PRIVILEGE DISRUPTION
The Cyber Prologue

Doctrine Lens · CP-002

What Taiwan Agentic makes visible

The canonical case record remains governed by its CP identifiers, evidence bands, ownership boundaries, and source discipline. This layer connects those findings to the Privilege Disruption Doctrine of Record without changing the evidence.

PD-P05

AI Accelerates

The multi-agent framework changed speed, parallelism, search, and adaptation. It did not create the target estate's privilege.

PD-P03

Privilege → Authority

Debug endpoints, live credentials, and upload paths converted requests or access into authenticated and write authority.

PD-P06

Dependency

Multiple independent conversion paths show how privilege connected initial access to consequential action.

PD-P07

Debt is Leverage

The case is concentrated in standing and credential debt: existing authority was found quickly and spent in parallel.

PD-P04

Actor-Agnostic

The authority model still holds when the operating mechanism on the threat-actor side is agentic.

CASE AUTHORITY PATHPublic Artifact → Application → Identity → Internal Systems
PD-P05 AI AcceleratesPD-P03 Privilege → AuthorityPD-P07 DebtPD-P04 Actor-Agnostic
View Foundational PrinciplesBrowse Attack Stories

The Doctrine Lens preserves a key distinction in the case record: the attacker was agentic, but the victim's documented authority supply was not itself agentic debt.

← All Attack Stories
Case thesis

The prologue is what was already true. The attack story is the adversary spending it. The chokepoint is where spending it could have been stopped.
Evidence discipline

The band reflects the source, not the stakes

Prologue records carry four bands describing how strongly the source establishes a pre-existing condition.

Attack story records carry three bands and point back to the prologue conditions the source supports.

No anchor is a valid state. It is counted, not filled in.

“Every cyberattack has a prologue, hunting in it is responsive cyber defense.”

University IT Security Director
Evidence family 1

Prologue catalog

Conditions present in the estate before the campaign realized them. Written by configuration, lifecycle and architecture decisions, not by the adversary. Spent by counts the documented behaviors that draw on each condition. A zero there is not an error. It marks a condition the source establishes independently of any behavior it documents, which is what keeps this catalog from being the attack story read backwards.

IDBandConditionDebtPlaneSpent by
Evidence family 2

Attack story catalog

Adversary behavior documented by the source, each pointing back to the prologue conditions it spent. Records with no source-supported anchor are marked and counted rather than assigned one.

IDBandBehaviorPD QTacticATT&CKAnchors
Invariant analysis

The three questions

Case-invariant. Every case in the collection answers these.
Chokepoint

Case finding

Collection methodology

Privilege debt

Six categories, always rendered

Counts are of prologue records, not of instances in the estate.

Empty categories are data. A category reading zero in this case is a finding about the campaign and the source, and it is what makes counts comparable across the collection.

Detection posture

Established by the primary source

    Not established by the primary source

    Case-specific rendering

    Privilege planes and plane jumps

    Select a plane to see the records that touch it.

    Plane jump. A case-specific visualization of execution authority changing domains as the adversary converts one form of inherited authority into another. It is a rendering of execution authority geometry, not a doctrinal entity. Planes are chosen to fit this estate. A cloud, SaaS, OT or agentic case will render its own geometry against the same invariant spine.

    Defender operating cycle

    Govern, hunt, disrupt, retire

    Each phase names the prologue records it acts on.
    Govern the acceptable prologue. Hunt the actual one. Disrupt the conversion. Retire the debt that wrote it.
    Method

    Bands, rules and sources

    Prologue evidence bands
    Attack story evidence bands
    Standing rules
      Source families
      Continue the collection

      Related Cyber Prologue stories

      CP-001Salt TyphoonA network campaign where authority moves across multiple privilege planes.CP-003Hugging FaceAn autonomous agent composes authority across several estates.