We analyze a sequence of aftershocks of the 2017 nuclear explosion at the North Korea test site. Cross correlation is a powerful tool that takes advantage of waveform similarity to improve detection and location by 1–2 orders of magnitude as compared to analyzing events one‐at‐a‐time. It can also help identify event type because if an event correlates well with another of known type, then it is likely of the same type. For a cluster of 13 aftershocks, we are able to achieve location estimates with high precision: the means of the 95% confidence ellipse semimajor and semiminor axes are only 69 and 19 m. The standard deviation of the residuals is only 0.0089 s, which is subsample and explains the residuals better than our starting locations. We are able to image a fault 700 m long and conclude from correlation and location data that these events are all earthquakes. Complementary and independent analysis using P/S spectral ratios measured at only one station initially classified 12 of the events as earthquakes and 1 as an explosion, but the latter event appears to be a misclassification due to noise at one station. That one event appears to be earthquake‐like even at that station, based on the similarity of the Lg waves with other events. The statistical significance of our results increases substantially combining our discriminant, correlation, and location data. We conclude that these events comprise an aligned cluster of small earthquakes, with a near‐zero probability of misclassification.