/cti

name: cti
description: "THE ENTRY POINT for cti-expert. Investigate any target — domain, IP, email, username, phone, wallet, hash or APK. Routes to the right chain automatically. Usage: /cti <target> [--deep|--quick|--passive]"
argument-hint: "<target> [--deep|--quick|--passive]"

/cti — cti-expert entry point

**Load the `cti-expert` skill now**, then investigate: `$ARGUMENTS`

This is the single entry to the whole toolkit. Everything else (`/cti-recall`, `/cti-case`, `/cti-pivot`, `/cti-cluster`, `/cti-check`, `/cti-report`, `/cti-status`) is a shortcut to one step of what this command does end-to-end.

Step 0 — ALWAYS FIRST: have we seen this before?

Run `recall` on the target before spending a single API credit. A known seed carries prior case context and possibly an existing operator attribution — re-investigating it wastes credits and risks contradicting a published assessment.

• **T1:** `mcp__intel__domain_verdict` + `mcp__intel__which_cases`
• **T2:** `python3 scripts/backend/intel.py recall <seed>`

If it is already attributed, **report that and stop** unless the user asks to extend the case.

Step 1 — Match the target and auto-run its route

Classify `$ARGUMENTS` before invoking a tool. In a full `/cti`, run **every applicable matching leg below without a second invocation or an opt-in prompt**; a seed is not complete after its first successful lookup. For each result, classify newly discovered identifiers and repeat Step 2c. `--quick` is the explicit one-pass exception (see Flags). Deduplicate by `(tool, normalized selector)` and use the case memo where available. Do not send a name, brand, favicon, JARM or certificate fingerprint to a file-hash/IoC endpoint. Use SKILL.md §Technique Activation Matrix for the rest of the target-matched techniques (e.g. `/icp` for domains, MSFTRecon only on M365 DNS, `/cn-corp` on a company/USCC, `/iban` on payment details, and `/hash-id` on discovered hashes). A checkmark means **eligible when its input/precondition exists**, not permission to send every source an unrelated selector. This is agent-orchestrated after `pipeline open`, not a claim that `pipeline open` alone runs the identity/OSINT commands.

| Target looks like | Automatically run (in addition to recall and applicable Step 2c legs) | |---|---| | domain / URL | Step 2 pipeline (already runs host-matched CLD Feeds + Shield when keyed), then convergence and Step 2c; do not run `cld route` again on that host | | person / organization name | `/query` + `/dork-sweep` and `/docleak` on the name; `/cn-corp` for a surfaced company/USCC, `/icp` on an identified domain, `/github-osint` only for a verified developer handle/account; keyed `cld ransomware <org>` and `cld internal-leaks <org>` for a real organization, not privacy/proxy boilerplate | | bare IP | `pivot_extract` in IPPivot mode (ASN, co-tenancy, ports, passive DNS); keyed `cld route <IP>`; treat co-tenants as leads, not owner links | | email | `email-deep <email> --case <case-dir>` (one IntelX search + reverse-WHOIS preview, bounded purchase); keyed `cld route <email>` for Feeds burner + Shield email IoC; `github-osint` only when a developer link exists; dork sweep on the address and its domain | | username / operator handle | `username <handle>`; keyed `cld actor-usernames <handle>` only for an operator handle, never a brand social account; pivot on exposed emails; dork sweep | | phone number | `phone <number>` + dork sweep; keyed `cld route <number>` (Feeds phone + Shield IoC); reverse-WHOIS preview only when it is a verified registrant contact, not a number scraped from page text | | crypto wallet / IBAN | chain tracing in **and out** for wallets (outbound can identify cash-out); `/iban` validation for IBAN; IntelX on a strong selector when keyed; never route an unsupported selector to CLD | | file hash / APK / EXE | **A binary seed routes itself:** `/cti <local file>` or `/cti <URL ending .apk/.exe/.dmg/.msi/.asar/…>` (`binary_indicators.json → binary_extensions`) is statically analysed first (BinaryPivot + REA, kept under `cases/<case>/bin/`, ingested, REA findings registered as kit nodes), then the run continues on the sample's **sha256** — the URL is never collected as a web page. Under `--passive`/hostile posture a binary URL is refused (pass the local path). `/hash-id` first for any hash; keyed `cld ioc hash <hash>` only for a confirmed **file hash**, never an ambiguous 64-hex cert fingerprint or a credential hash; never submit a sample to a public sandbox without the required confirmation | | Telegram handle / `t.me` URL | keyed `cld route t.me/<handle>` (Shield Telegram posts), not the domain route on `t.me` | | Facebook / Instagram / TikTok / LinkedIn URL, share link or handle | **Social intake (SKILL.md §2.5 "Social-media seed intake") — not the domain route on the platform host.** `sharelink <url>` (unwraps login walls → `platform_ids`; `--no-follow` for a pasted wall URL) → `meta-transparency <page-or-@handle> --case <case>` for Facebook/Instagram (tri-state fields + Wayback name/bio history) → `username` / `email-permute` on every discovered handle and display name → leak fan-out on the confirmed account usernames, business emails and phones (Step 2a) → relay the tool's `capture_checklist` to the analyst in round 1 (logged-in screenshots of Page transparency → See all, Ad Library Page → About, IG → About this account). **Never request cookies, session tokens, passwords or HAR files.** Account linkage (linked IG, owning organisation, admin countries, sharer id) ≠ owner identity | | CVE / `.onion` | keyed `cld route <selector>` (matching vulnerability / onion lookup); do not treat a CVE as a file hash |

`cld route` itself selects matching Feeds and Shield endpoints; never fire every vendor endpoint for every target. If the key is absent, a leg is unavailable; if `--passive` or case scope forbids it, skip with that reason. Keep no-spend separate from egress posture; `--free-only` and `scope.json` `n