Detection Chokepoints

TTPs evolve. Chokepoints don't.

Attack prerequisites that cannot be bypassed regardless of tool choice. High-signal, low-volume detection opportunities for every defender.

Every entry below targets an invariant prerequisite that attackers cannot bypass regardless of tool choice. Detections anchored to these chokepoints survive tool rotation, obfuscation, and variant evolution. Learn the framework →

? Badge guide
Research Broad baseline, high noise, not for alerting
Hunt Behavioral context, moderate noise, analyst triage
Analyst Production-ready, low noise, SOC alerting
Pre-Exec Fires before execution. ETW, web proxy, IOK.
High FP Expect significant noise
Medium FP Moderate noise, tune for your environment
Low FP Safe for production
New Added in latest update
Updated Modified in latest update
Tactic
Priority