Detection Chokepoints — a free DFIR tool on pranithjain.qzz.io. Browser-side security analysis, no signup required.
This is a free, browser-based DFIR toolkit on pranithjain.qzz.io. No signup required — all processing runs locally in your browser.
Invariant detection points in attack chains - prerequisites that attackers cannot bypass. Each chokepoint targets a forced action that generates reliable telemetry regardless of tool choice or variant.
Source: iimp0ster/detection-chokepoints · 13 chokepoints · 5 attack chains · 3 trend analyses
Adversary-in-the-Middle proxy relay via WebSocket-based phishing kits. Intercepts session tokens and MFA codes in real time, bypassing push-based MFA.
Browser credential and cookie exfiltration by commodity infostealers (Lumma, Raccoon, RedLine). Targets cookie stores, saved passwords, and session tokens.
LSASS process memory access for credential extraction. 24 documented variations across tools (Mimikatz, ProcDump, comsvcs.dll, direct syscalls).
Defense evasion via EDR sensor tampering - process termination, driver unloading, callback removal, and direct kernel calls.
Pre-encryption service disruption - stopping backup agents, databases, and AV services via sc.exe, net stop, or PsExec.
Post-exploitation web shell deployment on IIS, Apache, and Nginx. Server-side scripting persistence with command execution capability.
Bring-your-own scripting interpreters - Python, Node.js, PowerShell downloaded to disk and used for execution. Bypasses application whitelisting.
OAuth device code flow abuse - attacker tricks user into approving a device code, granting persistent token access without password compromise.
Azure/M365 Graph API enumeration - bulk user, group, and role queries from a single token. Detectable via query velocity.
Social engineering via fake CAPTCHA, browser update prompts, or "copy-paste" instructions that lead to PowerShell/terminal execution.
Remote Monitoring & Management tools (AnyDesk, ScreenConnect, TeamViewer) renamed or installed in non-standard paths.
Lateral movement via SMB/SSH/WinRM execution. PsExec, wmic, ssh.exe, and native cmdlets used for remote command execution.