Detection Chokepoints

Detection is a game of economics.

Make it expensive for attackers to avoid your detections.

Each entry targets an invariant prerequisite attackers can't bypass - detections anchored here survive tool rotation and obfuscation. Learn the framework →

? Badge guide

Research Broad baseline, high noise, not for alerting

Hunt Behavioral context, moderate noise, analyst triage

Analyst Production-ready, low noise, SOC alerting

Pre-Exec Fires before execution. ETW, web proxy, IOK.

High FP Expect significant noise

Medium FP Moderate noise, tune for your environment

Low FP Safe for production

New Added in latest update

Updated Modified in latest update

Tactic

Priority

Prevention · Application Control

Detection finds RMM/LOLBAS abuse. Application control stops it pre-execution. Learn how MagicSword blocks RMM / LOLBAS abuse →

AiTM WebSocket Kit Relay

Adversary-in-the-Middle (AiTM) kits operate a server-side WebSocket reverse proxy (typically Node.js + Socket.IO) tha...

T1539 T1078.004

THE CONSTANT Server-side relay → Node.js HTTP client UA on Entra ID / Google sign-in event...

Infostealer Browser Credential Theft

Infostealers harvest credentials, cookies, and autofill data from browser credential databases. The invariant across ...

T1555.003 T1539 T1041

THE CONSTANT Stealer process → Login Data / logins.json file read → CryptUnprotectData() /...

LSASS Credential Dumping

To extract plaintext credentials, NTLM hashes, or Kerberos tickets from a live Windows system, an attacker must read ...

T1003.001 T1003 T1547.005

THE CONSTANT A process must open a kernel-mediated handle to lsass.exe and read its virtua...

EDR Bypass Techniques

Adversaries impair or neutralize EDR/AV products before executing their primary payload to prevent detection and resp...

T1562.001 T1562.006 T1055.001 +1

THE CONSTANT Admin/SYSTEM privileges → bypass mechanism → security telemetry impaired

Ransomware Service Manipulation

Before encrypting files, ransomware operators stop and delete security tools, backup services, and database engines t...

T1562.001 T1489

THE CONSTANT SYSTEM-level process → service enumeration → bulk service stop/delete → encry...

Web Shell Persistence

Adversaries plant web-accessible scripts (web shells) on compromised servers to maintain persistent command execution...

T1505.003 T1190 T1059.004

THE CONSTANT HTTP request → web server process → child OS interpreter

BYOSI Scripting Interpreters

Adversaries bring legitimate, vendor-signed scripting interpreters (Python, PHP, Node.js, Ruby, Perl, AutoHotKey, etc...

T1059.006 T1059.007 T1059 +2

THE CONSTANT Non-default interpreter binary written to disk → interpreter process launched...

OAuth Device Code Phishing via Auth Broker

Adversaries abuse the OAuth 2.0 device authorization grant flow to obtain Microsoft access and refresh tokens without...

THE CONSTANT authenticationProtocol: deviceCode + MAB app ID 29d9ed98-... + resultType 0 +...

Post-AiTM Graph API Reconnaissance Burst

Within 10-20 minutes of successful AiTM session token theft, Tycoon 2FA's operator console tier executes an automated...

T1087.004 T1069.003 T1526

THE CONSTANT 4+ distinct Graph API endpoint categories (role/cross-tenant/mailbox/contact/...

ClickFix Techniques

User pastes a malicious command from their clipboard into a Run dialog, terminal, or Explorer address bar. The lure p...

THE CONSTANT Clipboard write → user pastes into interpreter → outbound C2 connection

Renamed RMM Tools

Legitimate RMM tools are renamed or masqueraded to appear as trusted applications (tax documents, invoices, IT suppor...

THE CONSTANT Browser download → renamed signed binary execution → persistent RMM C2 connec...

Remote Execution Tools (HackTools)

Offensive security tools (Impacket, NetExec, CrackMapExec, Evil-WinRM) used for remote code execution across Windows ...

T1021.002 T1021.003 T1021.006 +3

THE CONSTANT Valid admin credentials → authenticated protocol (SMB/WMI/WinRM) → remote com...

AiTM Kit Device PRT Enrollment

After capturing a victim's session via AiTM proxy, the Tycoon 2FA kit registers a synthetic device with Microsoft Dev...

THE CONSTANT DRS EnrollmentServer/device call with non-native UA (axios/1.15.2 not Dsreg) ...