How It Works
Start with what an action needs, what happens and what changes. MC makes that description explicit so people and tools can examine the same behavior, evidence and defensive questions.
In ShieldBreak (CVE-2026-69414), a Microsoft Defender flaw, attacker code already runs as an ordinary Windows user. Security software checks an attacker-supplied file with elevated privileges, detects contents that trigger cleanup, then reads different contents during that cleanup. MC records this content substitution as action M3.
Attacker code runs as an ordinary user. The attacker controls the function that supplies file contents when Windows requests them, the scanner is attending to the file, and the software uses the later contents without rechecking them.
The attacker serves different bytes when the engine reads the file during cleanup.
The privileged process now consumes attacker-controlled input. In the fuller model, content substitution (M3) and write redirection (M4) jointly contribute to the final execution action (M5). The sources report code running as SYSTEM, a Windows account with broad computer-level privileges.
MC calls these the requirements, mechanism and postconditions of a maneuver. Naming them separately helps expose what to investigate: which condition is needed, which observation could reveal the change, and where a defense could act.
For prevention or response, ask what would keep the later read tied to the checked contents. For detection, ask which observation would distinguish the checked contents from the bytes the engine consumed. The prepared Explorer lets you remove the content contribution and inspect the actions that depend on it.
Inspect content substitution and its sources · Read its formal record · Follow the archived evidence
The case uses archival source 0.4.0, dated 5 September 2026, and local revision local-draft-3. Its requirements and the joint necessity of content substitution (M3) and write redirection (M4) are inferred from the records and untested. The relative order of those two actions is unspecified. The specification and ontology bindings are provisional. The Explorer applies prepared dependency rules to your chosen scenario.
MC describes security behavior through conditions, mechanisms and resulting states. It also describes how prevention, detection and response relate to those actions. This gives analysis a common vocabulary across reports, observations and tests.
The reference design retains sources, claims and their qualifications alongside accepted revisions of the model. For content substitution (M3), that means keeping the report, the interpretation of its content change, and later challenges or corrections available for comparison.
A semantic compiler checks structured inputs against selected contracts and computes the consequences those contracts support. The system then makes a separate admission decision about accepting a revision. The source, computation and accepted state can each be inspected.
The 5 October 2026 development snapshot documents a bounded path through source custody, compilation, admission, retained revisions and queries. Its probes record failures in temporal/context handling, native identity joins and measured-evidence carriage. Those failures identify specific requirements for the next implementation work.
The native compiler implements selected contracts. Ontology RDF-rule execution, complete specification conformance, general planning, belief closure and governed external actions remain further implementation and research work. The wider architecture is the reference design for that work.