Threat intelligence and detection engineering framework for advanced attack surface mapping —
with a focus on zero-click exploitation analysis structured under MITRE ATT&CK.
// Overview
SILENTFALL is a CTI framework designed around a specific threat category that is notoriously
difficult to detect: zero-click exploitation — attacks that require no user
interaction and leave minimal forensic artifacts.
The framework maps known zero-click attack patterns (NSO Group Pegasus, FORCEDENTRY,
BlastPass) to MITRE ATT&CK techniques, then engineers detection logic
at the network and endpoint layer targeting the behavioral indicators that persist even
when payload artifacts are cleaned.
"Zero-click attacks are undetectable by definition at the payload level.
SILENTFALL detects them at the behavioral level — the C2 callouts, the anomalous
process spawns, the impossible data flows."
// ATT&CK Coverage
TA0001 · Initial Access
Exploit Public-Facing App
Mapping zero-click delivery vectors via iMessage, WhatsApp, and WebKit rendering engine vulnerabilities.
TA0011 · Command & Control
Encrypted Channel
Detection logic for anomalous TLS beacon patterns characteristic of commercial spyware C2 infrastructure.
TA0006 · Credential Access
OS Credential Dumping
Behavioral indicators for keychain access and credential extraction post-compromise on iOS and macOS targets.
TA0010 · Exfiltration
Automated Exfiltration
Network-layer detection of data staging and exfiltration timing patterns aligned with spyware operational profiles.
// Research Timeline
Phase 01
Threat Actor Profiling
Analyzed NSO Group, Candiru, and QuaDream operational TTPs from Citizen Lab, Amnesty Tech, and Google Project Zero reporting.
Phase 02
ATT&CK Technique Mapping
Structured attack chains for FORCEDENTRY and BlastPass into ATT&CK Navigator layers, identifying detection gaps in current tooling.
Phase 03
Detection Engineering
Developed YARA rules and Sigma-compatible detection logic targeting behavioral indicators persistent across payload variants.
// Tools & Sources