@lovehlmmm/primekit 1.0.0

package/skills/cti-expert/techniques/image-forensics-and-face-search.md

@@ -0,0 +1,224 @@
+# Image Forensics & Face Search Module
+
+> **Module ID:** IMG-FORENS-001
+> **Version:** 1.0.0
+> **Phase:** 5 - Enhancement Modules
+> **Classification:** Image Forensics, Face Recognition & Photo Geolocation
+
+---
+
+## 1. Overview
+
+Image forensics and face recognition for OSINT investigations. Covers reverse image search, face matching across social platforms, manipulation detection via error level analysis, EXIF GPS extraction, and AI-powered photo geolocation. Use when an image is the primary evidence artifact and you need to establish authenticity, origin, subject identity, or capture location.
+
+**Key use cases:** Verifying media authenticity, identifying persons from photographs, geolocating images to physical coordinates, detecting photo manipulation in disinformation campaigns, tracing image provenance.
+
+---
+
+## 2. Tool Inventory
+
+All tools below are free to use with no API key or account required for basic searches.
+
+### 2.1 FaceCheck.id — Face-to-Profile Search
+**URL:** https://facecheck.id/
+
+Upload a face photo to find matching social profiles, blogs, and news articles. Best free face search engine as of 2025 — indexes social media, personal sites, and news sources. Web-based, no install required.
+
+- **Usage:** Upload image via browser or paste URL → results list matching faces with source URLs
+- **Strength:** Cross-platform identity correlation from a single face crop
+- **Limitation:** Requires a clear, front-facing face crop for highest match rate
+
+### 2.2 FotoForensics — Error Level Analysis
+**URL:** https://fotoforensics.com/
+
+Detects image manipulation by analyzing compression artifact inconsistencies (ELA). Web-based, no install.
+
+- **Usage:** Upload image → view ELA heatmap; edited regions show higher error levels than surrounding areas
+- **Strength:** Reliable for detecting JPEG re-saves and pixel-level edits
+- **Limitation:** Only meaningful on JPEG; lossless PNG/BMP require noise analysis instead
+
+### 2.3 Forensically — Digital Forensics Suite
+**URL:** https://29a.ch/photo-forensics/
+
+Browser-based suite providing: clone detection, noise analysis, ELA, luminance gradient, JPEG analysis, magnifier, and metadata viewer. No install, drag-and-drop interface.
+
+- **Usage:** Open in browser → drag image onto canvas → select analysis tool from left panel
+- **Strength:** Clone detection catches copy-paste manipulation that ELA misses
+- **Limitation:** Browser processes locally; large images may be slow on low-spec hardware
+
+### 2.4 picarta.ai — AI Photo Geolocation
+**URL:** https://www.picarta.ai/
+
+AI model predicts where a photo was taken using visual clues (architecture, vegetation, signage, terrain, lighting). Returns predicted GPS coordinates with confidence score.
+
+- **Usage:** Upload photo → receive predicted latitude/longitude + confidence percentage
+- **Strength:** Works on outdoor scenes with distinctive environmental features
+- **Limitation:** Low confidence on indoor, featureless, or heavily cropped images
+
+### 2.5 GeoSpy — AI Location Prediction
+**URL:** https://geospy.web.app/
+
+Alternative AI-powered photo geolocation. Independent model from picarta — run both for cross-validation.
+
+- **Usage:** Upload photo → receive location estimate with map pin
+- **Strength:** Good on urban environments; cross-validates picarta results
+- **Limitation:** Accuracy degrades sharply on rural or non-Western locations
+
+### 2.6 Pic2Map — EXIF GPS Extractor
+**URL:** https://www.pic2map.com/
+
+Extracts GPS coordinates from photo EXIF metadata and displays the result on an interactive map. No install.
+
+- **Usage:** Upload photo → if EXIF GPS data is present, shows exact capture location on map
+- **Strength:** Authoritative if GPS is present — direct device-recorded coordinates
+- **Limitation:** Social media platforms strip EXIF on upload; downloaded images often have no GPS
+
+### 2.7 TinEye — Reverse Image Search
+**URL:** https://tineye.com/
+
+Reverse image search engine. Finds all indexed instances of an image across the web, tracks modifications, and identifies the oldest known publication.
+
+- **Usage:** Upload image or paste URL → results list matching pages sortable by date or image size
+- **Strength:** Best tool for provenance dating — "Oldest" sort finds first appearance
+- **Limitation:** Does not index all web content; absence of result does not confirm originality
+
+---
+
+## 3. Investigation Workflow
+
+```
+Step 1: EXIF extraction — establish metadata baseline
+  └─ Upload to Pic2Map or run exiftool locally
+  └─ If GPS present → geolocate immediately, record coordinates
+  └─ Check DateTimeOriginal, Make/Model, Software fields
+  └─ If Software shows Photoshop/GIMP → flag as post-processed; proceed to Step 5
+
+Step 2: Reverse image search — establish provenance
+  └─ Submit to TinEye; sort results by "Oldest" to find first publication
+  └─ Record earliest date and source URL as provenance anchor
+  └─ If multiple versions exist → crop distinctive background region and re-search
+
+Step 3: Face search — identify subjects (if face visible)
+  └─ Crop face region tightly (eyes/nose/mouth visible)
+  └─ Upload to FaceCheck.id → review matched profiles
+  └─ Cross-reference matched identities with other OSINT subjects in case model
+
+Step 4: AI geolocation — locate capture scene (if location unknown)
+  └─ Submit full image to picarta.ai → record predicted coordinates + confidence
+  └─ Cross-validate with GeoSpy → note agreement or divergence
+  └─ Verify predicted location against Google Street View or Mapillary
+  └─ Low confidence (<50%) → flag as unverified; do not treat as confirmed
+
+Step 5: Manipulation detection — assess authenticity (if authenticity questioned)
+  └─ FotoForensics ELA → bright irregular regions indicate editing
+  └─ Forensically clone detection → repeated texture patches indicate copy-paste
+  └─ Forensically noise analysis → inconsistent noise grain indicates splicing
+  └─ Document each finding with screenshot of analysis output
+```
+
+---
+
+## 4. CLI Commands & Expected Output
+
+```bash
+# EXIF extraction — local (requires exiftool)
+# Install: apt install libimage-exiftool-perl
+exiftool -GPSLatitude -GPSLongitude -GPSAltitude -DateTimeOriginal -Make -Model -Software target.jpg
+
+# Expected output (GPS present):
+# GPS Latitude                    : 48 deg 51' 29.95" N
+# GPS Longitude                   : 2 deg 17' 40.73" E
+# GPS Altitude                    : 35.1 m Above Sea Level
+# Date/Time Original              : 2024:03:15 14:22:07
+# Make                            : Apple
+# Model                           : iPhone 15 Pro
+# Software                        : 17.3.1
+
+# Expected output (GPS stripped):
+# Date/Time Original              : 2024:03:15 14:22:07
+# Make                            : samsung
+# Model                           : SM-G998B
+# Software                        : Adobe Photoshop 25.0 (Windows)
+# (No GPS fields — stripped on upload or disabled at capture)
+
+# Full EXIF dump to JSON
+exiftool -json target.jpg > target_exif.json
+
+# Strip EXIF before sharing (privacy)
+exiftool -all= -o clean_output.jpg target.jpg
+
+# Batch process a directory
+exiftool -r -GPSLatitude -GPSLongitude /path/to/images/
+```
+
+---
+
+## 5. Analysis & Interpretation Guidance
+
+### ELA Interpretation
+Error Level Analysis re-saves the image at a known compression level and computes the difference from the original. Regions that were edited (then re-saved) show higher residual error — appearing brighter in the ELA heatmap.
+
+| ELA Pattern | Interpretation |
+|-------------|---------------|
+| Uniform brightness across entire image | Likely original, single-save |
+| Isolated bright patches on faces/objects | Probable element insertion or removal |
+| Bright rectangular block | Cropped and re-pasted region |
+| Uniform bright overlay on whole image | Heavy re-compression; ELA inconclusive |
+| Text with different brightness from background | Text added in post-processing |
+
+**Caution:** ELA is not definitive proof. Multiple JPEG saves (WhatsApp, social media re-upload) produce bright regions without manipulation. Combine with clone detection and provenance for a confident verdict.
+
+### Clone Detection Interpretation
+Clone detection finds copy-pasted regions within the same image — a technique used to add, remove, or duplicate objects.
+
+- Highlighted overlapping regions with connecting lines = copy-paste detected
+- Common use: duplicating crowd to appear larger, removing objects, filling gaps after deletion
+
+### AI Geolocation Confidence Tiers
+
+| Confidence | Action |
+|-----------|--------|
+| >80% | Treat as probable location; verify via Street View |
+| 50–80% | Cross-validate with second tool (GeoSpy) |
+| <50% | Flag as unverified; note in findings |
+| Both tools agree within 10km | Elevate to HIGH confidence |
+| Tools diverge >50km | Treat as unresolved; note both estimates |
+
+### EXIF Software Field Indicators
+
+| Software Value | Interpretation |
+|---------------|---------------|
+| Camera firmware (e.g., `v1.4`) | Likely unmodified |
+| `Adobe Photoshop` | Post-processed |
+| `GIMP` | Post-processed (open source) |
+| `Affinity Photo` | Post-processed |
+| `WhatsApp` | Re-encoded by app; EXIF likely stripped |
+| Absent | Stripped — could be intentional or social media upload |
+
+---
+
+## 6. Confidence Ratings
+
+| Finding | Confidence | Notes |
+|---------|-----------|-------|
+| EXIF GPS coordinates | HIGH | Device-recorded; verify not spoofed |
+| TinEye provenance date | HIGH | Indexed crawl timestamp |
+| FaceCheck.id match | MEDIUM-HIGH | Depends on face quality and index coverage |
+| ELA manipulation evidence | MEDIUM | Inconclusive without corroboration |
+| AI geolocation >80% | MEDIUM | Visual inference; verify against Street View |
+| AI geolocation <50% | LOW | Directional only; do not treat as confirmed |
+| Clone detection finding | HIGH | Mathematical pattern match |
+
+---
+
+## 7. Related Techniques
+
+- [fx-image-verification.md](fx-image-verification.md) — Sun/shadow analysis and reverse search provenance workflow
+- [fx-metadata-parsing.md](fx-metadata-parsing.md) — Full EXIF field reference and extraction
+- [fx-geolocation.md](fx-geolocation.md) — Convert extracted GPS coordinates to location intelligence
+- [advanced-geolocation-techniques.md](advanced-geolocation-techniques.md) — Landmark-based manual geolocation
+
+---
+
+*Image Forensics & Face Search Module v1.0.0*
+*Part of CTI Expert Skill - Phase 5 Enhancement Modules*

package/skills/cti-expert/techniques/incident-triage.md

@@ -0,0 +1,197 @@
+# Incident Triage Module
+
+> **Module ID:** INC-TRI-001
+> **Version:** 1.0.0
+> **Phase:** 5 - Enhancement Modules
+> **Classification:** Security Incident Response & Evidence Preservation
+
+---
+
+## 1. Overview
+
+Guides rapid triage and initial response to security incidents following NIST SP 800-61 methodology. Covers classification, containment, evidence preservation (order of volatility), initial analysis, and IOC extraction.
+
+**When to use:** Active security incident, breach investigation, compromised system analysis, malware detection, or suspicious activity requiring immediate response.
+
+**Ethical boundary:** Focus on defense and containment. Never recommend counter-attacks or evidence tampering.
+
+---
+
+## 2. Tool Inventory
+
+| Priority | Tool | Purpose | Install |
+|----------|------|---------|---------|
+| Primary | `ps`, `ss`, `who`, `lsof` | Volatile evidence capture (Linux) | Built-in |
+| Primary | `journalctl` | System log analysis | Built-in (systemd) |
+| Primary | `tasklist`, `netstat`, `query user` | Volatile evidence capture (Windows) | Built-in |
+| Secondary | LiME | Linux memory dump | `git clone https://github.com/504ensicsLabs/LiME` |
+| Secondary | WinPmem | Windows memory dump | Download from GitHub releases |
+| Tertiary | YARA | IOC pattern matching | `apt install -y yara` |
+
+---
+
+## 3. Priorities (Strict Order)
+
+1. **Preserve human safety**
+2. **Contain the incident** to prevent further damage
+3. **Preserve evidence** for investigation
+4. **Identify root cause** and scope
+5. **Document everything**
+
+**CRITICAL: Do NOT power off systems.** Volatile memory contains evidence.
+
+---
+
+## 4. Investigation Workflow
+
+```
+1. Classify — determine incident type and severity
+2. Contain — network block, host isolation, account disable (NOT power off)
+3. Preserve — capture volatile evidence in order of volatility
+4. Analyze — process trees, network indicators, file indicators, logs, persistence
+5. Extract IOCs — IPs, domains, hashes, file paths, emails, URLs, user agents
+6. Document — structured triage report with timeline
+7. Escalate — management, legal, law enforcement if applicable
+```
+
+---
+
+## 5. Incident Classification
+
+### Type
+| Type | Examples |
+|------|---------|
+| Malware | Ransomware, trojan, worm, cryptominer |
+| Unauthorized access | Compromised credentials, exploitation |
+| Data exfiltration | Data theft, insider threat |
+| Denial of service | DDoS, resource exhaustion |
+| Web compromise | Defacement, skimming, backdoor |
+| Phishing / social engineering | Credential harvesting, BEC |
+
+### Severity
+| Level | Criteria |
+|-------|---------|
+| Critical | Active data exfiltration, ransomware spreading, critical system compromise |
+| High | Confirmed compromise, malware detected, unauthorized access |
+| Medium | Suspicious activity, potential indicators, failed attacks |
+| Low | Policy violation, reconnaissance detected, likely false positive |
+
+---
+
+## 6. Containment Actions
+
+| Vector | Action |
+|--------|--------|
+| Network | Block suspicious IPs/domains at firewall |
+| Host | Isolate affected system (network disconnect, NOT power off) |
+| Account | Disable compromised accounts, force password resets |
+| Application | Disable affected service if safe to do so |
+
+---
+
+## 7. Evidence Preservation (Order of Volatility)
+
+Capture most volatile first:
+
+```bash
+# 1. Running processes
+ps auxf                         # Linux
+tasklist /v                     # Windows
+
+# 2. Network connections
+ss -tupn                        # Linux
+netstat -anob                   # Windows
+
+# 3. Logged-in users
+who -a                          # Linux
+query user                      # Windows
+
+# 4. Open files
+lsof -nP                        # Linux
+
+# 5. System logs
+journalctl --since "1 hour ago" # Linux/systemd
+# Windows: Event Viewer export
+```
+
+If memory forensics tools available (LiME, WinPmem), capture memory dump **before anything else**.
+
+---
+
+## 8. Analysis Checklist
+
+| Area | What to Check |
+|------|--------------|
+| Process tree | Unusual process names, paths, parent-child relationships |
+| Network | Unusual outbound connections, suspicious DNS, beaconing patterns |
+| Files | Recently modified in unusual locations, hidden files, new executables |
+| Logs | Auth failures, privilege escalation, service changes, cleared logs |
+| Persistence | Crontab, systemd units, registry Run keys, scheduled tasks, startup items |
+
+---
+
+## 9. IOC Extraction
+
+| IOC Type | Examples |
+|----------|---------|
+| IP addresses | Source and destination IPs |
+| Domains | C2 domains, phishing domains |
+| File hashes | MD5 and SHA256 of suspicious files |
+| File paths | Malware locations, dropped files |
+| Email addresses | Phishing sender addresses |
+| URLs | Malicious URLs, C2 endpoints |
+| User agents | Unusual or known-malicious user agents |
+
+---
+
+## 10. Output Format
+
+```markdown
+# Incident Triage Report
+## Incident ID: [ID]
+## Date/Time: [UTC]
+## Severity: [Critical/High/Medium/Low]
+## Classification: [incident type]
+## Status: [Triage/Contained/Analyzing/Resolved]
+
+### Summary
+[2-3 sentence overview]
+
+### Affected Systems
+| Hostname | IP | Role | Status |
+|----------|-----|------|--------|
+
+### Timeline
+| Time (UTC) | Event | Source | Notes |
+|------------|-------|--------|-------|
+
+### Indicators of Compromise
+| Type | Value | Context | Confidence |
+|------|-------|---------|------------|
+
+### Containment Actions Taken
+- [ ] [Action and result]
+
+### Evidence Preserved
+| Type | Location | Hash | Notes |
+|------|----------|------|-------|
+
+### Recommended Next Steps
+1. [Immediate priority]
+2. [Short-term action]
+3. [Follow-up investigation]
+
+### Escalation Checklist
+- [ ] Management notified
+- [ ] Legal notified (if data breach)
+- [ ] Law enforcement (if applicable)
+- [ ] Affected parties notified (if data breach)
+```
+
+---
+
+## 11. References
+
+- NIST SP 800-61r2: Computer Security Incident Handling Guide
+- SANS Incident Handler's Handbook
+- MITRE ATT&CK Framework

package/skills/cti-expert/techniques/ioc-export.md

@@ -0,0 +1,176 @@
+# IOC Export
+
+Spec for exporting Indicators of Compromise (IOCs) from a case in machine-readable formats for threat intel sharing and tooling ingestion.
+
+---
+
+## Command
+
+```
+/report ioc [--format stix|flat|csv]
+```
+
+**Options:**
+
+| Option | Default | Description |
+|--------|---------|-------------|
+| `--format stix` | — | STIX 2.1 JSON bundle |
+| `--format flat` | — | One IOC per line with type prefix |
+| `--format csv`  | — | Structured CSV with metadata fields |
+
+Default format when `--format` is omitted: `flat`.
+
+---
+
+## IOC Type Mapping
+
+Subjects and findings are mapped to STIX 2.1 SCO (Cyber Observable) types:
+
+| Internal Type   | STIX 2.1 Type   | Flat Prefix | Notes |
+|-----------------|-----------------|-------------|-------|
+| NETWORK_ADDR    | `ipv4-addr`     | `ip:`       | IPv6 maps to `ipv6-addr` |
+| DOMAIN          | `domain-name`   | `domain:`   | |
+| URL             | `url`           | `url:`      | |
+| EMAIL           | `email-addr`    | `email:`    | |
+| FILE_HASH_MD5   | `file` (hashes.MD5) | `md5:` | |
+| FILE_HASH_SHA1  | `file` (hashes.SHA-1) | `sha1:` | |
+| FILE_HASH_SHA256 | `file` (hashes.SHA-256) | `sha256:` | |
+| USERNAME        | — (custom)      | `handle:`   | Not a native STIX SCO; use `x-osint-handle` extension |
+
+Only subjects with `confidence >= 60` and `verified = true` are included by default. Pass `--min-confidence <n>` to override.
+
+---
+
+## STIX 2.1 Bundle Template
+
+```json
+{
+  "type": "bundle",
+  "id": "bundle--{uuid4}",
+  "spec_version": "2.1",
+  "objects": [
+    {
+      "type": "identity",
+      "spec_version": "2.1",
+      "id": "identity--{uuid4}",
+      "created": "{ISO-8601}",
+      "modified": "{ISO-8601}",
+      "name": "cti-expert case {CASE_ID}",
+      "identity_class": "system"
+    },
+    {
+      "type": "ipv4-addr",
+      "spec_version": "2.1",
+      "id": "ipv4-addr--{uuid4}",
+      "value": "{ip_address}"
+    },
+    {
+      "type": "domain-name",
+      "spec_version": "2.1",
+      "id": "domain-name--{uuid4}",
+      "value": "{domain}"
+    },
+    {
+      "type": "url",
+      "spec_version": "2.1",
+      "id": "url--{uuid4}",
+      "value": "{url}"
+    },
+    {
+      "type": "email-addr",
+      "spec_version": "2.1",
+      "id": "email-addr--{uuid4}",
+      "value": "{email}"
+    },
+    {
+      "type": "file",
+      "spec_version": "2.1",
+      "id": "file--{uuid4}",
+      "hashes": {
+        "SHA-256": "{hash_value}"
+      },
+      "name": "{filename_if_known}"
+    },
+    {
+      "type": "indicator",
+      "spec_version": "2.1",
+      "id": "indicator--{uuid4}",
+      "created": "{ISO-8601}",
+      "modified": "{ISO-8601}",
+      "created_by_ref": "identity--{identity_uuid}",
+      "name": "{indicator_label}",
+      "pattern": "[{stix_type}:value = '{ioc_value}']",
+      "pattern_type": "stix",
+      "valid_from": "{first_seen_ISO}",
+      "confidence": {confidence_0_100},
+      "labels": ["{finding_type}", "{weight_lower}"]
+    }
+  ]
+}
+```
+
+One `indicator` object is generated per IOC, referencing the corresponding SCO via `pattern`.
+
+---
+
+## Flat IOC List Template
+
+One IOC per line. Format: `{prefix}:{value}` — compatible with most SIEM ingest pipelines.
+
+```
+# cti-expert IOC export — Case: {CASE_ID} — {YYYY-MM-DD}
+# Fields: type:value
+ip:203.0.113.45
+ip:198.51.100.12
+domain:malicious-example.net
+domain:c2.attacker-infra.io
+url:https://malicious-example.net/payload.php
+email:phishing@spoofed-domain.com
+md5:d41d8cd98f00b204e9800998ecf8427e
+sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
+handle:threat_actor_handle
+```
+
+---
+
+## CSV Template
+
+```csv
+type,value,first_seen,last_seen,confidence,source
+ip,203.0.113.45,2026-01-15T08:00Z,2026-03-20T14:30Z,85,FND-012
+domain,malicious-example.net,2026-01-10T00:00Z,,90,FND-008
+url,https://malicious-example.net/payload.php,2026-02-01T12:00Z,,75,FND-015
+email,phishing@spoofed-domain.com,2026-01-20T09:00Z,2026-03-01T00:00Z,80,FND-003
+sha256,e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855,2026-02-14T00:00Z,,70,FND-021
+```
+
+**Column definitions:**
+
+| Column | Source | Notes |
+|--------|--------|-------|
+| `type` | IOC type mapping table above | flat prefix value |
+| `value` | subject.value | normalized |
+| `first_seen` | finding.collected_at or subject.first_seen | ISO-8601 |
+| `last_seen` | most recent finding using this IOC | ISO-8601; blank if unknown |
+| `confidence` | subject.confidence | 0–100 |
+| `source` | finding.id that introduced this IOC | `FND-NNN` |
+
+---
+
+## Output Files
+
+Auto-saved alongside the case report per `output/reports/export-specs.md` auto-save rule:
+
+```
+IOC-{CASE_ID}-{YYYY-MM-DD}.stix.json   # STIX bundle
+IOC-{CASE_ID}-{YYYY-MM-DD}.txt         # flat list
+IOC-{CASE_ID}-{YYYY-MM-DD}.csv         # CSV
+```
+
+---
+
+## Cross-References
+
+- `output/reports/export-specs.md` — IOC format row in format options table
+- `engine/subject-registry.md` — subject type definitions and confidence fields
+- `engine/finding-framework.md` — finding types used as STIX indicator labels

package/skills/cti-expert/techniques/microsoft-tenant-recon.md

@@ -0,0 +1,86 @@
+# microsoft-tenant-recon
+
+## Purpose
+Unauthenticated Microsoft 365 / Azure tenant enumeration from a bare domain. Surfaces tenant ID, federation posture, SharePoint/Azure App Service presence, and Microsoft Defender for Identity (MDI) footprint — identity-layer intel that DNS/WHOIS recon misses.
+
+## Quick Reference
+| Item | Detail |
+|------|--------|
+| Command | `/msftrecon [domain]` |
+| Input | Domain hosted (even partially) on Microsoft 365 |
+| Output | Tenant name + ID (GUID), federation type, brand, cloud instance, MDI/SharePoint/Azure flags |
+| Confidence | HIGH for server-returned fields (tenant ID, openid-configuration); MEDIUM for heuristic checks (MDI, SharePoint) |
+| Auto-fires (in `/case`) | When domain MX ends in `protection.outlook.com` OR SPF contains `spf.protection.outlook.com` |
+| Severity | MEDIUM (tenant intel) · HIGH if MDI absent (indicates weaker identity-threat detection posture) |
+
+## Methodology
+1. Pre-check MX + SPF to confirm M365 hosting; skip tool if no match (no wasted calls).
+2. Run `msftrecon -d {domain} -j` — JSON output for easy parsing into the finding registry.
+3. Enumerate the 7 endpoints below; record success/failure per endpoint as evidence chain entries.
+4. Derive cloud instance: commercial (`microsoftonline.com`) / US gov (`microsoftonline.us`) / China (`microsoftonline.cn`).
+5. Capture tenant ID (GUID) — pivot seed for `/branch` in Enrich phase (map other domains under the same tenant).
+6. Log federation type; if `Federated`, flag the federation provider (AD FS, Okta, Ping, etc.) as a SAML/IdP attack surface for `/threat-model`.
+7. Flag MDI absence as elevated risk; tenant without Defender for Identity → weaker credential-theft detection.
+
+## Endpoints Queried
+| # | Endpoint | Purpose |
+|---|----------|---------|
+| 1 | `https://login.microsoftonline.com/getuserrealm.srf?login=user@{domain}&json=1` | Federation type (Managed / Federated / Unknown), brand name, federation provider |
+| 2 | `https://login.microsoftonline.com/{domain}/v2.0/.well-known/openid-configuration` | Tenant ID (GUID) via `issuer` field, authorization/token endpoints, cloud instance |
+| 3 | `https://{tenant}.sharepoint.com` | SharePoint tenant existence (401/403 = present, 404 = absent) |
+| 4 | `https://{tenant}.azurewebsites.net` | Azure App Service tenant existence |
+| 5 | DNS MX / TXT | M365 indicators (`protection.outlook.com`, `spf.protection.outlook.com`, `MS=ms…`) |
+| 6 | Autodiscover CNAME (`autodiscover.{domain}`) | Exchange config trail; often points to `autodiscover.outlook.com` for M365 |
+| 7 | MDI heuristic (tenant DNS probe) | Microsoft Defender for Identity instance — looks up `{tenant}.atp.azure.com` / sensor names |
+
+## Output Fields to Capture
+- **Tenant name** — friendly tenant prefix (e.g., `contoso`)
+- **Tenant ID (GUID)** — unique Azure identifier
+- **Federation type** — `Managed` · `Federated` · `Unknown`
+- **Federation provider** — if Federated (AD FS / Okta / Ping / …)
+- **Brand name** — tenant display name
+- **Cloud instance** — `microsoftonline.com` · `microsoftonline.us` (gov) · `microsoftonline.cn`
+- **MDI present** — Yes / No (heuristic)
+- **SharePoint accessible** — Yes / No
+- **Azure App Service exists** — Yes / No
+- **Autodiscover CNAME target** — hostname string
+
+## Tools & Fallbacks
+1. **Primary:** `msftrecon -d {domain} -j` (JSON; auto-installed via `pip install git+https://github.com/Arcanum-Sec/msftrecon.git`).
+2. **Fallback 1 — direct curl (trivial to script):**
+   ```bash
+   curl -s "https://login.microsoftonline.com/getuserrealm.srf?login=user@{domain}&json=1"
+   curl -s "https://login.microsoftonline.com/{domain}/v2.0/.well-known/openid-configuration"
+   curl -I "https://{tenant}.sharepoint.com"
+   curl -I "https://{tenant}.azurewebsites.net"
+   ```
+3. **Fallback 2 — manual DNS:** `dig MX {domain}`, `dig TXT {domain}`, `dig CNAME autodiscover.{domain}`.
+
+## CLI Variants
+| Flag | Purpose |
+|------|---------|
+| `-d {domain}` | Target domain |
+| `-j` | JSON output (mandatory for `/case` parsing) |
+| `--gov` | US government cloud (`microsoftonline.us`) |
+| `--cn` | China cloud (`microsoftonline.cn`) |
+
+## Integration into `/case`
+- **Trigger:** Acquire phase. Auto-fires when domain MX ends in `protection.outlook.com` OR SPF TXT contains `spf.protection.outlook.com`. No user flag required.
+- **Finding type:** `infrastructure`.
+- **Severity:** MEDIUM by default. Escalate to HIGH when `MDI present = No` (weaker detection posture) or federation provider is an unpatched / EOL IdP.
+- **Pivots fed to Enrich phase:**
+  - **Tenant ID → `/branch`** — query for other domains under the same tenant (shared org footprint).
+  - **Federation provider → `/threat-model`** — maps IdP as SSO attack surface.
+  - **SharePoint URL → `/sweep`** — can surface public sites/documents.
+
+## Limitations
+- Only covers M365-hosted domains — roughly 50% of enterprise, but 0% of Google Workspace / self-hosted mail.
+- Federation detection can be obscured by tenant-side config (home realm discovery policies, conditional access).
+- MDI detection is heuristic — false negatives are possible when tenants use non-default sensor naming.
+- No auth = no deep IAM / Entra ID graph data; pair with `techniques/cloud-audit.md` if target engagement has authorized access.
+
+## Related Techniques
+- `techniques/cloud-audit.md` — account-level AWS/GCP/Azure audit (complementary, needs creds).
+- `techniques/fx-email-header-analysis.md` — SPF/DKIM/DMARC overlap; the same MX/SPF signals that trigger msftrecon also drive email-auth verdicts.
+- `techniques/domain-advanced.md` — subdomain enumeration; SharePoint/Azure subdomains often surface here too.
+- `techniques/fx-dns-cert-history.md` — historical MX/TXT changes reveal M365 migration events and prior tenant IDs.