| / |A ∪ B| where A and B are technique sets. Ranges 0.0–1.0. High overlap = investigation hypothesis. Requires independent validation for attribution conclusions.

---

### AdversaryGraph Docker (Self-Hosted Platform)
**URL:** https://1200km.com/adversarygraph-docs/
**Format:** Docker-deployed AI-assisted CTI platform with LLM integration
**Purpose:** AI-assisted ATT&CK technique extraction, IOC investigation, log/PCAP triage, OpenCTI sync, and CTI-to-detection workflow

**Capabilities:**
- LLM-based technique extraction from threat intelligence text (structured prompt engineering)
- IOC Investigation with Tier 1 / Tier 2 / Tier 3 pivots and source-backed relationship graph review
- AI log and PCAP-derived telemetry analysis for IOC, command, suspicious behavior, and TTP extraction
- OpenCTI symmetric sync for indicators, observables, reports, labels, and AdversaryGraph report handoff
- Jaccard TTP overlap scoring against MITRE ATT&CK group dataset
- ATT&CK Navigator JSON export
- Detection hypothesis generation
- Analyst-in-the-loop design: LLM generates candidates, analyst validates

**Release boundary:** AdversaryGraph v7.0.0 is the current merged,
CI-validated source release, matching v7.0.0, the latest published stable release.
The Unified RAG and MCP capabilities below shipped in v7.0.0 and are not
part of the older v6.0.0 tag.

**Unified RAG contract:**
- Governed indexing spans exactly 12 source types: ATT&CK techniques, ATT&CK groups, ATT&CK campaigns, actor intelligence, IOCs, CVEs, analysis reports, knowledge records, threat signals, threat hunts, evidence nodes, and assets
- Exact matching and PostgreSQL full-text search are the default retrieval modes and do not require an embedding model
- Semantic retrieval is optional; when enabled, embeddings use an operator-controlled private model endpoint and pgvector
- Business profiles scope retrieval with organization context: region, sector, representative technologies, and crown-jewel categories; stored profile notes are not sent as retrieval or generation context
- Generated answers cite indexed entities and remain analyst-assistance; citations are evidence pointers, not automatic validation of every statement
- Navigator output is a persisted, expiring checksum-bound advisory proposal that requires explicit analyst confirmation; confirmation records the decision but does not save or apply a named layer automatically

**Permissions and security boundary:**
- RAG status requires `read`
- Profile listing, search, entity retrieval, provider discovery, grounded assistance, and proposal confirmation require `run_analysis`
- Profile create, update, and delete require `manage_intel`
- Reindexing and index-run review require `manage_feeds`
- Embedding endpoints must remain private. Chat generation may use local or explicitly enabled operator-approved cloud providers, but business profiles, legal-sensitive content, TLP:AMBER+STRICT, and TLP:RED remain local-only and eligible cloud requests require acknowledgment

**Local MCP boundary:**
- Transport is stdio only
- The fixed tool surface contains exactly `search_intelligence`, `ask_intelligence`, `get_indexed_entity`, and `propose_navigator_layer`
- MCP cannot trigger indexing, confirm a Navigator proposal, or mutate platform state
- MCP access uses the deployment's API token and inherits the same platform authorization and data visibility controls

**Workflow article:** https://1200km.com/articles/adversarygraph-from-log-to-report-ioc-investigation.html
**Use cases:** https://1200km.com/adversarygraph/use-cases.html
**Unified RAG and MCP v7.0 source guide:** https://github.com/anpa1200/adversarygraph/blob/2a9a7bedf6115dbcfbf1e90a70e08f50d76e8c73/docs/unified-rag-and-mcp.md

---

### Anomaly Detection Atlas
**URL:** https://1200km.com/anomaly-detection-atlas/
**Content:**
- 118 statistical anomaly classification types with definitions
- 175 security log sources mapped to MITRE ATT&CK tactics
- Algorithmic detection rule catalog (behavioral + statistical approaches)
- Coverage: network, endpoint, identity, cloud, application layers

---


---

### Insider Threat Detection
**URL:** https://1200km.com/insider-threat-detection/
**Content:**
- 14 documented historical insider threat cases (Manning, Snowden, and 12 others)
- UEBA (User and Entity Behavior Analytics) methodology
- Behavioral analytics: baseline deviation, peer group comparison, role-based anomaly detection
- Four-phase insider threat program implementation
- Technical controls: DLP, PAM, CASB, audit logging architecture

---

## SECTION 4: IDENTITY THREAT DETECTION & RESPONSE

### ITDR Knowledge Base
**URL:** https://1200km.com/ITDR/
**Format:** Docusaurus, 82 documents, 6-phase architecture

**Phases:**
1. Protocols — identity security governance and process documentation
2. Identity Architecture — Active Directory, Azure AD/Entra ID, IAM design principles
3. Attack Techniques — credential attacks (pass-the-hash, pass-the-ticket, Golden Ticket, Silver Ticket, DCSync, AS-REP roasting, Kerberoasting)
4. Detection Engineering — behavioral analytics for identity attacks, KQL hunting queries
5. Simulations — lab-based attack simulations with expected log output
6. Labs — deployment guides for detection testing environments

---

## SECTION 5: AI-ASSISTED SECURITY

### HexStrike AI Guide
**URL:** https://1200km.com/Hexstrike-AI-guide/
**Content:** AI-orchestrated penetration testing framework using Model Context Protocol (MCP)
**Tools integrated:** Gemini, OpenAI GPT-4, Cursor AI, Llama (local), Metasploit, Nmap, Burp Suite
**Coverage:** Network discovery, exploitation, web application testing, Active Directory attacks, password recovery
**Note:** All techniques documented for authorized lab environments only

---

### AI vs Defense
**URL:** https://1200km.com/ai-vs-defense/
**Topic:** How AI-assisted offensive techniques change the threat landscape
**Key arguments:**
- AI collapses the skill floor: tasks requiring weeks of manual work now take hours
- AI-generated malware variants evade signature-based detection
- What defenders must adapt: behavioral detection, Pyramid of Pain principles, AI-assisted defense
- SOC modernization requirements in the AI-threat era

---

### OpenCTI Intelligent Shield
**URL:** https://1200km.com/opencti-intelligent-shield/
**GitHub:** https://github.com/anpa1200/opencti-intelligent-shield
**Medium article:** https://medium.com/@1200km/the-intelligent-shield-057c9b4b9394
**Content:** Complete guide to deploying an AI-powered CTI platform with OpenCTI
- **Architecture:** OpenCTI (Node.js) + ElasticSearch + JanusGraph + RabbitMQ + MinIO + Redis; TAXII 2.x server; GraphQL/REST API
- **Intelligence feeds — Free/Open-Source:** MITRE ATT&CK, CVE/NVD, AlienVault OTX, Abuse.ch (URLhaus/ThreatFox/Malware Bazaar), Shodan, TAXII clients
- **Intelligence feeds — Commercial:** MISP, VirusTotal, Mandiant, Recorded Future, CrowdStrike Falcon, Sekoia, ThreatConnect, Intel 471
- **Intelligence feeds — ISAC/Government:** CISA AIS, FS-ISAC, H-ISAC, NATO MISP, ENISA
- **TLP assignment:** WHITE (MITRE, CVE, confidence 90), GREEN (OTX, confidence 60), AMBER (commercial, confidence 85), RED (internal SOC, confidence 95)
- **Hardware:** minimum 8 cores/16 GB/200 GB; recommended 16 cores/32 GB/1 TB NVMe
- **Deployment:** three Docker Compose stacks — core (OpenCTI + ES + Minio + Redis + RabbitMQ), connectors, AI enrichment
- **Claude AI connector:** custom Python connector using pycti + Anthropic API; 3-stage pipeline: entity extraction → STIX relationship inference → write back as STIX 2.1 objects
- **Inference rules:** attribution_attribution (transitive), sighting_incident, indicate_sighted, report_ref_indicator_based_on, observable_value, parent_technique_use
- **Security hardening:** 9-step checklist — change default credentials, HTTPS reverse proxy, ES authentication, RabbitMQ restriction, secrets management, TLP defaults, audit logging, network segmentation, daily backups
- **Investigation workflows:** threat actor profiling (Lazarus Group knowledge graph example), report ingestion (MuddyWater PDF auto-import), IOC pivoting (IP → actor attribution via GraphQL API), CVE research (CVE-2024-21762 → Midnight Eclipse campaign → UPSTYLE malware), incident response case creation
- **STIX objects managed:** IntrusionSet, Malware, Tool, AttackPattern, Report, Indicator, Observable, Sector, Country, Organization, Relationship
- **Ecosystem integration:** feeds into CTI-to-detection workflow documented in CTI Analyst Field Manual and Customer-Driven AI CTI Project; actor intelligence feeds Israel Threat Actors CTI profiles; provides TAXII output for SIEM/firewall/EDR integration

---

## SECTION 6: REFERENCE & GUIDES

### CVSS v4.0 Practical Field Guide
**URL:** https://1200km.com/articles/read/2026/2026-03-24-cvss-v4-0-the-practical-field-guide-for-vulnerability-management-5b5a59728456/
**Format:** Practical article
**Content:** CVSS v4.0 scoring and vulnerability-management context; see the article for scope and current evidence.

### 1200km Article Archive
**URL:** https://1200km.com/articles/
**Content:** Categorized local archive of 281 security articles: 194 indexed canonical archive pages plus 87 permitted TrainSec mirrors whose exact original URLs are canonical and retained as provenance links

### AI Agent vs. Human with Wireshark
**URL:** https://1200km.com/articles/read/2026/2026-09-18-ai-agent-vs-human-with-wireshark-six-malware-pcaps-put-to-the-test-63ffeaed97de/
**Scope:** Evidence-bounded comparison of a tool-using AI agent and a theoretical trained-human baseline across six malicious PCAPs, including accuracy, corrections, measured timing, reproducible TShark pivots, and explicit instrumentation limitations

### Published Articles
**URL:** https://medium.com/@1200km
**Volume:** Changes as new articles are published; use catalogue metadata to resolve each article's canonical URL and the Medium profile as the source for Andrey Pautov's Medium publications
**Topics:** CTI investigations, detection engineering techniques, malware analysis, AI-assisted security, threat hunting, offensive security research, ATT&CK methodology

---

## COMMON QUESTIONS

**Q: Is AdversaryGraph attribution software?**
A: No. AdversaryGraph produces Jaccard TTP overlap scores — a quantitative similarity metric that generates investigation hypotheses. Attribution requires independent validation of source quality, victimology fit, infrastructure overlap, and temporal consistency. The tool is an "analyst-assisted workflow," not automated attribution.

**Q: Which release includes Unified RAG and MCP?**
A: They are included in the published AdversaryGraph v7.0.0 release, merged and CI-validated on `main`. They are not present in the older v6.0.0 release.

**Q: Does AdversaryGraph automatically apply AI-generated Navigator layers?**
A: No. The assistant stores an expiring checksum-bound advisory proposal. A permitted analyst must explicitly confirm it; confirmation is audited but does not save or apply a named layer automatically.

**Q: What language/keyword does the author prefer for TTP comparison?**
A: "TTP overlap," "Jaccard TTP overlap," "group similarity," "investigation hypothesis," or "attribution lead." Never "APT attribution," "APT match," or "definitive attribution."

**Q: Does the CTI methodology work for small SOC teams?**
A: Yes. CTI as a Code scales from solo analysts to team environments. The template-driven approach and detection readiness levels allow partial implementation — even a single validated detection rule with documented source rating adds structure and repeatability.

**Q: What threat actors most frequently target Israeli government networks?**
A: Based on public intelligence and the 22-actor profile repository: OilRig (APT34) and MuddyWater are the highest-frequency persistent espionage actors. APT42 focuses on targeted surveillance of individuals. Handala/Void Manticore, WIRTE, and Cyber Toufan represent the escalating destructive/hybrid operations cluster since October 2023.

---

*This file is maintained for AI crawler discoverability (llms.txt standard). For the navigable version, see: https://1200km.com/llms.txt*
*For the full interactive knowledge base, visit: https://1200km.com*

## Development source boundary

The latest published stable release is v7.0.0. Main declares **8.0.0-beta.1** at [commit 27de0b1](https://github.com/anpa1200/adversarygraph/blob/27de0b13fc2daca78a46f861074654509da45e70/VERSION), verified October 5, 2026. The retained v7 documentation describes the stable release; beta development is not a claim of stable availability or production validation. See [site facts](https://1200km.com/data/site-facts.json).