Research in development
How can security teams compare actions, test defensive ideas and revise conclusions as evidence changes? MC investigates a common description of behavior and a system that retains the reasoning behind it.
ShieldBreak and RoguePlanet change different values between a check and privileged use. Comparing their conditions and mechanisms identifies what a test on one variation would need to establish before its result could apply to another.
Contribution to examine: an explicit comparison of file contents, object paths and folder junctions, with each variation's requirements preserved.
An observation has a scope, a time and a collection context. Research asks how a conclusion should retain those qualifications when it combines evidence or follows a chain of actions.
Contribution to examine: a way to relate an action's conditions and effects to the evidence a detector or investigator would need.
A useful evaluation compares a specific task with and without the structured model. The task might involve choosing a test, finding an evidence gap or explaining which action a preventive or response measure could affect.
Contribution to test: an inspectable record of behavior, evidence and revisions that makes the decision easier to compare and challenge.
The 5 September 2026 case archive supplies the worked action records and source-derived comparisons. Its requirements are inferred; perturbation runs and measured defense results remain open work. The 5–6 October development summaries document bounded implementation checks, failures in temporal/context handling, native identity joins and measured-evidence carriage, and added resource costs.
These materials support inspection of concrete records and implementation behavior. Measuring practical benefit is a separate research question, pursued through comparative evaluation.
Choose the decision to assess, the available evidence and the alternative to compare. Record the expected observation before the test, then retain the outcome and any change to the model.
Identify the uncertainty that changes a decision.
State a claim an observation could challenge.
Specify the case, versions, intervention and comparison.
Retain observations, failures and resource costs.
Explain which claims or model records change and why.
The development snapshot contains six selected templates, T1–T6: controlled case, missing evidence, meaningful choice, changed premise, live execution and independent-case transfer. Those selected template records await completed runs in that snapshot. Earlier Results pages were withdrawn because their methodology was flawed; a replacement benchmark needs independently inspectable evidence and a comparison that measures the claimed benefit.
These sources provide concepts and comparison points for the research. The list connects each work to a question or design element; the draft crosswalks record proposed mapping relations and their versions.
Assertions before and after execution provide a comparison for MC's conditions, mechanism and resulting state. C. A. R. Hoare, October 1969; author's publication record.
Attack patterns organize prerequisites, execution and consequences. CAPEC-66 gives a concrete comparison with that structure. First released in 2007.
Concept schemes and mapping relations such as exactMatch, closeMatch and relatedMatch provide vocabulary for relating catalogs while retaining each catalog's meaning. Recommendation, 18 August 2009.
Classes, properties, individuals and relationships provide ontology-language background. MC uses crosswalks to relate external concepts. Second edition, 11 December 2012.
Observed adversary tactics and techniques provide catalog references for behavior analysis. The retained crosswalk is pinned to historical v19.2; MITRE's version history records v20.0 from 13 October 2026.
Countermeasures related through digital artifacts offer a comparison for offense/defense reasoning and observability. Peter E. Kaloroumakis and Michael J. Smith, 2021.
Malware behaviors and micro-behaviors provide another level of descriptive detail. The Get File Attributes entry, C0049, is an example from v2.2, created 4 December 2020 and modified 30 April 2024. These links follow the mutable main branch.
Detection-observable robustness and coverage evaluation provide a comparison for MC's defensive questions. The project page is dated 10 September 2026; its v4.0.0 documentation describes five levels. A version-specific comparison with MC is open research.
Reusable investigative questions and approaches provide a structure for asking what evidence would answer a question. The retained comparison uses specification 1.0.0; its publication date is unestablished, and concrete MC predicate bindings remain to be evaluated.
Source review: 19 October 2026. These conceptual references sit alongside the case intelligence sources and development test evidence.
Choose an action record, an observation or a proposed comparison. State what it explains, identify an alternative, and describe the evidence that would separate them.