Back to platform
Export plan→
Adversary Elimination Playbook

Model them. Deny them. Evict them. Keep them out.

Most tools detect. We remove an adversary's ability to operate against you - one named actor at a time, aligned to Qatar's National Incident Management Framework.

Start an adversary workshop→ Download sample plan→
4
Elimination phases
8–12w
Per adversary campaign
182d→11d
Mean dwell time
100%
Signed evidence
Representative campaign
DUNE SPARROW
State-aligned · regional
Phase 2 of 4 · Denial hardening · 61%
ScopePilot entity · 42 assets
Next milestoneHunt kick-off · 4 days
Evidencesigned · 1,204 events
Pick the adversary

Not generic APT. Named behaviours.

Select the actor most relevant to your mission. The playbook re-scopes to their techniques - the doors they use, the persistence they favour, the exfil they prefer.

Four phases

The loop we run on every engagement.

01

See them

  • Threat-model by named adversary
  • Map TTPs to MITRE ATT&CK
  • Identify likely entry points
  • Build the attack tree
Deliverable: adversary briefing + attack-tree map
02

Deny them

  • Close the specific doors they use
  • Harden the surface they target
  • Block known C2 / infra patterns
  • Prove each control change
Deliverable: hardening programme + control evidence
03

Evict them

  • Assume they are already in
  • Hunt for their fingerprints
  • Sever persistence, in the right order
  • Rotate credentials safely
Deliverable: hunt report + eviction evidence
04

Keep them out

  • Signed audit trail
  • IR retainer on standby
  • Quarterly re-hunt
  • Re-entry alerting
Deliverable: monitoring instrumentation + alerts
Phase 2 · Deny - expanded

Every door DUNE SPARROW uses - closed, with proof.

Controls being changed
Known TTPs being closed
T1566.001 · Spearphishing attachment
Mail-flow rule blocks executable + macro attachments. Coverage now 100%.
T1190 · Exploit public-facing app
Perimeter CVEs patched; WAF managed rules attached to all public ALBs.
T1059.001 · PowerShell
Constrained Language Mode and script-block logging enforced via policy; 88% of the fleet so far.
T1021.001 · Remote Desktop
RDP being removed from the internet; jumpbox + MFA for all admin access, 74% complete.
T1048 · Exfil over alternative protocol
DNS + ICMP egress inspected; anomalous volumes alert in real time.
Phase 3 · Hunt preview

What the eviction hunt surfaces.

HostArtifactTechniqueConfidenceEvicted
Measured outcome

The number that matters: how long they can stay.

182d
Mean dwell time at campaign start (illustrative)
11d
After Phase 3 (evict) complete
<48h
Detection on re-entry, steady-state
Download sample elimination plan (PDF)→