Article authored by Eoghan Casey
Technical details of Technique and class diagrams reviewed by Alex Nelson

Requirements that arose out of SOLVE-IT and Project-VIC led the CASE/UCO community (supported by DFRWS.org) to add the new concept of Technique, modeled as a metaclass. This solution expands the ability to represent cyber-investigations, supports subclassing with inheritance, and enables interoperability across frameworks, including SOLVE-IT and Project-VIC, and MITRE ATT&CK.

Motivation for Metaclass

Until now, representing cyber investigation information focused on what discrete actions were performed on evidence sources, with which tools, and the resulting observations. For example, an InvestigativeAction specifies that, on July 1 at 13:25 UTC, Eoghan Casey acquired data from a Seagate hard drive (model=ST2000DM008, S/N=9WM03PYK, etc.) using dc3dd (hash=sha256, bs=4k, etc.), saved the output in a file (of=CASE01-07012026-01.dd).

The digital forensics and security operations community also needs to represent how certain techniques can be performed, such as in a Standard Operating Procedure (SOP). CASE/UCO version 1.5 delivers a solution for representing how an objective in cyber investigations can be achieved more generally, on a certain class of evidence, using any fit-for-purpose tool. This is an important distinction of a Technique as an operation that can be performed using many different tools. For instance, SOLVE-IT extends CASE/UCO with the following Technique that could be applied to a traditional hard disk, SSD, USB stick, or data from an eMMC chip that has been desoldered and placed in a reader, using various tools, and the copied data needs to output as a bitstream.

solveit-data:techniqueDFT-1002 a owl:Class , solveit-core:Technique ;
    rdfs:label "DFT-1002: Disk Imaging"@en ;
    solveit-core:techniqueID "DFT-1002" ;
    solveit-core:techniqueName "Copy sectors from storage media" ;
    solveit-core:techniqueDescription "Copying of sectors from a storage media, typically LBA~0~ to LBA~max~ to a bitstream that can be stored in an image format (DFT-1025)." ;
    solveit-core:hasExample "dc3dd" ;
    solveit-core:hasExample "FTK Imager" ;
    solveit-core:hasExample "Magnet ACQUIRE" ;
    solveit-core:hasPotentialWeakness solveit-data:weaknessDFW-1004 ;
    solveit-core:hasCASEInputClass "https://ontology.solveit-df.org/solveit/observable/WriteProtectedDeviceInterface"^^xsd:anyURI ;
    solveit-core:hasCASEInputClass "https://ontology.solveit-df.org/solveit/observable/ReadWriteDeviceInterface"^^xsd:anyURI ;
    solveit-core:hasCASEOutputClass "https://ontology.solveit-df.org/solveit/observable/Bitstream"^^xsd:anyURI .

Capturing the Dual Nature of Techniques

There are some nuances to this solution, which models Technique as a metaclass. A metaclass is a class whose instances are themselves classes. Where an ordinary class has individuals as members, a metaclass has classes as members. This establishes a third tier above the standard two-tier object-oriented inheritance:

1. Technique: the metaclass (a class of action-classes)
2. Disk Imaging: a class (an instance of Technique, and a class in its own right, subclassing Action)
3. Disk Imaging using dc3dd: an instantiation (an instance of Disk Imaging)

To illustrate how the Disk Imaging Technique is instantiated as an InvestigativeAction using dc3dd:

kb:investigativeaction-9a713814-5107-4df6-8442-b706c80e14d4 a solveit-data:techniqueDFT-1002 ;
    uco-core:name "acquired" ;
    uco-core:description "Disk image of Seagate ST2000DM008 hard drive using dc3dd." ;
    solveit-core:appliedMitigation solveit-data:mitigationDFM-1004 ;           # Hash verification applied
    uco-action:startTime "2026-07-01T13:25:04Z"^^xsd:dateTime ;
    uco-action:endTime "2026-07-01T14:13:45Z"^^xsd:dateTime ;
    uco-action:instrument kb:configuredtool-dc3dd-0757589f-64df-486e-bf43-23b85e396a26 ;
    uco-action:location kb:location-67abb4ae-5cfa-4bc1-8c9b-b0552d2d156a ;
    uco-action:performer kb:forensicexaminer-267cbbde-b1fc-424c-bd3f-5fb0b535a748 ;
    uco-action:object kb:device-seagate-36d34d1f-cbef-4a51-b7a6-9ed1ea121643 ,   # source drive (input)
                      kb:provenancerecord-93c321d2-e4ba-4354-8b33-e8dcf4c16d2e ; # chain-of-custody (input)
    uco-action:result kb:forensicimage-0d69221c-f44a-4ef6-bc67-4bd5cb46bba8 ,    # bitstream copy (output)
                      kb:provenancerecord-1d017aee-2b89-4667-9c15-e7d27d8fed41 ; # chain-of-custody (output)

There are multiple benefits to this design:

• Captures the dual nature of Technique with the feature of OWL 2 called “punning” with the same term being treated as a class in one context (general Disk Imaging) and as an instantiation in another (Disk Imaging on July 1st using dc3dd).
• A catalogue of Techniques (e.g., SOLVE-IT, Project-VIC, ATT&CK) can be encoded in a class hierarchy, opening opportunities for reasoning (such as with OWL mechanisms) and usage verification (such as with SHACL specifications).
• A Technique class is a node in the graph that allows you to ask the question “show me every instance of a Disk Imaging Technique in this case, whatever tool was used” without having to parse strings in the object properties for “Disk Imaging using [any tool]”.
• A weakness associated with a parent Technique is inherited by every subclassed Technique without having to manage duplicative references to weaknesses for each child.
• A Technique can be identified by combining two other Techniques, and an instance of the aggregate Technique simply represents an instance of both parent Techniques (multi-classing).

Illustrative Example with SOLVE-IT: Keyword Searching

When performing a keyword search of a disk image, it may be necessary to specify what to search for (case-specific keywords versus case-type keywords) and how the search runs (across indexed data versus live search). The combination of two distinct Technique classes in SOLVE-IT are represented here for an indexed keyword search using case-specific wordlists:

# These two Techniques are subclasses of DFT-1049 keyword search class, each an instance of the metaclass:

solveit-data:techniqueDFT-1123 rdfs:subClassOf solveit-data:techniqueDFT-1049 ;
    a owl:Class, solveit-core:Technique ;
    solveit-core:techniqueID "DFT-1123" ;
    solveit-core:techniqueName "Keyword search (case-specific wordlists)" .

solveit-data:techniqueDFT-1124 rdfs:subClassOf solveit-data:techniqueDFT-1049 ;
    a owl:Class, solveit-core:Technique ;
    solveit-core:techniqueID "DFT-1124" ;
    solveit-core:techniqueName "Keyword search (indexed)" .

# The performed action is an instantiation of both Technique classes with native
# multi-classing rather than creating a custom "usedTechnique" property:

kb:keyword-search-20260715
    a solveit-data:techniqueDFT-1123 , solveit-data:techniqueDFT-1124 ;
    uco-core:description "Indexed keyword search using case-specific wordlists" ;
    uco-action:startTime "2026-07-01T09:30:00Z"^^xsd:dateTime ;
    uco-action:endTime   "2026-07-01T09:32:17Z"^^xsd:dateTime ;
    uco-action:performer kb:examiner-01 ;
    uco-action:instrument kb:tool-01 ;
    uco-action:result    kb:search-results .

The class diagram for SOLVE-IT keyword search Techniques and the multi-classing are shown here.

A reviewer, or an automated audit, can ask “was an indexed search ever performed using case-specific terms?” and get an answer from the graph’s structure rather than searching for strings in property fields. Because this performed action is explicitly typed as DFT-1123 (“Keyword search case-specific wordlists”) and DFT-1124 (“Keyword search indexed”), a query for DFT-1049 (“Keyword search”) would find this performed action via hierarchical inferencing.

Illustrative Example with ATT&CK

The ATT&CK knowledge base for adversary behaviors currently has references between techniques, which could be represented as a Technique class hierarchy. For example, OS Credential Dumping (T1003) is a general Technique with named sub-techniques, one of which is Cached Domain Credentials (T1003.005). An observed adversary action becomes a Technique class instantiation as shown here:

attack:T1003 a owl:Class , uco-action:Technique ;
    rdfs:subClassOf uco-observable:ObservableAction ;
    uco-action:techniqueID "T1003" ;
    rdfs:label "OS Credential Dumping"@en .

attack:T1003.005 rdfs:subClassOf attack:T1003 ;   # sub-technique = subclass = "refines"
    a owl:Class , uco-action:Technique ;
    uco-action:techniqueID "T1003.005" ;
    rdfs:label "Cached Domain Credentials" .

# An observed occurrence during an intrusion is an instantiation of the sub-technique:

kb:adversaryaction-credentialdump-20260717
    a attack:T1003.005 ;
    uco-core:description "Cached domain credentials dumped using cachedump.exe" ;
    uco-action:startTime "2026-07-17T14:03:11Z"^^xsd:dateTime ;
    uco-action:performer kb:threat-actor-suspected ;
    uco-action:instrument kb:cachedump-exe ;
    uco-action:object    kb: system-registry .

Because `T1003.005 rdfs:subClassOf T1003`, a reasoner knows every observed event involving extracting cached domain credentials is also a credential dumping event, by inheritance. An analyst querying “show every credential dumping observation in this campaign” captures the sub-technique instances automatically. A class hierarchy inherently codifies this reasoning, rather than being re-encoded as ad-hoc links across ATT&CK techniques that complicate queries and correlation.

Using a Technique class hierarchy opens opportunities for logical grouping of subclasses as shown below with three notional intermediate classes bridging between T1003 and its subclasses:

Using the same construct in ATT&CK and SOLVE-IT allows one to reference and refine the other when a particular Technique aligns, such as T1003 (OS Credential Dumping) in ATT&CK and DFT-1033 (Extract credentials) in SOLVE-IT for digital forensics purposes.

Improving AI Reliability

As large language models (LLMs) are being used to support cyber investigations, it is essential to prevent errors and hallucinations. The most effective solutions pair neural language understanding with symbolic logic, grounding AI with a knowledge graph built on a sound ontology to give the model a foundation of validated facts to be checked against and retrieved from. With such neuro-symbolic AI, answers are anchored with what the graph actually asserts rather than to what is statistically plausible. Technique-as-metaclass provides the needed symbolic scaffolding, with “implements a technique” and “refines a technique” driving logical operations the symbolic side can compute, increasing the reliability and accuracy of AI results.

In addition, with Technique as a class hierarchy, a reasoner can classify new observations, propagate sub-technique memberships up to their parents, detect contradictions, and answer structural queries. These are capabilities that knowledge bases of cross-referenced entries do not support. The robust logic chain of Technique metaclass, classes, and instantiations also supports traceability and repeatability, which is critical for cyber investigations.

Conclusions

This representation of Technique clarifies a core concept in cyber investigations, which strengthens practitioner comprehension and AI grounding, improving their analysis and reasoning capabilities. It also makes it easier to model multiple frameworks consistently so that information can flow across tools and subdomains, which is one of the founding goals of the Cyber Domain Ontology (CDO).