"Complexity is the ultimate attack surface. The only permanent defense is to erase the pathway entirely."
Traditional corporate cybersecurity focuses on additive detection—layering expensive, high-latency visibility platforms and machine learning models on top of inherently fragile infrastructure to watch fires burn.
The Path Erasure Engine represents a paradigm shift toward Subtractive Security. This repository provides an elite, production-vetted, multi-platform collection of Indicators of Attack (IOAs) designed specifically for hard-blocking enforcement in an enterprise deployment.
By transforming passive threat telemetry into binary block rules across Windows, macOS, and Linux, this engine ruthlessly strips away the conductive pathways that automated, machine-speed exploit chains and ransomware operations rely on to achieve initial access, execute internal reconnaissance, and move laterally.
This engine evaluates security efficacy not by counting vulnerability patches or alert volume, but by optimizing the Path Erasure Rate (
Instead of managing risk exceptions via paperwork, these rules enforce structural non-conductivity by default. If a pathway is fundamentally conductive to an enterprise catastrophe, it ceases to exist in the environment.
This repository is organized by operating system architecture. Each directory contains raw regular expressions (Regex) optimized for ingestion into enterprise Endpoint Detection and Response (EDR) platforms (e.g., CrowdStrike Custom IOAs, Palo Alto Cortex XDR, Microsoft Defender for Endpoint).
Target-locks and permanently severs the fundamental mechanics of Windows lateral movement and "Living off the Land" (LotL) tactics.
- Ingress & C2 Decapitation: Global hard-blocking of unauthorized commercial Remote Monitoring and Management (RMM) tools (
AnyDesk,TeamViewer,ScreenConnect) and reverse tunnels (Ngrok,chisel). - Execution Tree Collapse: Binary enforcement denying web browsers (
Chrome,Edge) and productivity software (Word,Excel) from ever spawning local shell interpreters (cmd,powershell,mshta). - Credential Protection: Hard blocks on unauthorized Active Directory enumeration utilities (
SharpHound,AdFind) and raw memory/LSASS dumping vectors (createdump).
Enforces a highly deterministic operational scope on cloud, container, and bare-metal server infrastructure.
- Pipeline Interdiction: Blocks web delivery utilities (
curl,wget) from piping directly into shell interpreters or executing payloads straight out of world-writable staging directories (/tmp,/dev/shm). - Persistence & Escape Prevention: Enforces immediate process termination upon unauthorized writes to
authorized_keys, crontabs, or attempts to abuse container namespace boundaries (nsenter). - Kernel & EDR Defense: Rejects unauthorized kernel module insertion (
insmod) and eBPF program loading (bpftool) attempting to blind or unhook underlying system logging and endpoint agents.
Neutralizes the traditional "creative sandbox exception" by bringing strict administrative hygiene to Apple endpoints.
- Initial Access Neutralization: Disrupts macro-less browser and collaboration tool exploit delivery by preventing applications like
Slack,Teams, orSafarifrom executing child scripting runtimes (osascript,swift,shortcuts). - Secrets Vault Isolation: Blocks programmatic, automated harvesting of local secrets, browser cookies, session tokens, and the native privacy access configuration database (
TCC.db,security dump-keychain). - OS Policy Preservation: Hard-blocks utility calls designed to bypass native OS mechanisms like Gatekeeper (
spctl --master-disable) or clear quarantine flags via attribute manipulation.
Unlike out-of-the-box vendor rule sets that default to passive alerting to protect legacy system inefficiencies, this engine is designed to be flipped to block.
- Audit Phase (Day 1): Ingest the rule sets into your EDR platform in
Audit/Report-Onlymode to map out existing, non-standard administrative scripts or broken internal infrastructure. - Standardization Phase (Day 2-29): Monitor rules for any detections and build any needed exceptions for legitimate behaviors.
- Enforcement Phase (Day 30): Flip all rules to
Hard Blockonce no detections are being triggered for legitimate workflows.
Result: Alert fatigue drops by an average of 80% on day one, and the underlying enterprise graph transitions from fully conductive to highly resilient.
We welcome contributions from elite practitioners and system architects. If you have engineered a deterministic, subtractive block rule that eliminates a cross-platform attack vector without introducing unnecessary administrative debt, please submit a Pull Request.
- Please ensure all rules are submitted in raw regular expression formats.
- Include a brief architectural explanation detailing the conductive pathway the rule liquidates.
This project is licensed under the MIT License - see the LICENSE file for details.