Re-source ClickGrab ingest off the dead Git-LFS path onto raw GitHub blobs and re-architect the ClickFix trends page around three feeds, each used only for what it is reliable for (DECISIONS #010-012).
Ingest (#010-011): fetch MHaggis ClickGrab as raw blobs (upstream LFS quota exhausted); append-only idempotent volume generator + daily GHA for volume and Carson gist landscape count.
Behaviour (#012): rebuild the per-domain command classification from Carson's ClickFix Hunter export (build_domain_monthly.py) and re-plumb charts/cards to it, separating hex-XOR from base64 (the prior site-crawl source conflated them and measured ~93-99% noise). Trends prose corrected to the honest figures: May base64 69% (316/458), inline 95.2%, Nov msiexec 87% (669/767).
Workstream B: rank MHaggis lure-page HTML keywords (build_lure_keywords.py) into data-driven URLScan OSINT pivots on the clickfix chokepoint and enrich the multilingual IOK matcher.
Validated: scripts/validate_schema.py passes (13 chokepoints, 3 trends files). Deferred: two classifier regex bugs distort Dec-Apr months only; headline figures robust (DECISIONS #013).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Keep docs/M3-PROVENANCE-PLAN.md out of the public repo, matching the internal-material convention (DECISIONS.md, ATTEMPTS.md, .planning/). It is internal research synthesis for a separate workstream (DECISIONS #007), not site content.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Enrichment touches IPs/keys/external lookups and must not live in the repo --
the repo holds only published site data (decision #009). Mirrors the existing
scripts/enrich_staging_domains.py entry. The scripts run locally and write only
IP-free aggregates to cache/, which the page publishes.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
validate_schema.py now also checks the generated trends data files
(edge_exploits, clickgrab_trends, masq_infra_hunts) against the structure
their page templates depend on: required meta keys, list sections, and the
field types the templates do date/number work on. Catches a transform bug or
hand-edit that would render a page blank or break the build.
- declarative TRENDS_SPECS per file; each validated only once it goes data-driven
- validate-data.yml now also triggers on _data/** changes
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Classify each Defused alert by its Alert verb -- weaponized exploitation
("Vulnerability Exploited") vs targeted recon (probing / vuln-check /
exposure) -- and surface two views on the edge-exploits page:
- daily stacked exploitation-vs-recon chart (live window; 67% / 33%)
- per-CVE recon->exploit lead-time table, where probing preceded the first
weaponized hit (e.g. CVE-2025-55182 led by 6 days)
No export change -- pure classification of the existing high/critical data.
Live window only (the baseline kept no per-alert verbs). Aggregates only; no IPs.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The infra-malware-delivery-hunter skill writes hunt intel to the local
de-intel-pipeline; transform_intel_hunts.py aggregates it into
_data/masq_infra_hunts.yml. That data file was gitignored from when the
workflow was being tested, so the trends page guard
(`{% if site.data.masq_infra_hunts %}`) silently hid the section on the
live site. Un-ignore it (and its producer) so the section publishes.
- un-ignore _data/masq_infra_hunts.yml + scripts/transform_intel_hunts.py
- commit the current aggregated data (5 hunts, 5 brands)
- add scripts/refresh_masq_infra.py: local weekly refresher that
regenerates from the hunts folder and opens a review PR only when real
hunt data changed (ignores the generated: timestamp); preserves the
working tree when run unattended
enrich_staging_domains.py stays ignored (belongs to the clickgrab trend).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Adds scripts/validate_schema.py and a validate-data.yml PR gate that
checks every chokepoints/*/*.yml against schema/chokepoint-schema.yml:
required fields, enum values, UUIDv4/ISO-date/MITRE-id formats, tactic
folder consistency, and that referenced Sigma paths exist on disk.
(Replaces the validate_schema.py that cp-drafter referenced but was
never created.) Validator tolerates the authored conventions for
Variations.Status and ExpectedFPRate (leading token + detail).
Fixes surfaced by the validator/link audit:
- 2 invalid Ids regenerated as real UUIDv4 (ransomware-service-
manipulation, remote-execution-tools)
- 4 dead reference citations repaired (Proofpoint moved URL; Trustwave
via Wayback; Metasploit psexec -> GitHub docs; BleepingComputer had a
wrong slug -> correct article)
Adds scripts/check_links.py — advisory external-link sweep (not a CI
gate; external links flake). Buckets BROKEN vs BLOCKED vs OK so API
endpoints and bot-blocked blogs are not mistaken for rot.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
First-run Dependabot opened one PR per outdated dependency across 4
ecosystems (a dozen+ at once). Group all bumps per ecosystem into a
single PR and switch weekly -> monthly so a scan yields at most ~4 PRs.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
XSS:
- Escape `</` in all 5 jsonify-into-<script> data blobs so contributed
YAML cannot break out of the script context (verified: JSON still
parses, no </script breakout)
- Add `| escape` to contributor-controlled fields in chokepoint-card.html
and ~71 value outputs in the chokepoint detail layout
Supply chain (SRI):
- Pin highlight.js, d3, and Chart.js CDN includes with sha384 integrity +
crossorigin (hashes computed from the immutable versioned URLs)
- Document why cdn.tailwindcss.com cannot take SRI + the real fix
GitHub Actions:
- SHA-pin all 7 third-party actions to commit SHAs (version in comment)
Governance:
- SECURITY.md (private disclosure policy + scope: detection content is
intentional, not a vuln)
- CODEOWNERS routing review to @iimp0ster
- Dependabot for github-actions / bundler / npm / pip
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
1200x630 og:image in the playingwithpackets card style: navy field,
Press Start 2P title, tagline, framed arcade artwork strip, site URL.
Wired site-wide via jekyll-seo-tag front matter defaults with
twitter:card summary_large_image; pages can override with their own
image front matter.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Chokepoint index: 9 -> 13 entries (adds AiTM WebSocket Kit Relay,
OAuth Device Code Phishing, Graph API Recon Burst, Device PRT
Enrollment); names and tactic columns now match the canonical YAML
- Why This Exists: replace misattributed dwell-time stat with verified
figures (M-Trends 2025 median dwell 11 days; Unit 42 GIRR 2026
first-quartile time-to-exfiltration 72 minutes)
- Attack chains: fill in ransomware coverage (260 procedures, 36 reports)
- Trends: add missing Software Impersonation Infrastructure entry;
refresh ClickFix and Edge Exploit figures to current dashboards
- Framework: question list now verbatim with the site; mention the
interactive relationship map
- New Prevention Layer section (per-chokepoint prevention opportunities
+ MagicSword application-control mapping)
Audited against the live site and chokepoint YAMLs as of 2026-06-12.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
RNC-with-body-triangle artwork in a versus-game frame with the Press
Start 2P title band and tagline, matching the Tacklebox README lockup.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Replace the overflowing right-column mobile menu with a full-screen overlay: decluttered top bar (brand + hamburger), one item per row with large tap targets, a collapsible Trends accordion (no longer dumped inline), and theme/GitHub/MagicSword in a footer row. Move the overlay outside .site-nav so position:fixed isn't trapped by the nav's backdrop-filter containing block, and bind the theme toggle to all .js-theme-toggle buttons. Desktop nav unchanged.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
On <=900px the Press Start 2P brand (~240px) collided with the nav toolbar. Pare the toolbar to theme + hamburger (GitHub stays in the menu's Contribute, MagicSword on the homepage card), shrink the brand to .6rem, and cap its width with ellipsis so the full title fits at 375px and truncates cleanly on narrower screens. Desktop unchanged.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Homepage-only nav CTA, homepage prevention card, and per-chokepoint Prevention Opportunities with MagicSword affiliate callouts. Replace the opaque-background logo with a transparent emerald PNG and drop the colour-inverting filter so it renders correctly in nav/card/chip on both themes.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
D3-based TTP graph (graph/list toggle, actor filtering, zoom/pan) on attack-chain pages, with supporting diagram/flow include updates and chain content.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Keep GSD planning, draft detections, mockups, local intel hunt data, and intel-pipeline scripts out of the public repo.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Section icon HTML was committed without its companion CSS, leaving
SVGs unconstrained and rendering full-page on all chokepoint pages.
Inlines the four missing rules directly in chokepoint.html until
assets/css/style.css is committed as part of the MagicSword rollout.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Payload Note and variant Notes fields output unescaped, so literal HTML
tags in YAML prose (e.g. "<a> element" in DownloadFix variant note) were
parsed by htmlproofer as real anchor tags with missing href.
Add xml_escape to p.Note, v.Notes/NotesShort, and src.Notes outputs.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Jekyll builds with --baseurl "/detection-chokepoints", so all absolute
links in the HTML carry that prefix. htmlproofer checks these against
_site/ directly, so without --swap-urls it looks for
_site/detection-chokepoints/... instead of _site/... and fails on
every internal link — CSS, nav, chokepoint cross-refs, everything.
--swap-urls "^/detection-chokepoints:" strips the prefix before each
path lookup, making the checker match the actual _site/ layout.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Lure files use bare <a> elements intentionally (defanged phishing samples).
Add --ignore-files regex to skip the entire lures directory.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Pin gem to ~> 5.2 to prevent future silent upgrades
- Drop OpenGraph from --checks (not valid in 5.x; valid: Links,Images,Scripts)
- Add explicit .html argument to --assume-extension (required in 5.x)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Flag format changed between 4.x and 5.x; pattern was being treated as a
directory path. Redundant anyway since --disable-external skips all
external URLs including github.com links.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
--check-html and --typhoeus-config were removed in html-proofer 5.x.
Replace with --checks Links,Images,Scripts,OpenGraph (explicit defaults).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Update 9 published chokepoints with accuracy fixes and variant additions.
Update layouts, attack chains, trends pages, and framework content.
Note: _config.yml, _includes/nav.html, assets/css/style.css, and index.html
contain in-progress MagicSword affiliate integration -- held back from this PR.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Added a hamburger menu for mobile view, improving accessibility and usability on smaller screens.
- Updated navigation links to be more flexible and responsive, adjusting layout based on screen size.
- Introduced styles to prevent horizontal overflow for images and other media.
- Enhanced the overall structure of the navigation bar for better alignment and spacing.
This update aims to create a more user-friendly navigation experience across different devices.
The previous README was outdated (chokepoint count off by 2, no mention of 3 of the 5 attack chains, no trends section, framework section referenced only FRAMEWORK.md instead of the live framework page) and written in a tone that didn't match the rest of the site's voice.
This rewrite:
- Opens with the value prop in two sentences instead of the Thermopylae/Fulda Gap analogy (moved to framework page where it belongs)
- Leads Why This Exists with the Kaspersky 8/8 finding and the broader 5-chain convergence result from the Kitsune + ORKL rebuild, ties dwell time compression (Mandiant M-Trends 2025) to why chokepoints matter now
- Corrects chokepoint index from 7 to 9 entries (adds LSASS Credential Dumping and BYOSI Scripting Interpreters which were missing)
- Adds Attack Chains section listing all 5 chains with shared-technique counts
- Adds Trends section (ClickFix ClickGrab + Defused Cyber edge-exploit telemetry)
- Framework section now points at the interactive page, not the markdown file
- Contributing section aligns with the partial-contributions tone used on CONTRIBUTING.md
- Resources table adds Kitsune, ORKL, and Defused Cyber as first-class sources
- 0 em dashes (was 18). Peer-to-peer voice throughout.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- ttp-vertical-diagram.html: TTP card legend (applies to all attack chain pages via shared include)
- attack-chain.html: Chokepoint Convergence Principle callout and Actor Convergence Matrix description (applies to all attack chain pages via shared layout)
Replaces em dashes with periods or commas per project style. No content changes.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Both trend pages now include paired collapsible blocks on each detection recommendation: one for real observed payloads (IOCs from the source dataset) and one for example Sigma-style detection logic. Formats match across the two pages.
clickgrab.md
- Add Example detection logic to all 7 detection recommendations (T1059 unusual parent->PS, cradle-agnostic network fetch, T1027 Base64 decode+execute, T1070 self-delete, INFRA CDN staging, T1218 MSIExec, T1059 inline decode-and-execute)
- Add Observed payloads collapsibles for T1218 MSIExec (3 examples) and T1059 inline decode (3 examples)
- Defang all malicious IOCs: shift-art.com, verifyhumanbot.com, port-5506 staging IPs
- Align h1 with colon separator instead of em dash
edge-exploits/index.html
- Add Observed payloads collapsibles to all 6 detection recommendations populated with real honeypot data (SD-WAN DCA bypass, Wildfly webshell upload, CitrixBleed 2, Bearer-token SQLi, pipe-to-shell, DCA credential access)
- Defang all malicious IOCs: CitrixBleed 2 operator IPs, pipe-to-shell staging (kernel.sh, moneroocean, 83.142, miso88, apache.selfrep), Ivanti reverse shell target, FortiWeb CIDR ranges, multi-device operator IPs, staging infrastructure entries
- Align h1 with colon separator matching clickgrab style; convert inline-styled meta div to .ep-meta class
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Apply the same Kitsune pipeline + ORKL corpus workflow previously used for the ransomware and infostealer attack chains to the remaining three chains. All three now use research-backed convergence data filtered to techniques observed in 2+ actors.
AiTM / Phishing Kits (11 reports, 5 kits, 12 shared techniques across 7 phases)
- Tycoon 2FA, Evilginx, EvilProxy, Sneaky 2FA, Device Code Phishing
- Sources: Microsoft Threat Intelligence, Sekoia, Proofpoint, Volexity, ANY.RUN, Resecurity, Silent Push
- T1557 AiTM and T1566.002 Spearphishing Link converge across all 4 proxy kits; T1078 Valid Accounts across 4 of 5
Hypervisor Compromise (12 reports, 5 actors, 22 shared techniques across 9 phases)
- BRICKSTORM/UNC5221, UNC3886, UNC3944/Scattered Spider, Play, Alphv/BlackCat
- Sources: CISA, Mandiant/Google Threat Intelligence, Trend Micro, Varonis, Sygnia
- T1190 Exploit Public-Facing App + T1078 Valid Accounts hit 4 of 5; T1486 Data Encrypted for Impact across all 3 ransomware actors
AD / Identity Domination (12 reports, 5 actors, 23 shared techniques across 8 phases)
- APT29/Midnight Blizzard, Storm-0501, Storm-2372, Scattered Spider, Ransomware Operators
- Sources: Microsoft Threat Intelligence, CrowdStrike, Mandiant/Google Threat Intelligence, CISA, ReliaQuest, The DFIR Report
- T1078 Valid Accounts hit by all 5; T1078.004 Cloud Accounts + T1110.003 Password Spraying hit by 4 of 5; T1550.001 Application Access Token converges across the 3 identity-centric actors
Each page now follows the consistent pattern: redundant mitre_techniques blocks removed (TTP diagram renders these from _data/), em dashes replaced, static References section replaced with Research Methodology crediting Kitsune + ORKL. Last-updated stamps bumped to 2026-04-14.
Reproducibility artifacts kept: scripts/build_{aitm,hypervisor,identity}_overlap.py regenerate the YAML from actor-TTP pair input.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Condense Logic fields across 8 chokepoint pages (22 blocks total) from pseudocode-style WHERE/AND/OR constructs into plain-language 1-3 sentence descriptions matching the clickfix reference pattern. Technical specificity preserved (event IDs, access masks, paths, thresholds).
- LSASS page: align structure with clickfix template (remove redundant AttackerControls/AttackerCannotControl blocks, reformat RawLogs samples to match clickfix style with Key signal comments, add URL fields to OSINT pivots so queries are clickable)
- Layout: remove tier badges from chokepoint stage headers and raw log sample cards so badges only appear on Sigma rule examples where they add context. Switch detection logic block from white-space:pre to pre-wrap with word-break so long rules wrap instead of hiding under the horizontal scrollbar.
- Remove remaining em dashes from chokepoint layout intro copy ("Each stage is an invariant condition...", "Tools and methods that exploit this chokepoint...")
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Apply site-wide hero gradient (radial orange glow + diagonal bg) to framework, trends, and attack-chains landing pages so all four landing pages read as one system
- Replace emoji icons on trends pillars, framework testing cards, and attack-chains ecosystem flow boxes with inline SVG icons (shield, crosshair, cluster, radar, server rack, envelope, lock, pulse, arrows, chart) in accent-tinted tiles
- Rewrite attack-chains landing page copy in Tyler's peer-to-peer voice; shorten Kaspersky reference to a single hyperlinked title; remove "coming soon" footers from trends and attack-chains
- Tighten ac-prose top padding after the actor convergence matrix, reduce actor-matrix bottom margin
- Remove all em dashes from landing page prose (chokepoints index, framework, trends, attack-chains)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace hand-curated infostealer TTP data with research-backed convergence analysis extracted via Kitsune pipeline from 13 vendor and government reports sourced via ORKL. Now covers RedLine, LummaC2, Vidar, StealC, and Raccoon with 28 shared techniques across 8 MITRE tactics, filtered to techniques observed in 2+ families.
Also removes redundant mitre_techniques blocks from infostealer page stages (TTP overlap diagram already renders these) and adds a Research Methodology section crediting Kitsune and ORKL for data provenance.
scripts/build_infostealer_overlap.py is kept as a reproducibility artifact for regenerating the YAML when new reports are analyzed.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Replace external GitHub FRAMEWORK.md link with local /framework/ href
- Remove target=_blank and rel=noopener (no longer external)
- Add active state conditional matching other nav items pattern
- Hero section with subtitle and Red Canary attribution
- 6 step cards with click-to-expand examples (SMB lateral movement worked example)
- Step 4 highlighted as THE CHOKEPOINT with critical red styling
- Detection maturity model (research/hunt/analyst) with pseudocode
- Chokepoint vs tool detection comparison
- Relationship graph container with tactic filter buttons
- Liquid-generated __GRAPH_DATA from site.data.chokepoints
- D3 v7 CDN load + framework-graph.js reference
- Testing section with 4 validation questions
- CTA section linking to chokepoints, attack chains, contribute
- All colors via CSS custom properties (--accent, --critical, etc.), no hardcoded hex
- No em dashes in prose
- Reads window.__GRAPH_DATA (set by Liquid in framework/index.html)
- D3 v7 force simulation with link, charge, center, and collision forces
- Tactic/chokepoint/technique node sizing, coloring, and labeling
- Tactic filter buttons via .graph-btn[data-filter] elements
- Hover tooltip with connection highlighting (dims unrelated nodes)
- Chokepoint click navigates to detail page via window.location.href
- Colors read from CSS custom properties at runtime (no hardcoded hex)
- Variation count badge on chokepoint nodes with vars > 0
- Link deduplication for Liquid output
- Responsive resize handler with 250ms debounce
Two plans covering the full framework page: content/layout/nav (Plan 01)
and D3 relationship graph visualization (Plan 02). Both Wave 1, parallel.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
TTP diagram now only shows techniques shared by 2+ actors, focusing on
convergence signals rather than actor-specific procedures. Ransomware
attack chain page removes inline MITRE technique lists (now driven by
data layer), drops VSS deletion table (covered by chokepoint page),
and condenses report bibliography into summary format.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add MIN_RECORD_FLOOR = 5 constant next to CONFIDENCE_THRESHOLD
- Add --min-records CLI argument (default: MIN_RECORD_FLOOR, set 0 to disable)
- Add floor guard block: exits sys.exit(1) without writing output when filtered
record count is below floor
- Guard fires after filtering, before output dict assembly
- Merges ioc_records.json, infra_records.json, enriched_infra.json into enriched_records.json
- Deduplicates by domain (case-insensitive), first occurrence wins
- Two-pass approach: first build domain->sources map, then dedup and flag multi_source
- Sets multi_source=True on records whose domain appears in 2+ source files
- Imports rescore_record from pipeline_utils for behavioral scoring
- Handles missing source files gracefully (WARN, not crash)
- No API calls — pure I/O merge
- confidence_label maps 0-100 score to confirmed/high/medium/low
- rescore_record uses behavioral signals (chain_observed 40pts, multi_source 20pts)
- SHA-256 presence drops from 30pts to 5pts (structural, not behavioral)
- Feed membership scores 0pts (not behavioral per PIPE-02)
- Single source of truth for scoring logic across all pipeline scripts
- Table-wrapper div applied to Top Families, Lure Type, Confirmed Delivery Domains,
Favicon Clusters, and Samples tables (UX-03)
- Prevents horizontal overflow bleed on 390px viewports
- .table-wrapper { overflow-x: auto } already defined in style.css
- Add .sigma-block--research/hunt/analyst with 4px left border accent (UX-02)
- Add .sigma-btn.copied rule with green color and border feedback (UX-01)
- Update copyCode() to toggle .copied class on click and remove after 1.8s (UX-01)
- Insert cp.TheConstant aside with .cp-invariant/.cp-invariant-label CSS classes after description paragraph
- Replace all — entities in sigma-label and det-meta-label UI chrome with colons
- Fix inline prose em dashes: satisfy comma fix, Lure label, list-grows sentence, Goal label
- All em dashes removed from rendered HTML output; Liquid/CSS/HTML comments untouched
- jekyll build --strict passes clean; THE CONSTANT renders above first <details> block
- browser-credential-theft.yml: rewrite Description to lead with invariant (target paths), break stat dump into short sentences; fix em dashes in Invocation and References Name fields
- web-shells.yml: rewrite Description to open with mechanism ("A script lives in the web root"); fix em dashes in Invocation code comments, detection logic, and References Name fields
- renamed-rmm-tools.yml: rewrite Description to drop passive opener, state 4-step invariant concisely; fix em dashes in Invocation code comments, Sources list items, and References Name fields
- byosi-scripting-interpreters.yml: rewrite Description to drop "Adversaries bring" opener, lead with vendor-signed interpreter pattern; fix em dashes in References Name fields
- ransomware-service-manipulation.yml: rewrite Description to drop "This service manipulation phase" opener, tighten to five short sentences; fix em dash in Invocation code comment; preserve Windows Event Log quoted strings (Service State Change, Service Start Type Changed)
- clickfix-techniques.yml: fix 10 em dashes in Notes, Detections, and References Name fields; cut weak closer from Description; quote YAML Name values with colons
- edr-bypass-techniques.yml: fix 7 em dashes in Context and References/Variation Name fields; quote YAML Name values with colons
- remote-execution-tools.yml: fix 5 em dashes in References Name fields; quote YAML Name values
- trends/clickgrab.md: fix 15 em dashes in titles, prose paragraphs, and callouts; preserve Liquid empty-cell placeholders
- trends/index.md: fix 5 em dashes in hero text, pillar descriptions, and front matter description
- trends/masq-infra.md: fix 5 em dashes in front matter, methodology, and chokepoints prose; preserve 7 Liquid table placeholder instances
- Split single-line append with parenthesized filter chain into two-step assign
- emu_lang_raw computes the language string, emu_lang appends the prefix
- Resolves Jekyll warning emitted for every chokepoint with an emulation block
- jekyll build --strict now exits 0 with zero warnings
- Remove forloop.parentloop.index == 2 and == 3 conditions from detection rule display logic
- Replace with tier_lower field-based matching so any stage position renders correctly
- Hunt tier stages now show hunt and analyst detections regardless of array position
- Analyst tier stages now show research detection regardless of array position
Unquoted colon in Invariant field caused yaml.scanner.ScannerError
in aggregate.py CI step.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Remove em dashes from prose throughout all 7 remaining chokepoints,
replacing with periods, commas, or semicolons for tighter writing.
Remove AttackerControls/AttackerCannotControl bulleted lists (redundant
with chokepoint stage descriptions). Intel reference names preserved.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Remove em dashes throughout, replace with periods/commas for cleaner
prose. Remove AttackerControls/AttackerCannotControl bulleted lists
since the chokepoint stages describe the same information. Tighten
description to match Tyler's writing style.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Reuse the proven .badge class from style.css instead of custom
ac-actor-status styles. Eliminates border/alignment mismatch.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Badges now render on their own line beneath the actor name to prevent
overflow into adjacent columns. Actor column widened to 180px.
Added espionage and legacy badge color variants.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
