PRIVILEGE DISRUPTION
The Cyber Prologue

Doctrine Lens · CP-001

What Salt Typhoon makes visible

The case record remains governed by its CP identifiers and evidence bands. This layer connects those findings to the Privilege Disruption Doctrine of Record without changing the underlying evidence.

PD-C02

Execution Authority

Device execution, authentication, privileged management, network-control and cross-domain authority appear as distinct planes.

PD-P03

Privilege → Authority

Root-level device authority and recovered credentials become usable administrative and network-control authority.

PD-P06

Dependency

The case makes the conversion from access through privilege into persistence, escalation and lateral reach visible.

PD-P07

Debt is Leverage

Pre-existing credentials, shared secrets and trusted relationships supply authority the adversary did not have to manufacture.

PD-P10

Reach + Recurrence

Created administrative accounts and pre-existing cross-domain relationships show how authority can persist and extend beyond one device.

CASE AUTHORITY PATHNetwork → Identity → Privileged Management → Network Control → Cross-Domain
PD-C02 Execution AuthorityPD-P03 Privilege → AuthorityPD-P07 DebtPD-P10 Reach + Recurrence
View Foundational PrinciplesBrowse Attack Stories
← All Attack Stories
Case thesis

The prologue is what was already true. The attack story is the adversary spending it. The chokepoint is where spending it could have been stopped.
Evidence discipline

The band reflects the source, not the stakes

Prologue records carry four bands describing how strongly the source establishes a pre-existing condition.

Attack story records carry three bands and point back to the prologue conditions the source supports.

No anchor is a valid state. It is counted, not filled in.

“Every cyberattack has a prologue, hunting in it is responsive cyber defense.”

University IT Security Director
Evidence family 1

Prologue catalog

Conditions present in the estate before the campaign realized them. Written by configuration, lifecycle and architecture decisions, not by the adversary. Spent by counts the documented behaviors that draw on each condition. A zero there is not an error. It marks a condition the source establishes independently of any behavior it documents, which is what keeps this catalog from being the attack story read backwards.

IDBandConditionDebtPlaneSpent by
Evidence family 2

Attack story catalog

Adversary behavior documented by the source, each pointing back to the prologue conditions it spent. Records with no source-supported anchor are marked and counted rather than assigned one.

IDBandBehaviorPD QTacticATT&CKAnchors
Invariant analysis

The three questions

Case-invariant. Every case in the collection answers these.
Chokepoint

Case finding

Collection methodology

Privilege debt

Six categories, always rendered

Counts are of prologue records, not of instances in the estate.

Empty categories are data. A category reading zero in this case is a finding about the campaign and the source, and it is what makes counts comparable across the collection.

Detection posture

Established by the primary source

    Not established by the primary source

    Case-specific rendering

    Privilege planes and plane jumps

    Select a plane to see the records that touch it.

    Plane jump. A case-specific visualization of execution authority changing domains as the adversary converts one form of inherited authority into another. It is a rendering of execution authority geometry, not a doctrinal entity. Planes are chosen to fit this estate. A cloud, SaaS, OT or agentic case will render its own geometry against the same invariant spine.

    Defender operating cycle

    Govern, hunt, disrupt, retire

    Each phase names the prologue records it acts on.
    Govern the acceptable prologue. Hunt the actual one. Disrupt the conversion. Retire the debt that wrote it.
    Method

    Bands, rules and sources

    Prologue evidence bands
    Attack story evidence bands
    Standing rules
      Source families
      Continue the collection

      Related Cyber Prologue stories

      CP-002Taiwan AgenticAI accelerates the discovery and consumption of existing privilege.CP-003Hugging FaceComposition turns legitimate capabilities into broader authority.