Unit 02 of 03
Analysis Tools
Measuring the gap between a candidate and an evidenced finding produced by traffic, request, and file-analysis tools: which field in packet capture is direct evidence, which is inference, and which is a spoofable claim; how protocol analyzers leave only metadata in an encrypted flow; how many requests and which risk class intercepting-proxy validation requires; the suppressed behavior in sandbox analysis; the false-positive rate of the majority decision in multi-engine reputation services; what exploitation frameworks can and cannot prove; and the skill that legal practice labs do not cover.
Published Updated
Lessons
- 01 Packet Capture and Analysis Measuring the evidentiary value of captured traffic: 10 flows from 24 fictional packets, 18, 44, and 85 claim candidates at three capture points, 50 of the 85 candidates at the core mirror turning out to be evidence and 7 spoofable, low-value claims being proven at a rate of 20/20 while high-value claims are proven at only 10/25, and passive capture leaving zero records on the target while requiring one configuration change. 14 min read
- 02 Protocol Analyzers Measuring application-layer inspection in terms of visibility: only 16 of the 30 application fields defined across ten flows can be read, two flows are mislabeled by an analyzer that looks at the transport number, 43 of 91 claim candidates are evidence and 48 are inference drawn from metadata, three of five encrypted flows have in-org access to key material, and passive analysis leaves zero records on the target. 13 min read
- 03 Request Manipulation Measuring intercepting-proxy request manipulation as a validation step: 18 candidates' 40 planned requests, 6 candidates decided with observation-only requests producing zero alerts, 14 candidates decided under the broadest rule set producing 16 alerts, the number of requests to an out-of-scope target staying at zero across all three rule sets, and two candidates that are actually open being unprovable under any rule set. 14 min read
- 04 Sandbox Analysis Measuring sandbox analysis in terms of suppressed behavior: 5 of 14 items noticing the environment on a stock image and not showing their decisive behavior, the number of resolved items rising from 7 to 12 while total time rises from 288 minutes to 965 minutes, one environment hint being impossible to hide in any environment, and analysis leaving zero records on the target while dropping a trace on the other side. 14 min read
- 05 File and Link Reputation Services Measuring the combination of multi-engine reputation results: recall falling from 92 percent to 8 percent as the majority threshold rises across 24 items and 12 engines, precision instead rising from 50 percent to 86 percent at the seventh threshold and then returning to 50 percent, the majority decision within a single engine family turning out identical to picking a single engine, 10 of the 24 items never being queryable at all because of the privacy limit, and every query leaving a trace on the other side. 14 min read
- 06 Exploitation Frameworks Measuring an exploitation framework strictly by its validation limit: of 16 candidates 9 are actually open while only 3 turn into evidence, only one of four validation options has a negative result that shows the vulnerability's absence, two of the three candidates that come back negative are actually open, three candidates get wrongly closed if negative and weak results are counted as closure grounds, and two targets are never touched at all because of scope. 14 min read
- 07 Test Distributions and Labs Measuring legal practice labs in terms of scope: 13 of the 18 skill items produced by the topic's six lessons are covered by the union of three lab types, no single type exceeds 10, a security-focused test distribution covers zero skills on its own, and the five uncovered items stem from the absence of a real record and real risk. 14 min read