--- layout: default title: Chokepoint Identification Framework description: A practical methodology for identifying durable detection chokepoints. For every technique, ask what must be true and what the attacker cannot control. Detect the invariant, detect all variations. ---

Chokepoint Identification Framework

For every technique: what must be true, and what can't the attacker control? Those invariants are chokepoints - detect them, catch every variant.

Adapted from Matt Graeber's threat research methodology at Red Canary.

The 6-Step Process

Steps 1–3 scope the technique. Step 4 finds the chokepoint. Steps 5–6 make it a detection.

1

What is this technique at a technical level?

Define the objective. What does the attacker need to accomplish? Gain initial access? Move laterally? Evade defenses?

Click to see example
2

What must be true for it to succeed?

Identify the required components. Every prerequisite that must be satisfied, regardless of the tool used.

Click to see example
3

What does the attacker control?

The variables. Tool choice (Impacket, CrackMapExec, PsExec), obfuscation methods, infrastructure, binary names.

Click to see example
4

What can't the attacker control?

THIS IS THE CHOKEPOINT

The prerequisites from step 2 that no tool rotation, obfuscation, or variant can eliminate. These are your detection anchors.

Click to see example
5

Can we observe it?

Map to log sources and telemetry. Sysmon event IDs, ETW providers, network artifacts, EDR hooks.

Click to see example
6

What are all the variations?

Every tool and method that shares this chokepoint. One detection anchored to the invariant covers all of them.

Click to see example
Step 1 example

Detection Maturity Model

Start broad, refine to production. Don't skip levels - the research rule is the baseline you tune from.

Research

Establish visibility

Baseline understanding of the chokepoint in your environment. High false positive rate expected. Not for alerting.

process_creation where ParentImage endswith 'services.exe' and LogonType = 3
FP Rate: HIGH Use: Threat research, baselining
Hunt

Reduce noise, keep coverage

Add context: parent process constraints, user filtering, timing windows. Noise drops. Coverage holds.

process_creation where ParentImage endswith 'services.exe' and LogonType = 3 and User != 'SYSTEM' and Image not in (known_service_binaries)
FP Rate: MEDIUM Use: Active hunting, campaigns
Analyst

Production SOC alerting

High-fidelity, correlated events. Minimal false positives. Your SOC acts on these without second-guessing.

process_creation where ParentImage endswith 'services.exe' and LogonType = 3 and User != 'SYSTEM' and Image not in (known_service_binaries) and Image path not in (Program Files, System32) and correlated with EID 4624 Type 3 within 5s
FP Rate: LOW Use: SOC alerting, automated IR
Research → Hunt → Analyst

Chokepoint Detection vs. Tool Detection

FRAGILE Tool Detection

  • Detects a specific tool by name or hash
  • Breaks when the tool is renamed or replaced
  • Narrow coverage: one threat family
  • Requires constant signature updates
  • High long-term maintenance cost
CommandLine contains "psexec.exe"
// Bypassed by: renaming, different tools

DURABLE Chokepoint Detection

  • Detects the requirement the tool must satisfy
  • Survives tool rotation, obfuscation, and variation
  • Broad coverage: all families sharing the chokepoint
  • Durable. New tools hit the same chokepoints.
  • Low long-term maintenance cost
Service creation via network logon
// Catches: psexec, wmiexec, smbexec, future tools

Chokepoint Relationship Map

How chokepoints connect to MITRE ATT&CK techniques, tactics, and tool variations. Click a tactic to filter. Click any node to explore.

Chokepoint MITRE Technique Tactic Variation (click chokepoint to expand)

Testing Your Chokepoint

Four questions. All must be yes for a valid, durable chokepoint.

Can the attacker avoid it?

Can they achieve the objective without meeting these conditions? If no, valid chokepoint.

Does it survive tool rotation?

Does this detection break if the attacker switches tools? If no, good chokepoint.

Does it cover multiple families?

Does this detection apply to more than one tool or malware family? If yes, strong chokepoint.

Will it still work in 6-12 months?

Is this detection likely to remain effective without constant tuning? If yes, durable chokepoint.

Start Building

Pick a chokepoint. Apply the 6 steps. Write your first detection.

Browse Chokepoints View Attack Chains Contribute