A Repeatable Method for Measuring APT Infrastructure Exposure

A Repeatable Method for Measuring APT Infrastructure Exposure An infrastructure query becomes useful when another analyst can reproduce it. The Cisco Talos research on UAT-6275 provides a concrete test case because it includes a narrative report, a Virus Bulletin paper, an IOC repository, and several kinds of infrastructure. A good measurement method should make each query answer a defined question without collapsing different evidence types into one number. The method below starts with the source report, records exact controls, and adds broader context only when it supports the argument. It does not require a large query set. It requires discipline about what each result means. Define the observation before the query Write the claim the query is meant to support. For example: "The published IOC address is still visible in public scan data." The corresponding query is an exact IP search. If the claim is "FortiWeb has a substantial internet-facing population," th