0Start here

A thief disabling the lock on a bank’s back door. Before, they must reach the lock, move the pins, and turn it; the move is to defeat the lock; after, the lock is open and the door lets them through. The part that cannot change is all three boxes taken together — change any one and it is no longer the same maneuver. Underneath sit two ways of doing it: pick the lock, or forge a key. A rake pick, a hook pick, this gang’s tools — all still “pick the lock” to us. One entry, not fifty.

An operator already at SYSTEM integrity reads credential material out of LSASS. That need·do·get is invariant core A — read it live. Underneath are swappable variants: a userland read, a syscall/handle-dup route. LSASS actually carries three cores, not one: A read memory live, B write it to disk (which yields a file, not yet a credential), C execute inside LSASS (A’s ending, reached with write access rather than an outside read). This plate is core A. Which tool ran is tradecraft; the reading itself is what cannot be dropped.

A maneuver record is a Hoare triple {P} m {Q} — a precondition it requires, a mechanism, a postcondition it yields (§4.1). Its identity is the stripped triple ⟨P*, m*, Q*⟩, what every aligned record structurally requires; two cores differing in any component are distinct (§4.4.3). An element is required exactly when removing it stops the record reaching its effect (§4.4.3.1). A tool realizes the core but is not part of it — the trivial core ⟨∅,∅,∅⟩ is never named (§4.4.5.3).

One goal, four genuinely different maneuvers: disable the lock, blow the door, take off the hinges, or get a person to open it. You fit a lock whose pins cannot be moved — so Maneuver 1 stops in every way of doing it, including ways nobody has written down. That is a real, honest win; say it that way. But you did not block the goal: three other maneuvers reach it and your lock does nothing about them. And if you had blocked only rake picks, you would not even have blocked Maneuver 1.

The objective — credential access — is reached by several maneuvers. RunAsPPL and Credential Guard act on core A (read LSASS live), so they stop every variant of A: userland read, syscall/handle-dup, and any route not yet catalogued. They do nothing to core B (dump to disk), core C (execute inside), or the unmodeled sibling paths — SAM-hive, DCSync, NTDS.dit, LSA secrets. A defence stops a whole maneuver, or one way of doing one maneuver; nothing stops the objective. A control keyed only on minidumps would not even stop core A.

A placement structurally breaks a maneuver when it stops it reaching its effect; a detect placement never breaks anything (§9.2). A result transfers to every aligned record exactly when the placement acts on the invariant core; acting on one record’s variation is a result for that record alone (§4.7.1). Scope follows a lattice: core → class-wide; several variations → those records; one variation → that record (§4.7.3). The mc:Objective is carried, not a criterion (§4.4.5).

Coverage is not a colour on a wall chart. One camera is unplugged — that watcher is blind — but the strong-room guard and the delivery ledger still watch, so this maneuver stays seen. What you never drew a plan for is a different matter: a door missing from your drawings is not a guarded door. Silence there is a gap to escalate, never a tick in the “covered” column.

Detection health is four-valued and derived from the telemetry underneath, not read off a dashboard. Impairing Sysmon blinds faceUserlandHandle; faceKernelRead (ETW-Ti) and faceMDMP (File/DLP) stay healthy, so core A is still seen. Health is computed, so killing one source moves every verdict resting on it. Separately, the Zone E sibling paths — SAM-hive, DCSync, NTDS.dit, remote LSASS, LSA secrets — have no record at all. Unmodeled is not covered: the honest output is the gap, escalated. Not tested is not covered either.

Each detection face carries a four-valued status — live, degraded, uncertain, blind — evaluated over the telemetry it grounds on (§8.2); a face is blind when its trigger requirement is unsatisfied. A maneuver with no record, a sibling path never modeled, and a cell never authored are all unmodeled, and unmodeled MUST NOT be reported as covered; absence of a record is not evidence of coverage (§10.4).

Where the defence lands decides how far the win travels. Un-pickable pins act on the part that cannot change, so they beat every way of picking — and ways nobody has written down. A sign reading “no rake picks” acts on one particular way; it stops the rake and nothing else — not the hook pick, not forging. Same door, two very different claims, with very different lifetimes.

A detection keyed on the invariant core — “a non-LSASS context reads LSASS credential memory,” visible via ETW-Ti (o1, spanning, L5) — fires whichever variant of core A ran: userland read, syscall/handle-dup, or a route not yet catalogued. That result transfers across the whole class. A detection keyed on a variation — the minidump written to disk (o2, discriminating, L2) — covers only that route; swap to a userland read and it is silent. Grounding fixes the scope.

The transfer rule (§4.7.1): a defensive result established against one aligned record transfers to every aligned record exactly when the placement acts on the invariant core. A placement on a record’s variation establishes a result for that record alone. Grounding fixes role — core-grounded is spanning, variation-grounded is discriminating (§7.2.1) — and the scope lattice (§4.7.3) reads the reach off where the placement lands.