Indicators rotate.
Actors don't.

A structural grammar for adversary infrastructure, positioned between short-lived IOCs and the deliberately abstract ATT&CK. Five layers: Entities (raw observation) to Relations to Roles (5 types: entry, redirector, staging, payload, c2) to Techniques (26, across 5 categories: Hosting, Resolution, Routing, Gating, Composition) to Chains and Patterns. Complementary to ATT&CK, to STIX 2.1 (lossless export) and to the Diamond Model, for which it supplies the missing grammar for the Infrastructure vertex. Technique catalog v1.0 released.

GhostShell (MB-0009): a standalone EC-P-256 mTLS implant with per-implant client certificates and a self-named CA, tracked after publication by Zscaler ThreatLabz and the Belgian CCB. IIM techniques also carry longitudinal cases such as Gamaredon’s BITS-downloading (MB-0001) and the GIFTEDCROOK tooling evolution across UAC-0226 (MB-0004).

A query language for IIM data, drawing on Cypher's graph pattern matching and SQL's filtering, built for the IIM v1.1 data model: MATCH (e:entry)-[:download]->(s:staging)-->(p:payload)-[:connect]->(c:c2) WHERE ... RETURN ... Ships as CLI, REPL and Python API, with no runtime dependencies beyond stdlib. 25 end-to-end tests.

Six dimensions of evidence, weighted by forgeability rather than treated as equal: Technical (easiest to fake) to Infrastructure to Linguistic to Behavioral to Operational to Strategic (hardest to fake: cui bono). A divergence between surface and deep dimensions reads as a false-flag signal, not noise to discard.

Sits above ATT&CK, NIST CSF and FAIR: takes their output and produces a reasoned order for which control comes first, against a specific actor. Four axes (ADV, IRR, CC, DDT), weighted per actor rather than generically. A worked example against a Sandworm profile puts immutable backups in Tier 1 and awareness training in Tier 4, against that actor, not in general.