Infrastructure Intelligence Model · v1.1

The layer between
what they do and
what they deploy.

Classical threat intelligence rests on two pillars: indicators of compromise and MITRE ATT&CK techniques. Both miss something essential - how an attack is actually executed at the infrastructure level. IIM fills that gap.

Technique Catalog 26 techniques
Categories 5 axes
Status Draft v1.1
01 - THE GAP

Two pillars. One blind spot between them.

IOCs are ephemeral snapshots. ATT&CK describes behavior at a level of abstraction that omits implementation. The actual infrastructure - hosting, routing, resolution, gating - falls in the gap. This is where campaigns live and where adversaries actually diverge.

Pillar One

Indicators of Compromise

Domains, IPs, hashes. Concrete and actionable for a short window, then stale. IOCs describe artifacts without context. A blocklist of last week's C2 domains tells you nothing about tomorrow's.

Describes What existed
The Gap

Infrastructure Intelligence

How traffic actually flows. Where nodes are hosted. Who is allowed to reach them. How containers are structured. The structural reality of the operation - stable over time, portable across samples.

Describes How it works
Pillar Two

MITRE ATT&CK

Behavioral TTPs. Stable abstractions of what adversaries do on endpoints. Powerful for behavioral analysis, but deliberately silent on infrastructure composition, routing, and operational gating.

Describes What happens
02 - MODEL

Four layers, one chain.

IIM separates observation from interpretation. Entities are facts. Roles are meaning. Relations are connections. Techniques are patterns. A chain weaves these into a concrete, directed execution trace that can be abstracted into a reusable pattern.

Entities

Raw observable facts

Entities are what you see: a URL, an IP, a domain, a file hash, a TLS certificate, a social account. No interpretation, no logic. An entity is strictly an artifact that exists, carrying identity and observation metadata.

// Pure observation, no interpretation { "id": "e3", "type": "url", "value": "https://worker.cloudflare.example/r", "first_seen": "2026-04-10T12:00:00Z", "last_seen": "2026-04-10T14:00:00Z" }

Roles

Semantic position in a chain

Roles give an entity meaning within a specific operational context. An entity can hold different roles in different chains - but only one role at a given position within a single chain. This chain-scoping is essential: it prevents role conflicts and allows the same host to play different parts across campaigns.

// Role lives on the chain position, not the entity { "entity_id": "e3", "role": "redirector", "confidence": "confirmed", "evidence_refs": ["obs-001"] }

Relations

Observed interactions

Relations describe how entities actually interact: redirects, downloads, resolutions, drops, connections, references. Relations carry evidence - they assert something was observed, not assumed - and optionally carry ordering and timing.

{ "from": "e3", "to": "e4", "type": "download", "sequence_order": 3, "observed_at": "2026-04-10T12:00:15Z", "confidence": "confirmed" }

Techniques

Reusable infrastructure patterns

Techniques describe recurring properties of infrastructure - CDN Abuse, Fast-Flux DNS, Geofenced Delivery, Multi-Hop Redirect. Unlike ATT&CK techniques, which describe behavior, IIM techniques describe infrastructure itself: hosting, routing, resolution, gating, composition.

// Attached to role at a chain position { "entity_id": "e3", "role": "redirector", "techniques": [ "IIM-T001", // CDN Abuse "IIM-T019", // Geofenced Delivery "IIM-T015" // Client-Side Redirect ] }

Chain

Concrete, observed execution

A chain is a directed sequence of role positions, each carrying an entity and a set of techniques. Chains describe what was actually observed - a specific campaign's specific infrastructure at a specific time. They are the operational unit of IIM.

{ "chain_id": "gamaredon-2026-01-13", "steps": [ { "role": "entry", "entity": "phish.ua" }, { "role": "redirector", "entity": "worker.example" }, { "role": "staging", "entity": "loader.rar" }, { "role": "payload", "entity": "pteranodon.exe" }, { "role": "c2", "entity": "c2.duckdns.org" } ] }

Pattern

Reusable chain abstraction

A pattern strips concrete entities from a chain, leaving only the structural fingerprint: role sequence, techniques, match semantics. Patterns are what federated feeds share. They match infrastructure that was never directly observed but follows the same operational logic.

{ "pattern_id": "ua-phishing-archive-c2", "match_mode": "structural", "structure": ["entry", "redirector", "staging", "payload", "c2"], "techniques": [ "IIM-T019", "IIM-T024", "IIM-T007", "IIM-T008" ], "allow_additional_hops": true }
03 - INTERACTIVE

Build a chain.

Drop role nodes onto the canvas, set their entity values, and attach infrastructure techniques. The builder emits a valid IIM v1.1 chain JSON in real time. Use it to understand the model, to annotate a campaign you are analyzing, or to sketch a pattern for federation.

This is just a demo, try the IIM Workbench: https://workbench.iim.malwarebox.eu

Chain Builder · Live

Start by adding a role.
Click a role in the palette on the left to drop a node onto the chain. Chains are directed: entry first, terminal roles last.

IIM v1.1 Chain · JSON Export

04 - CATALOG

26 techniques, strictly infrastructure.

Every technique describes a property of infrastructure itself - where it runs, how traffic flows, how it resolves, who it admits, how it is composed. Endpoint behavior is out of scope and belongs to ATT&CK. The two catalogs are complementary; together they describe a campaign fully.

05 - REAL CASE

Gamaredon. One chain.

A condensed view of the Gamaredon January 2026 delivery chain, annotated with IIM techniques. Infrastructure reads cleanly across five role positions. Behavioral ATT&CK annotations live on a separate axis and are not shown here - by design.

Gamaredon GamaLoad via BITS
Observed January 2026 · structural pattern reused since Nov 2025
Roles
5 positions
Techniques
9 attached
Confidence
Confirmed
Entry
Spearphishing email (Ukrainian gov theme)
T019 Geofenced
Staging
Password-protected RAR attachment
T024 Archive
Staging
HTA dropped to Startup folder
T006 LoTST021 Fingerprint Gate
Payload
Pteranodon loader (GamaLoad variant)
T007 Fast-FluxT008 DynDNS
C2
DuckDNS C2 endpoint pool
T008 DynDNST011 RotationT013 Dead-Drop