 imposterandClaude Opus 4.8
|
d3d3538f17
|
content: chokepoint, trends, and framework updates
Refresh chokepoint YAML entries, trends pages (incl. masq-infra rewrite), framework page, search index script, build aggregation, and pixel nav/section icons.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
2026-06-11 08:13:50 -06:00 |
|
|
imposterandClaude Sonnet 4.6
|
2a4d06baef
|
fix(yaml): fix mapping-values-not-allowed parse errors in 3 chokepoints
Plain scalars with "key: value" patterns (authenticationProtocol: deviceCode,
incomingTokenType: primaryRefreshToken, Account Discovery/Manipulation colons)
rejected by PyYAML. Fixed with > block scalar indicators and quoted Name/TheConstant
values.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
2026-05-29 19:57:01 -06:00 |
|
|
imposterandClaude Sonnet 4.6
|
424a81212a
|
feat(chokepoints): add 4 AiTM Tycoon 2FA chokepoints from Elastic research (2026-05-27)
Promotes intel-pipeline drafts to canonical chokepoints/. All entries sourced
from Elastic Security Labs Tycoon 2FA AiTM detection engineering article.
New entries:
- credential-access/aitm-websocket-relay (T1539, T1078.004) -- CRITICAL
Node.js UA on Entra sign-in + two-tier ASN correlation. Covers Tycoon 2FA
and EvilProxy variants.
- defense-evasion/oauth-device-code-phishing (T1550.001) -- HIGH
MAB app ID + deviceCode + isInteractive = high-confidence victim redemption.
CA policy "Block device code flow" documented as prevention.
- discovery/graph-api-recon-burst (T1087.004, T1069.003, T1526) -- HIGH
4+ Graph API endpoint categories in 60s = automated operator console.
Requires Graph Activity Logs. c_sid pivot mistake documented.
- persistence/aitm-device-prt-enrollment (T1098.005) -- HIGH
axios UA on DRS enrollment generates audit event; device PRT survives
revokeSignInSessions. IR playbook fix: delete devices BEFORE revoking.
12 Sigma rules (research/hunt/analyst per chokepoint). KQL implementations
documented inline for graph-api-recon-burst and aitm-device-prt-enrollment
analyst rules that require multi-table correlation.
Pending lab validation (documented inline):
- RawLogs samples not yet attached
- filter_legit_automation placeholders need tenant-specific UPNs
- AuditLogs UserAgent field name to verify for prt-enrollment
- graph-api-recon-burst: KQL required (Sigma cannot express category-count)
Closes: intel/aitm-drafts-2026-05 (drafts branch; this promotes to canonical)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
2026-05-29 15:07:53 -06:00 |
|