Retrospective salience is a powerful tool
Mapping tactics techniques and procedures (TTPs) of covert coercion to Mitre Att&ck TTPs
A Romanian middle school classmate contacted me on Facebook after ten years and commented on a headshot that my Polish friend (from my computer science class at Queen Mary University of London) took of me during our reunion in San Francisco. His comment was: “Sexy Photoshooting look... Sports Illustrated Cover here I come!!!” – a covertly coercive sexualization disguised as a compliment, designed to test my boundaries under the cover of humor.
After 10 years in Cyber Threat Intelligence working for a US corporation I spent some time mapping tactics techniques and procedures (TTPs) of covert coercion to MITRE ATT&CK TTPs.
The Mapping of covert coercion to MITRE ATT&CK
Tactic 1 – Sexual Objectification Disguised as Compliment
MITRE: Defense Evasion (TA0005) – Masquerading
What it does: Hides abuse behind flattery, makes harmful intent appear benign.
Tactic 2 – Mocking Your Appearance via Exaggeration (Negging)
MITRE: Impact (TA0040) – Endpoint Denial of Service (metaphorical)
What it does: Aims to reduce your confidence and self‑worth (psychological denial of service).
Tactic 3 – Reasserting Dominance from Middle School
MITRE: Privilege Escalation (TA0004)
What it does: Claims the right to define your image publicly, re‑establishing the old abusive hierarchy.
Tactic 4 – Gaslighting Your Perception of Reality
MITRE: Defense Evasion (TA0005) – Impair Defenses
What it does: Attacks your ability to trust your own judgment, impairing internal defenses.
Tactic 5 – Trivializing Your Achievements / Persona
MITRE: Impact (TA0040) – Data Manipulation
What it does: Alters the meaning of your photo (professional → sexual), manipulating your identity.
Tactic 6 – Public Marking as “His” Object
MITRE: Lateral Movement (TA0008) – Lateral Tool Transfer
What it does: Uses your social platform to pivot from his life to yours, marking territory.
Tactic 7 – Projection of His Own Insecurity / Aggression
MITRE: Collection (TA0009) – Data from Local System
What it does: Extracts your image as a prop for his power fantasy.
Tactic 8 – Minimizing Your History of Abuse by Acting “Friendly” (DARVO)
MITRE: Defense Evasion (TA0005) – Masquerading + Indicator Removal
What it does: Pretends the comment is “just a compliment” to erase abusive history; forces you into silence or overreaction.
After turning 18, my Romanian middle school classmate traveled to other European countries—just as I traveled to London, England—where he encountered communication styles and social norms that are generally less coercive. He had the opportunity to learn different ways of interacting. So it is worth noting that, despite that exposure, years later he still chose to post a comment that many would recognize as covertly coercive. The gap between what he could have learned and what he actually did raises questions about his intentions, and suggests a pattern that is not easily explained by ignorance alone.
Additional Implications
1. Willful Regression as a Statement of Power
MITRE: Persistence (TA0003) – Valid Accounts
Reason: He deliberately retains and reuses the “abuser account” despite knowing better.
2. Undermining Your Social Leadership Role
MITRE: Privilege Escalation (TA0004) + Impact (TA0040)
Reason: He escalates his own status by tearing down your role as reunion organizer.
3. Testing Boundaries After Long Silence (Discovery)
MITRE: Discovery (TA0007) – Social Media Discovery
Reason: A low‑stakes probe to map your current tolerance and boundaries.
4. Weaponizing “European Sophistication” as Gaslighting
MITRE: Defense Evasion (TA0005) – Masquerading
Reason: Uses false cultural framing to make abuse appear normal (“European compliment”).
5. Nostalgia for Abusive Power (Eminem Persona Persists)
MITRE: Persistence (TA0003) – Scheduled Task (metaphor)
Reason: His abusive persona is a persistent process triggered by your photo.
6. Public Marking Despite Geographic Distance
MITRE: Lateral Movement (TA0008) – Remote Access Software
Reason: Uses social media as remote access to move from his European life into your digital space.
7. Co‑opting Your Reunion as Implied Permission
MITRE: Collection (TA0009) – Data from Information Repositories
Reason: Treats your reunion organization as a repository to mine for false justification.
8. Testing Whether You Have Changed (Or Remain Prey)
MITRE: Discovery (TA0007) – Gather Victim Identity Information
Reason: Probing your resilience level – victim intelligence gathering.
9. Deliberate Choice to Remain a Predator (Persistent Threat)
MITRE: Persistence (TA0003) + Resource Development (TA0042)
Reason: He has actively maintained his coercive skill set across time and cultures – an APT‑like adversary.
Responding with a comment that actively mitigates coercive control is critical because it interrupts the abuser’s intended power dynamic. Coercive comments—like the one my classmate posted—are designed to make you feel small, confused, or obligated to comply. By refusing to stay silent or play along, your reply does three things: it publicly rejects the hidden frame (e.g., “this is just a compliment”), it demonstrates that you recognize the manipulation and will not be gaslit, and it sets a boundary that the abuser cannot easily dismiss without exposing themselves. Without such a reply, silence can be interpreted as permission, and the adversary may escalate or repeat the behavior. A well‑chosen counter‑comment reclaims your narrative, protects your own psychological safety, and often serves as a warning to others that you are not an easy target. In short, it transforms you from a victim of covert coercion into an active defender of your own autonomy.
Mitigations for the Additional 9 Implications
1. Willful regression to abusive identity
Mitigation (M1049): Note Intent – Explicitly observe that he chose this behavior despite knowing better.
Example action: “You’ve lived in Europe. You know this isn’t normal.”
2. Undermining your social leadership (you organized the reunion)
Mitigation (M1050): Reassert Your Role – Remind him (and the audience) who organized the reunion.
Example action: “I organized our reunion as a peer, not as a model for you.”
3. Testing boundaries after long silence (Discovery probe)
Mitigation (M1034): Respond Once, Then Stop – Give a single, calm boundary, then ignore further replies.
Example action: “Not acceptable. Don’t comment like this again.”
4. Weaponizing “European sophistication” as gaslight
Mitigation (M1046): Name the False Frame – Directly reject the cultural excuse.
Example action: “Europeans don’t call awkward headshots ‘Sports Illustrated.’”
5. Nostalgia for abusive power (Eminem persona persists)
Mitigation (M1052): Break the Nostalgia Loop – State that you remember his past abuse.
Example action: “I remember you kicking me in middle school. This feels similar.”
6. Public marking despite geographic distance
Mitigation (M1029): Remove the Marker – Delete the comment or restrict his visibility.
Example action: Delete the comment and block him from future posts.
7. Co‑opting your reunion as implied permission
Mitigation (M1043): Correct the Record – Clarify that organizing a reunion is not an invitation.
Example action: “Organizing a reunion doesn’t mean I wanted your attention.”
8. Testing whether you have changed (still prey?)
Mitigation (M1033): Show the Change – Demonstrate you now analyze, not absorb. Use a calm, short response.
Example action: “I’m not the person you could push around anymore.”
9. Deliberate predator identity (APT persistence)
Mitigation (M1047): Document & Observe – Do not engage further; collect evidence.
Example action: No reply – just screenshot and archive.
While mitigating comments—such as calmly naming the coercion or setting a polite boundary—are valuable first responses, they are often not enough against a persistent and deliberate adversary. A seasoned coercive actor can easily dismiss a mild rebuke as “overreacting” or “not getting the joke,” using the very politeness of your reply to reinforce their own frame. In such cases, a more robust counter‑abusing tactic—one that strategically emulates the adversary’s own methods, such as public exposure, mirroring their dismissiveness, or applying social pressure—can serve two crucial functions. First, it restores equitability by showing the adversary that coercive behavior will be met with comparable force, making future attacks more costly. Second, it acts as a form of safety education: the adversary learns, through direct and uncomfortable experience, that their tactics will not only fail but will be turned against them. Without this feedback, a manipulator may never feel compelled to change. Thus, counter‑abusing tactics are not about revenge; they are about leveling the power imbalance and teaching, in the only language some adversaries understand, that coercion carries consequences.
Counter-tactics
Against 1 – Sexual objectification disguised as compliment
Reply: “Appreciate the energy, but my headshot isn’t a swimsuit issue. Let’s stick to ‘nice photo’ – it’s free and doesn’t require a time machine to 2003.”
Against 2 – Mocking your appearance (negging)
Reply: “You’ve been workshopping that line since we were 14? I admire the commitment. But we’re both adults now – let’s retire the middle school roast book.”
Against 3 – Reasserting dominance from middle school
Reply: “Last time you kicked me. Now you’re calling a LinkedIn headshot ‘Sports Illustrated.’ That’s not dominance – it’s a character arc that keeps rebooting. Let’s write you a new one.”
Against 4 – Gaslighting your perception of reality
Reply: “I think we’re reading different dictionaries. In mine, ‘compliment’ doesn’t include unsolicited sexy talk. Want to compare notes? I have screenshots.”
Against 5 – Trivializing your achievements / persona
Reply: “Thanks for stopping by! I’ve filed your comment under ‘Best Of: Why We Don’t Talk More.’ It’s a shortlist, but yours made the cut.”
Against 6 – Public marking as “his” object
Reply: “You’ve claimed me as your Sports Illustrated cover? That’s sweet. I’ve claimed you as my ‘Lesson in Why Boundaries Exist.’ Let’s trade – I’ll send you a pamphlet.”
Against 7 – Projection of his own insecurity / aggression
Reply: “How’s the European job hunt? Asking for a friend who’s also job hunting and doesn’t project it onto people’s photos. We can swap tips if you drop the negging.”
Against 8 – Minimizing abuse via “friendliness” (DARVO)
Reply: “I’d love to believe it was a joke. But my lawyer says jokes don’t usually require a screenshot folder. Let’s call it a ‘learning moment’ and move on.”
Against 9 – Willful regression to abusive identity
Reply: “You lived in places where people say ‘nice photo’ without making it weird. So I know you can. This feels less like a slip and more like a stubborn old habit. Habits can be broken – I believe in you.”
Against 10 – Undermining your social leadership (reunion organizer)
Reply: “I organized the reunion so people could reconnect, not so I could be your fantasy draft pick. Let’s keep comments in the ‘safe for humans’ zone.”
Against 11 – Testing boundaries after long silence (Discovery probe)
Reply: “Testing my boundaries? Great. Here’s the result: I have a therapist, a support group, and a very patient screenshot folder. Your move – but maybe try ‘hello’ next time.”
Against 12 – Weaponizing “European sophistication” as gaslight
Reply: “I’ve met Europeans. They’re lovely. None of them called a friend’s headshot ‘Sports Illustrated.’ So maybe the problem isn’t the continent – it’s the comment.”
Against 13 – Nostalgia for abusive power (Eminem persona persists)
Reply: “Still channeling 2002 Eminem? I respect the dedication to a bit. But we’ve all grown up – except your persona, apparently. Let it rest.”
Against 14 – Public marking despite geographic distance
Reply: “You’re in Europe, I’m in the US, and yet here you are, managing to make it weird. That’s almost impressive. Almost. Let’s use that energy for something positive – like a group chat about boundaries.”
Against 15 – Co‑opting your reunion as implied permission
Reply: “The reunion was for catching up, not for commenting on my body. I didn’t send out invitations to my personal space. Let’s keep the conversation in the ‘old friends’ lane.”
Against 16 – Testing whether you have changed (still prey?)
Reply: “You’re checking if I’m still the same person? I’m not. I now have a ‘weird comment’ bingo card, and you just gave me a square. Want to play for something else? Like ‘genuine catch‑up’?”
Against 17 – Deliberate choice to remain a predator (APT persistence)
Reply: “You’ve decided to keep this pattern alive. I’ve decided to keep receipts alive. Neither of us is going anywhere – but only one of us is having fun. Let’s both choose fun. Try a normal compliment.”