# DISARM Red framework

# DISARM

P01 Plan | P01 Plan | P02 Prepare | P02 Prepare | P02 Prepare | P03 Execute | P03 Execute | P03 Execute | P03 Execute | P04 Assess | P01 Plan | P02 Prepare | P02 Prepare | P02 Prepare | P03 Execute | P03 Execute

TA01 Plan Strategy

TA02 Plan Objectives

TA05 Microtarget

TA06 Develop Content

TA07 Select Channels and Affordances

TA08 Conduct Pump Priming

TA09 Deliver Content

TA10 Drive Offline Activity

TA11 Persist in the Information Environment

TA12 Assess Effectiveness

TA13 Target Audience Analysis

TA14 Develop Narratives

TA15 Establish Social Assets

TA16 Establish Legitimacy

TA17 Maximize Exposure

TA18 Drive Online Harms

T0073 Determine Target Audiences

T0002 Facilitate State Propaganda

T0016 Create Clickbait

T0015 Create hashtags and search artifacts

T0029 Online polls

T0020 Trial content

T0114 Deliver Ads

T0017 Conduct fundraising

T0059 Play the long game

T0132 Measure Performance

T0072 Segment Audiences

T0003 Leverage Existing Narratives

T0007 Create Inauthentic Social Media Pages and Groups

T0009 Create fake experts

T0049 Flooding the Information Space

T0047 Censor social media as a political force

T0074 Determine Strategic Ends

T0066 Degrade Adversary

T0018 Purchase Targeted Advertisements

T0019 Generate information pollution

T0043 Chat apps

T0039 Bait legitimate influencers

T0115 Post Content

T0057 Organize Events

T0060 Continue to Amplify

T0133 Measure Effectiveness

T0080 Map Target Audience Information Environment

T0004 Develop Competing Narratives

T0010 Cultivate ignorant agents

T0011 Compromise legitimate accounts

T0118 Amplify Existing Narrative

T0048 Harass

T0075 Dismiss

T0101 Create Localized Content

T0023 Distort facts

T0103 Livestream

T0042 Seed Kernel of truth

T0116 Comment or Reply on Content

T0061 Sell Merchandise

T0128 Conceal People

T0134 Measure Effectiveness Indicators (or KPIs)

T0081 Identify Social and Technical Vulnerabilities

T0022 Leverage Conspiracy Theory Narratives

T0013 Create inauthentic websites

T0097 Create personas

T0119 Cross-Posting

T0123 Control Information Environment through Offensive Cyberspace Operations

T0076 Distort

T0102 Leverage Echo Chambers/Filter Bubbles

T0084 Reuse Existing Content

T0104 Social Networks

T0044 Seed distortions

T0117 Attract Traditional Media

T0126 Encourage Attendance at Events

T0129 Conceal Operational Activity

T0040 Demand insurmountable proof

T0014 Prepare fundraising campaigns

T0098 Establish Inauthentic News Sites

T0120 Incentivize Sharing

T0124 Suppress Opposition

T0077 Distract

T0085 Develop Text-based Content

T0105 Media Sharing Networks

T0045 Use fake experts

T0127 Physical Violence

T0130 Conceal Infrastructure

T0068 Respond to Breaking News Event or Active Crisis

T0065 Prepare Physical Broadcast Capabilities

T0099 Prepare Assets Impersonating Legitimate Entities

T0121 Manipulate Platform Algorithm

T0125 Platform Filtering

| T0078 Dismay |  | T0086 Develop Image-based Content | T0106 Discussion Forums | T0046 Use Search Engine Optimization |  |  | T0131 Exploit TOS/Content Moderation |  |  | T0082 Develop New Narratives | T0090 Create Inauthentic Accounts | T0100 Co-opt Trusted Sources | T0122 Direct Users to Alternative Platforms |
| T0079 Divide |  | T0087 Develop Video-based Content | T0107 Bookmarking and Content Curation | T0113 Employ Commercial Analytic Firms |  |  |  |  |  | T0083 Integrate Target Audience Vulnerabilities into Narrative | T0091 Recruit bad actors |  |  |
|  |  | T0088 Develop Audio-based Content | T0108 Blogging and Publishing Networks |  |  |  |  |  |  |  | T0092 Build Network |  |  |
|  |  | T0089 Obtain Private Documents | T0109 Consumer Review Networks |  |  |  |  |  |  |  | T0093 Acquire/ recruit Network |  |  |
|  |  |  | T0110 Formal Diplomatic Channels |  |  |  |  |  |  |  | T0094 Infiltrate Existing Networks |  |  |
|  |  |  | T0111 Traditional Media |  |  |  |  |  |  |  | T0095 Develop Owned Media Assets |  |  |
|  |  |  | T0112 Email |  |  |  |  |  |  |  | T0096 Leverage Content Farm |  |  |

- T0073: Determine Target Audiences
- T0002: Facilitate State Propaganda
- T0016: Create Clickbait
- T0015: Create hashtags and search artifacts
- T0029: Online polls
- T0020: Trial content
- T0114: Deliver Ads
- T0017: Conduct fundraising
- T0059: Play the long game
- T0132: Measure Performance
- T0072: Segment Audiences
- T0003: Leverage Existing Narratives
- T0007: Create Inauthentic Social Media Pages and Groups
- T0009: Create fake experts
- T0049: Flooding the Information Space
- T0047: Censor social media as a political force
- T0074: Determine Strategic Ends
- T0066: Degrade Adversary
- T0018: Purchase Targeted Advertisements
- T0019: Generate information pollution
- T0043: Chat apps
- T0039 : Bait legitimate influencers
- T0115: Post Content
- T0057: Organize Events
- T0060: Continue to Amplify
- T0133: Measure Effectiveness
- T0080: Map Target Audience Information Environment
- T0004: Develop Competing Narratives
- T0010: Cultivate ignorant agents
- T0011: Compromise legitimate accounts
- T0118: Amplify Existing Narrative
- T0048: Harass
- T0075: Dismiss
- T0101: Create Localized Content
- T0023: Distort facts
- T0103: Livestream
- T0042: Seed Kernel of truth
- T0116: Comment or Reply on Content
- T0061: Sell Merchandise
- T0128: Conceal People
- T0134: Measure Effectiveness Indicators (or KPIs)
- T0081: Identify Social and Technical Vulnerabilities
- T0022: Leverage Conspiracy Theory Narratives
- T0013: Create inauthentic websites
- T0097: Create personas
- T0119: Cross-Posting
- T0123: Control Information Environment through Offensive Cyberspace Operations
- T0076: Distort
- T0102: Leverage Echo Chambers/Filter Bubbles
- T0084: Reuse Existing Content
- T0104: Social Networks
- T0044: Seed distortions
- T0117: Attract Traditional Media
- T0126: Encourage Attendance at Events
- T0129: Conceal Operational Activity
- T0040: Demand insurmountable proof
- T0014: Prepare fundraising campaigns
- T0098: Establish Inauthentic News Sites
- T0120: Incentivize Sharing
- T0124: Suppress Opposition
- T0077: Distract
- T0085: Develop Text-based Content
- T0105: Media Sharing Networks
- T0045: Use fake experts
- T0127: Physical Violence
- T0130: Conceal Infrastructure
- T0068: Respond to Breaking News Event or Active Crisis
- T0065: Prepare Physical Broadcast Capabilities
- T0099: Prepare Assets Impersonating Legitimate Entities
- T0121: Manipulate Platform Algorithm
- T0125: Platform Filtering
- T0078: Dismay
- T0086: Develop Image-based Content
- T0106: Discussion Forums
- T0046: Use Search Engine Optimization
- T0131: Exploit TOS/Content Moderation
- T0082: Develop New Narratives
- T0090: Create Inauthentic Accounts
- T0100: Co-opt Trusted Sources
- T0122: Direct Users to Alternative Platforms
- T0079: Divide
- T0087: Develop Video-based Content
- T0107: Bookmarking and Content Curation
- T0113: Employ Commercial Analytic Firms
- T0083: Integrate Target Audience Vulnerabilities into Narrative
- T0091: Recruit bad actors
- T0088: Develop Audio-based Content
- T0108: Blogging and Publishing Networks
- T0092: Build Network
- T0089: Obtain Private Documents
- T0109: Consumer Review Networks
- T0093: Acquire/ recruit Network
- T0110: Formal Diplomatic Channels
- T0094: Infiltrate Existing Networks
- T0111: Traditional Media
- T0095: Develop Owned Media Assets
- T0112: Email
- T0096: Leverage Content Farm