Audit of the live site found 42 OSINT pivot cards: 1 real pivot with
no URL at all (aitm-websocket-relay), and 4 whose link diverged from
the query shown on the card. Policy applied: the query on the card is
exactly what the link executes; where a platform cannot express the
query, the displayed query is rewritten to the platform's real syntax.
- aitm-websocket-relay/URLScan: original query was invalid on the
platform (page.ip.asn is not a field; filename:*.js is a rejected
leading wildcard). Rewritten to (page.asn:AS37963 OR page.asn:AS9009)
AND page.status:200 AND page.mimeType:"application/javascript" -
verified live, 1583 results as of 2026-07-13 - and URL added
- lsass/LOLDrivers: site has no deep-linkable query syntax; displayed
query is now the free-text term to type (lsass), guidance in Notes
- lsass/ANY.RUN: ?search= URL parameter is ignored by the app
(verified live); same free-text treatment (sekurlsa)
- edr-bypass/GitHub: link now carries the full query incl. the
(path:*.c OR path:*.asm) qualifiers; query parenthesized
- renamed-rmm/VirusTotal: link now carries all four metadata: terms,
not just AnyDesk
- schema/chokepoint-schema.yml: document the URL field (template had
it, schema did not - why contributors kept omitting it)
graph-api-recon-burst's N/A card is intentional (not externally
observable) and left as-is.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W87Fdr8vD1ZiR8jumj4Ud5
Homepage-only nav CTA, homepage prevention card, and per-chokepoint Prevention Opportunities with MagicSword affiliate callouts. Replace the opaque-background logo with a transparent emerald PNG and drop the colour-inverting filter so it renders correctly in nav/card/chip on both themes.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Update 9 published chokepoints with accuracy fixes and variant additions.
Update layouts, attack chains, trends pages, and framework content.
Note: _config.yml, _includes/nav.html, assets/css/style.css, and index.html
contain in-progress MagicSword affiliate integration -- held back from this PR.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Condense Logic fields across 8 chokepoint pages (22 blocks total) from pseudocode-style WHERE/AND/OR constructs into plain-language 1-3 sentence descriptions matching the clickfix reference pattern. Technical specificity preserved (event IDs, access masks, paths, thresholds).
- LSASS page: align structure with clickfix template (remove redundant AttackerControls/AttackerCannotControl blocks, reformat RawLogs samples to match clickfix style with Key signal comments, add URL fields to OSINT pivots so queries are clickable)
- Layout: remove tier badges from chokepoint stage headers and raw log sample cards so badges only appear on Sigma rule examples where they add context. Switch detection logic block from white-space:pre to pre-wrap with word-break so long rules wrap instead of hiding under the horizontal scrollbar.
- Remove remaining em dashes from chokepoint layout intro copy ("Each stage is an invariant condition...", "Tools and methods that exploit this chokepoint...")
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Add .sigma-block--research/hunt/analyst with 4px left border accent (UX-02)
- Add .sigma-btn.copied rule with green color and border feedback (UX-01)
- Update copyCode() to toggle .copied class on click and remove after 1.8s (UX-01)
- browser-credential-theft.yml: rewrite Description to lead with invariant (target paths), break stat dump into short sentences; fix em dashes in Invocation and References Name fields
- web-shells.yml: rewrite Description to open with mechanism ("A script lives in the web root"); fix em dashes in Invocation code comments, detection logic, and References Name fields
- renamed-rmm-tools.yml: rewrite Description to drop passive opener, state 4-step invariant concisely; fix em dashes in Invocation code comments, Sources list items, and References Name fields
- byosi-scripting-interpreters.yml: rewrite Description to drop "Adversaries bring" opener, lead with vendor-signed interpreter pattern; fix em dashes in References Name fields
- ransomware-service-manipulation.yml: rewrite Description to drop "This service manipulation phase" opener, tighten to five short sentences; fix em dash in Invocation code comment; preserve Windows Event Log quoted strings (Service State Change, Service Start Type Changed)
Remove em dashes from prose throughout all 7 remaining chokepoints,
replacing with periods, commas, or semicolons for tighter writing.
Remove AttackerControls/AttackerCannotControl bulleted lists (redundant
with chokepoint stage descriptions). Intel reference names preserved.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Merge variant cards and evolution timeline into single chronological view
- Add click-to-filter: chip selection highlights related timeline entries
- Add per-variant intel links for analyst pivoting to threat reports
- Add variant chip strip for quick scanning of all variants with status
- Add TheConstant box showing the invariant detection anchor
- Update all 7 chokepoint YAML files with VariantId and EventType fields
- Update chokepoint layout template with combined section and filtering JS
- Add new CSS for combined timeline, chips, filtering states, and intel links
YAML: Removed variant-specific, single-incident, secondary, and annual
report entries from all 7 chokepoint Intel sections. Migrated variant-
specific sources to SourceURL on variation cards (Commit 3). Added
Tier: primary to entries that lacked the field. No Tier: supporting entries
remain in any chokepoint file.
Entry counts after trim:
clickfix: 18 → 9
renamed-rmm: 7 → 4
edr-bypass: 10 → 4 (Tier field added to all kept entries)
ransomware-svc: 8 → 3
browser-credential: 9 → 5 (Tier field added to all kept entries)
web-shells: 10 → 5 (Tier field added to all kept entries)
remote-execution: 9 → 7
Layout: Replaced tiered Intel rendering (primary card grid + supporting
collapsible toggle) with a uniform flat link list — title (link) + one
sentence description. Removed intel-card, intel-grid, intel-card-name,
intel-card-desc, intel-linked, intel-link-tag, intel-supporting-toggle CSS.
Removed intel-supporting-toggle JS event handler.
https://claude.ai/code/session_018xsxUHnwvGtKP6J2W69qa5
YAML: Added SourceURL to top-level Variations entries across all 7
chokepoint files (24 total). One authoritative primary source per variant;
omitted field where no clear primary source exists. No SourceURL added to
nested structures (MasqueradeThemes in renamed-rmm-tools).
Layout: Added .variant-source-link CSS class (small monospace text, subtle
accent border, hover underline — matches chain-sigma-link pattern). Added
{% if v.SourceURL %} footer block to var-card template rendering
"Source →" link at the bottom of each variation card.
https://claude.ai/code/session_018xsxUHnwvGtKP6J2W69qa5
Added NotesShort (<=20 words) before Notes on every Variation entry across
all 4 chokepoint YAML files. Replaced the Variations HTML table in
chokepoint.html with a 2-col card grid showing Name, FirstSeen, Status badge,
and NotesShort by default; full Notes revealed via inline More/Less toggle.
Added corresponding CSS and expand/collapse JS.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds a new `Chokepoints:` YAML block to all four chokepoint entries
(ClickFix, Renamed RMM Tools, Ransomware Service Manipulation, Remote
Execution Tools), each with Stage, Invariant, WhyCantBypass, LogSources,
DetectionTier, SigmaRef, and optional BypassNote fields per attack stage.
Layout: replaces the flat Prerequisites section with a trimmed
environmental-precondition list, then adds a new collapsible Detection
Chain section — numbered stage bubbles, tier badges (Research/Hunt/Analyst)
with urgency subtitles (Baseline / Active Hunt / SOC Alert), segmented
connector lines, and a red BypassNote callout on affected stages.
Schema and template updated with Chokepoints block definition.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Applied the same methodology used for clickfix-techniques.yml to evaluate
and improve the OsintSources blocks in all five remaining chokepoint files.
renamed-rmm-tools.yml (moderate):
- Expanded URLScan filename query with support*.exe and verify*.exe pretexts
- Updated Shodan note to also cover SimpleHelp (CISA AA25-163A, June 2025)
- Replaced Censys AnyDesk cert query with SimpleHelp (AnyDesk certs were
revoked after the Feb 2024 breach, making that query largely historical)
- Added VT Intelligence PE metadata query for renamed RMM binaries in the wild
- Added LOLRMM.io — the community catalog of RMM tool file/network indicators
remote-execution-tools.yml (significant):
- Removed port:445 country:US — returns millions of results with zero
signal for hunting attack infrastructure; was an exposure audit query,
not a threat hunting query
- Repositioned WinRM query with clearer notes about its scope (exposure
audit, not attacker infra hunting)
- Added Shodan JARM fingerprint query for Cobalt Strike team servers —
the correct approach for hunting C2 infra paired with Impacket/NetExec
- Added hunt.io for real-time C2 infrastructure mapping
ransomware-service-manipulation.yml (minor):
- Fixed ANY.RUN URL from general trends page to the actual public
submissions feed with ransomware filter
- Added Ransomware.live for real-time ransomware group activity tracking
- VT Intelligence and GitHub queries were solid; kept as-is
web-shells.yml (minor):
- Expanded Shodan title query with FilesMan and Antak Webshell
- Expanded URLScan filename query with webshell.php and cmd.aspx
- Added Censys eval(base64_decode) query for live obfuscated PHP shells
- VT Intelligence tag:webshell query was the strongest in any file; kept
edr-bypass-techniques.yml (minor):
- Added LOLDrivers (loldrivers.io) — the canonical community catalog of
vulnerable and malicious drivers used in BYOVD attacks; was absent
entirely despite being the most important resource for this chokepoint
- All three existing queries were solid; kept as-is
https://claude.ai/code/session_01CeEB6yuJimygkCBi7ubSh3
Five Name fields containing ": " were parsed as YAML mapping separators.
Wrapped affected values in double-quotes across three chokepoint files.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
