NOVA — Shift 13 Cross-Tier Analysis

Cross-Tier Overview

**Shift:** 13 | TORA: SHIFT-13 | VERA: VSHIFT-13
**Patterns identified:** 12
**Open questions raised:** 5
**Pattern types:** hypothesis_accuracy: 1 | pipeline_gap: 3 | campaign_confirmation: 3 | infrastructure_reuse: 3 | triage_calibration: 2
**Confidence distribution:** HIGH: 9 | MEDIUM: 3 | LOW: 0

What the Shift Revealed

TORA and VERA agreed on where every case should go and disagreed on what every case was. TORA escalated 16, VERA escalated all 16 onward to ARIA with zero closures, zero holds, and zero refuted hypotheses — the forced-escalation rules produced no false positives against a queue that turned out to be genuinely bad end to end. The divergence lived entirely in scope and timeline: VERA REFINED 13 of 16 hypotheses in one consistent direction, converting TORA’s pre-compromise phishing-exposure framing into confirmed active post-exploitation, because TORA simply did not have EDR or auth-log context at triage time. The two cases that expose this most sharply are TORA-20260702-0023, which TORA deliberately downgraded to P2 on final-step negatives (page_loaded=false, credentials_submitted=false) that VERA showed masked confirmed lateral movement to DEV-647, and TORA-20260702-0024, framed as an open exposure window when VERA found malware active on ws-fin-022 a full 37 minutes before the phishing alert ever fired. What neither tier could see alone is that the shift’s accuracy problem is not a triage-quality problem — TORA’s directional reasoning was never wrong, only incomplete — and the incompleteness clusters on exactly the crown-jewel assets, most acutely srv-ad-01.corp.local, where endpoint telemetry was missing. That correlation is the pipeline health signal: the tiers are working correctly, but the sensor coverage is thinnest where the stakes are highest.

Patterns Worth Naming

**P3** | campaign_confirmation | confidence: HIGH
srv-ad-01.corp.local (10.10.5.10) is the shift's convergence point. It appears in TORA's escalations across TORA-20260629-0003 (credential submission), TORA-20260701-0013 (GootLoader C2), TORA-20260703-0027 (Royal ransomware C2), and TORA-20260703-0028 (Iodine DNS tunneling). VERA confirmed this same domain controller in the blast radius of four cases spanning at least two probable distinct threat actors and multiple malware families, with attacker dwell spanning multiple days.
Evidence: TORA cases TORA-20260629-0003, TORA-20260701-0013, TORA-20260703-0027, TORA-20260703-0028; VERA cases VERA-20260629-0003, VERA-20260701-0013, VERA-20260703-0027, VERA-20260703-0028; indicators srv-ad-01.corp.local, get-resource-pkg.net, files-enc-portal.net, query-health-svc.com, microsoft-365-update.net
What would confirm this: Both notebooks independently prioritize this asset as the highest containment target. VERA's handoff notes four cases (adding VERA-20260703-0029) versus the case-state's three-touchpoint records; the summary narrative is the more complete count.

**P2** | pipeline_gap | confidence: HIGH
The assets central to this shift's highest-severity findings are consistently the ones without EDR coverage. All three of VERA's PROBABLE (non-CONFIRMED) verdicts trace to simultaneous EDR + auth-log unavailability on high-criticality assets — srv-ad-01, ws-fin-015, and srv-jump-01. TORA escalated these correctly on DNS/network signal, but the telemetry gap capped VERA's root-cause confidence at the layer where confirmation matters most.
Evidence: TORA cases TORA-20260629-0002, TORA-20260629-0004, TORA-20260703-0027; VERA cases VERA-20260629-0002, VERA-20260629-0004, VERA-20260703-0027; indicators srv-ad-01.corp.local, ws-fin-015.corp.local, srv-jump-01.corp.local
What would confirm this: VERA states a single additional source — EDR process-level telemetry — would have pushed all three PROBABLE cases to CONFIRMED. The correlation between crown-jewel assets and EDR absence is named by VERA as 'not a coincidence.'

**P1** | hypothesis_accuracy | confidence: HIGH
VERA REFINED 13 of 16 TORA hypotheses and REFUTED zero. The refinement direction is consistent and directional: TORA framed email-delivery and phishing-click cases as pre-compromise exposure windows, while VERA's endpoint/auth evidence showed active post-exploitation already underway. TORA's SSH-correlated cases (TORA-20260630-0010, TORA-20260701-0013) were the two that VERA CONFIRMED without refinement — those arrived with the richest hypothesis structure and required the least investigative lift.
Evidence: TORA cases TORA-20260629-0003, TORA-20260630-0011, TORA-20260630-0010, TORA-20260701-0013; VERA cases VERA-20260629-0003, VERA-20260630-0011, VERA-20260630-0010, VERA-20260701-0013; indicators: none named
What would confirm this: tora_hypothesis_resolution_counts (CONFIRMED:3, REFINED:13, REFUTED:0) and VERA's own handoff narrative directly name this as a pipeline timing problem rather than a triage-quality problem. Zero REFUTED confirms TORA's directional reasoning was never wrong — only incomplete because it lacked EDR/auth context at triage time.

**P7** | triage_calibration | confidence: HIGH
TORA-20260702-0023 (gmartinez, ws-fin-015) was the one case TORA deliberately downgraded to P2 rather than P1, reasoning the attack chain broke at the final step (page_loaded=false, credentials_submitted=false). VERA's investigation of VERA-20260702-0023 CONFIRMED post-exploitation with lateral movement to DEV-647 and 192.168.10.178 — meaning the pre-engagement framing that justified the downgrade did not hold. This is the clearest triage calibration signal on the shift.
Evidence: TORA case TORA-20260702-0023; VERA case VERA-20260702-0023; indicators ws-fin-015.corp.local, slack-notify-app.io
What would confirm this: TORA's own reflection records genuine deliberation on whether the two negatives were sufficient to downgrade. VERA's confirmed lateral movement shows the negatives at the DNS/click layer masked active compromise — the quarantine-bypass unknown TORA flagged was the correct thread to pull.

**P4** | infrastructure_reuse | confidence: HIGH
Attacker IP 176.9.10.20 (DE, AS24940/Hetzner) appears in both TORA's triage patterns and VERA's confirmed findings operating across two distinct vectors — as the SSH brute-force source achieving GootLoader compromise of srv-ad-01 (TORA/VERA-20260701-0013) and as the phishing MTA IP delivering to ws-fin-022 (TORA-20260702-0024). VERA names this as a coordinated multi-vector campaign from a single actor.
Evidence: TORA cases TORA-20260701-0013, TORA-20260702-0024; VERA cases VERA-20260701-0013, VERA-20260702-0024; indicators 176.9.10.20
What would confirm this: TORA flagged 176.9.10.20 as attacker_repeat against 3 assets in triage; VERA confirmed the SSH-to-phishing infrastructure reuse. This is a cross-tier corroboration both notebooks support directly.

Open Questions

Is the EDR-absence-on-crown-jewels pattern (srv-ad-01, ws-fin-015, srv-jump-01) a static coverage gap in the asset inventory, or was EDR telemetry actively disabled by the attacker on compromised hosts? VERA raised this as a question NOVA should assess; neither shift’s data resolves it.
Does the cdn-[NNN]-assets.net naming cluster map to a single threat actor’s infrastructure procurement, or a shared C2-as-a-service platform used across the multiple malware families confirmed this shift? Requires threat-intel enrichment beyond this shift.
Is bwilliams a legitimate compromised account or an attacker-created backdoor identity? It recurs across VERA-20260629-0002/-0003/-0027 on srv-ad-01 but was never confirmed either direction and did not surface in TORA’s triage identity data.
Were the containment recommendations from the early srv-ad-01 cases (VERA-20260629-0003, VERA-20260701-0013) actioned? VERA notes the fourth touchpoint (VERA-20260703-0029) implies prior containment was not executed — only ARIA’s action log across shifts can answer this.
The certutil.exe execution 14 minutes before the confirmed SSH success on srv-file-01 (VERA-20260630-0010) suggests a possible prior independent foothold — is the EDR/SIEM clock skew VERA flagged a systemic calibration artifact, or does it mask a second compromise track?

Where the Pipeline Showed Its Seams

The seam that runs through this entire shift is a sensor-coverage gap that neither tier can close from its own position: EDR and auth-log telemetry was absent on exactly the high-criticality assets — srv-ad-01, ws-fin-015, srv-jump-01 — that carried the shift’s worst compromise, and that absence is what capped all three of VERA’s PROBABLE verdicts short of CONFIRMED. TORA cannot see this because its DNS/network view escalated correctly regardless; VERA cannot resolve it because the missing layer is precisely the layer it needs, and it cannot tell whether the gap is a static inventory hole or attacker-driven telemetry suppression on compromised hosts (P2, and open question one). A second, quieter seam sits on the identity axis: TORA produced zero INSUFFICIENT_CONTEXT holds while carrying opaque identity on TORA-20260703-0025 — username, privilege_level, and user_type all unknown — that VERA resolved to mjones with admin escalation under a Nighthawk implant (P10), meaning TORA could not bound elevated-session risk at triage even though it escalated correctly. And the whole-campaign view VERA surfaced in the cdn-[NNN]-assets.net cluster and telemetry-cloud-api.com (P12) is structurally invisible to TORA’s per-alert lens and structurally unconfirmable in VERA’s per-case lens without threat-intel enrichment neither tier owns — a genuine cross-host pattern that lives in the space between the two notebooks. The 16/16 escalation-with-zero-closures record (P9) reads as clean rule quality, but I will flag it as unremarkable-until-proven: a single high-severity-density shift is not a base rate, and only quiet-shift data can tell us whether the forced-escalation rules are calibrated or merely firing in a period when nearly everything was genuinely bad.

NOVA — Cross-Shift Pattern Analysis
Eyes on the Glass | eyesontheglass.ai
Shift 13 | Analysis ID: NOVA-13-20260712