---
layout: default
title: Detection Chokepoints
description: "Community resource for detection engineering: high-signal chokepoints that every attacker must pass through."
---

<section class="hero py-16 px-6 text-center overflow-hidden relative">
  <div class="max-w-2xl mx-auto relative">
    <h1 class="hero-title mb-2">Detection Chokepoints</h1>
    <p class="hero-tagline mb-4">Detection is a game of economics.</p>
    <p class="hero-sub">Make it expensive for attackers to avoid your detections.</p>
  </div>
</section>

<!-- ── Intro + Badge Legend ──────────────────────────────────────── -->
<section class="max-w-[1100px] mx-auto px-6 pt-8">
  <p style="color: var(--text-muted); font-size: 0.95rem; max-width: 720px; line-height: 1.7; margin-bottom: 0.5rem;">
    Each entry targets an invariant prerequisite attackers can't bypass - detections anchored here survive tool rotation and obfuscation.
    <a href="{{ '/framework/' | relative_url }}" style="white-space: nowrap;">Learn the framework &rarr;</a>
  </p>

  <details class="badge-legend">
    <summary class="badge-legend-toggle">
      <span class="badge-legend-icon">?</span>
      Badge guide
    </summary>
    <div class="badge-legend-body">
      <div class="badge-legend-row">
        <span class="det-rule-badge det-badge-research">Research</span>
        <span class="badge-legend-desc">Broad baseline, high noise, not for alerting</span>
      </div>
      <div class="badge-legend-row">
        <span class="det-rule-badge det-badge-hunt">Hunt</span>
        <span class="badge-legend-desc">Behavioral context, moderate noise, analyst triage</span>
      </div>
      <div class="badge-legend-row">
        <span class="det-rule-badge det-badge-analyst">Analyst</span>
        <span class="badge-legend-desc">Production-ready, low noise, SOC alerting</span>
      </div>
      <div class="badge-legend-row">
        <span class="det-rule-badge det-badge-preexec">Pre-Exec</span>
        <span class="badge-legend-desc">Fires before execution. ETW, web proxy, IOK.</span>
      </div>
      <div class="badge-legend-row">
        <span class="det-rule-badge det-badge-fp-high">High FP</span>
        <span class="badge-legend-desc">Expect significant noise</span>
      </div>
      <div class="badge-legend-row">
        <span class="det-rule-badge det-badge-fp-med">Medium FP</span>
        <span class="badge-legend-desc">Moderate noise, tune for your environment</span>
      </div>
      <div class="badge-legend-row">
        <span class="det-rule-badge det-badge-fp-low">Low FP</span>
        <span class="badge-legend-desc">Safe for production</span>
      </div>
      <div class="badge-legend-row">
        <span class="det-rule-badge det-badge-new">New</span>
        <span class="badge-legend-desc">Added in latest update</span>
      </div>
      <div class="badge-legend-row">
        <span class="det-rule-badge det-badge-updated">Updated</span>
        <span class="badge-legend-desc">Modified in latest update</span>
      </div>
    </div>
  </details>
</section>

<section class="max-w-[1100px] mx-auto px-6 pt-8" aria-label="Search and filter">
  <div class="mb-4">
    <div class="search-box-wrap relative max-w-[640px]">
      <svg class="search-icon absolute left-3.5 top-1/2 -translate-y-1/2" width="18" height="18"
           viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" aria-hidden="true">
        <circle cx="11" cy="11" r="8"/><path d="m21 21-4.35-4.35"/>
      </svg>
      <input
        type="search"
        id="search-input"
        class="search-box w-full rounded-xl text-base py-3 pl-11 pr-12"
        placeholder="Search chokepoints, techniques, MITRE IDs…"
        aria-label="Search chokepoints"
        autocomplete="off"
        spellcheck="false"
      />
      <kbd class="search-shortcut absolute right-3.5 top-1/2 -translate-y-1/2 rounded text-xs px-1.5 py-0.5"
           aria-hidden="true">/</kbd>
    </div>
  </div>

  <div class="filter-row flex flex-wrap items-center gap-2 mb-3"
       role="group" aria-label="Filter by tactic">
    <span class="filter-label text-xs font-semibold uppercase tracking-[.06em] min-w-[4.5rem]">Tactic</span>
    <button class="filter-chip active rounded-full text-[.8125rem] px-3.5 py-1 cursor-pointer"
            data-filter="tactic" data-value="all">All</button>
    <button class="filter-chip rounded-full text-[.8125rem] px-3.5 py-1 cursor-pointer"
            data-filter="tactic" data-value="initial-access">Initial Access</button>
    <button class="filter-chip rounded-full text-[.8125rem] px-3.5 py-1 cursor-pointer"
            data-filter="tactic" data-value="lateral-movement">Lateral Movement</button>
    <button class="filter-chip rounded-full text-[.8125rem] px-3.5 py-1 cursor-pointer"
            data-filter="tactic" data-value="defense-evasion">Defense Evasion</button>
    <button class="filter-chip rounded-full text-[.8125rem] px-3.5 py-1 cursor-pointer"
            data-filter="tactic" data-value="credential-access">Credential Access</button>
    <button class="filter-chip rounded-full text-[.8125rem] px-3.5 py-1 cursor-pointer"
            data-filter="tactic" data-value="execution">Execution</button>
    <button class="filter-chip rounded-full text-[.8125rem] px-3.5 py-1 cursor-pointer"
            data-filter="tactic" data-value="persistence">Persistence</button>
  </div>

  <div class="filter-row flex flex-wrap items-center gap-2 mb-3"
       role="group" aria-label="Filter by priority">
    <span class="filter-label text-xs font-semibold uppercase tracking-[.06em] min-w-[4.5rem]">Priority</span>
    <button class="filter-chip active rounded-full text-[.8125rem] px-3.5 py-1 cursor-pointer"
            data-filter="priority" data-value="all">All</button>
    <button class="filter-chip priority-chip critical rounded-full text-[.8125rem] px-3.5 py-1 cursor-pointer"
            data-filter="priority" data-value="CRITICAL">Critical</button>
    <button class="filter-chip priority-chip high rounded-full text-[.8125rem] px-3.5 py-1 cursor-pointer"
            data-filter="priority" data-value="HIGH">High</button>
    <button class="filter-chip priority-chip medium rounded-full text-[.8125rem] px-3.5 py-1 cursor-pointer"
            data-filter="priority" data-value="MEDIUM">Medium</button>
    <button class="filter-chip priority-chip low rounded-full text-[.8125rem] px-3.5 py-1 cursor-pointer"
            data-filter="priority" data-value="LOW">Low</button>
  </div>
</section>

<section class="results-meta max-w-[1100px] mx-auto px-6 mt-3 text-[.8125rem] min-h-[1.4rem]"
         aria-live="polite" aria-atomic="true">
  <span id="results-count"></span>
</section>

{% if site.magic_sword_enabled and site.magic_sword_affiliate_url %}
<section class="max-w-[1100px] mx-auto px-6 mt-6 mb-1">
  <div class="ms-home-card">
    <div class="ms-home-card-inner">
      <div class="ms-home-card-icon" aria-hidden="true">
        <img src="{{ site.magic_sword_logo_path | relative_url }}" alt="MagicSword" width="40" height="40" />
      </div>
      <div class="ms-home-card-body">
        <span class="ms-home-card-label">Prevention &middot; Application Control</span>
        <p class="ms-home-card-text">
          Detection finds RMM/LOLBAS abuse. Application control stops it pre-execution.
          <a href="{{ site.magic_sword_affiliate_url }}"
             target="_blank" rel="noopener sponsored"
             class="ms-home-card-link">
            Learn how MagicSword blocks RMM / LOLBAS abuse &#8594;
          </a>
        </p>
      </div>
    </div>
  </div>
</section>
{% endif %}

<main id="chokepoints-grid"
      class="max-w-[1100px] mx-auto px-6 mt-5 mb-16 grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-4"
      aria-label="Chokepoints">
  {% if site.data.chokepoints %}
  {% assign sorted = site.data.chokepoints | sort: "DetectionPriority" %}
  {% for cp in sorted %}
    {% include chokepoint-card.html cp=cp %}
  {% endfor %}
  {% endif %}
</main>

<div id="no-results" class="no-results max-w-[1100px] mx-auto px-6 my-12 text-center" hidden>
  <svg width="48" height="48" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" aria-hidden="true">
    <circle cx="11" cy="11" r="8"/><path d="m21 21-4.35-4.35"/>
    <path d="M8 11h6M11 8v6" transform="rotate(45 11 11)"/>
  </svg>
  <p class="text-[1.1rem] mt-4 mb-5">No chokepoints match your search.</p>
  <button id="clear-search" class="btn-outline rounded text-sm px-5 py-2">Clear filters</button>
</div>

<script>
  // Pass Jekyll data to JS
  window.CHOKEPOINTS_DATA = {{ site.data.chokepoints | jsonify | replace: '</', '<\/' }};
  window.SITE_BASEURL = "{{ site.baseurl }}";
</script>
<script src="{{ '/assets/js/fuse.min.js' | relative_url }}"></script>
<script src="{{ '/assets/js/search.js' | relative_url }}"></script>