mirror of
https://github.com/iimp0ster/detection-chokepoints
synced 2026-08-09 12:41:00 +00:00
imposterandClaude Fable 5
ad4b5c7d16
Audit of the live site found 42 OSINT pivot cards: 1 real pivot with no URL at all (aitm-websocket-relay), and 4 whose link diverged from the query shown on the card. Policy applied: the query on the card is exactly what the link executes; where a platform cannot express the query, the displayed query is rewritten to the platform's real syntax. - aitm-websocket-relay/URLScan: original query was invalid on the platform (page.ip.asn is not a field; filename:*.js is a rejected leading wildcard). Rewritten to (page.asn:AS37963 OR page.asn:AS9009) AND page.status:200 AND page.mimeType:"application/javascript" - verified live, 1583 results as of 2026-07-13 - and URL added - lsass/LOLDrivers: site has no deep-linkable query syntax; displayed query is now the free-text term to type (lsass), guidance in Notes - lsass/ANY.RUN: ?search= URL parameter is ignored by the app (verified live); same free-text treatment (sekurlsa) - edr-bypass/GitHub: link now carries the full query incl. the (path:*.c OR path:*.asm) qualifiers; query parenthesized - renamed-rmm/VirusTotal: link now carries all four metadata: terms, not just AnyDesk - schema/chokepoint-schema.yml: document the URL field (template had it, schema did not - why contributors kept omitting it) graph-api-recon-burst's N/A card is intentional (not externally observable) and left as-is. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01W87Fdr8vD1ZiR8jumj4Ud5