← Blog

Delete the category — prevention that makes the mistake impossible

Pattern · 2026-10-14

This started with a simple move a defender made on their own home network: they blocked the advertising URLs at the resolver. Not a filter that judges each ad — a flat refusal of the whole ad-delivery category. The effect is that malvertising and the drive-by-download it rides stop being something anyone can accidentally click, because the hostile code never reaches the page in the first place.

That is worth naming, because the principle generalises far past ads:

Stop trying to classify the bad instance. Remove the category at a choke point, so the mistake becomes a structural impossibility instead of a judgment the human has to get right every time.

Detection asks "did we catch it?" — a question you answer after the fact, every single time, in a race against noise. This asks "could it have happened at all?" — answered once, in the architecture. Below are five families the pattern produces, each grounded in the attacks it neutralises in this corpus, and each honest about the legitimate usage you trade away.

1. Delete the delivery channel

The reader's own move. Pick the channel a class of attack must travel, and refuse the channel.

• Sinkhole the ad networks. Kills malvertising, malvertising-delivery, and starves the redirect infrastructure behind scareware-pop-up-phishing and some search-engine-phishing-seo-poisoning.
• Sinkhole newly-registered domains (NRD). Most phishing runs on domains days old; the sites you actually use are not. Refusing young domains at the resolver guts adversary-in-the-middle-phishing-kits, phishing-as-a-service-phaas, and credential-harvesting-page-web-portal-capture without judging a single domain "malicious".
• Strip active content at the mail gateway. Flatten and detonate instead of scan — which removes the vehicle for html-smuggling and macro-malware rather than trying to spot each payload.

The tail you pay: a brand-new legitimate domain, or a genuinely needed macro, gets caught. Both are rare enough to allowlist by exception.

2. Delete the execution primitive

The payload is inert if the thing that runs it does not exist on the box.

• Writable XOR executable. An AppLocker/WDAC posture where user-writable paths (%TEMP%, Downloads, %APPDATA%) can never execute removes the ground commodity-ransomware, replication-through-removable-media, and badusb-usb-drop all stand on — drop a binary, run it from where you dropped it. There is nowhere to drop it that will run.
• Remove the interpreters and the Run box. Disabling the script hosts and the Win+R dialog for standard users deletes the landing surface for clickfix-fake-captcha — the fake-CAPTCHA lure whose entire payload is "paste this into Run" — and blunts the macro stage of macro-malware.

The tail you pay: power users lose convenience; a few legitimate tools that self-extract to temp need an explicit rule.

3. Delete the capability the attack needs to pay off

A compromise that cannot call home or move data out is a compromise that earned nothing.

• Default-deny egress, allowlist out. Flipping outbound from allow-all to allow-known makes the callback in c2-over-application-layer-protocols, dns-tunneling, and fast-flux-dns simply fail, and strangles exfiltration-over-web-service-cloud-account. The malware runs and then has nothing to talk to.

The tail you pay: egress allowlisting is real operational work, and it is the pattern most likely to break a legitimate app the first week. Log every block — see the caveat below.

4. Make the human error structurally impossible

The purest version: the user cannot make the mistake even if they try.

• Phishing-resistant credentials (FIDO2 / passkeys). A passkey is cryptographically bound to the real origin, so it will not authenticate to a look-alike. That converts "don't fall for the phish" into "the phish has nothing to harvest" — and it collapses the downstream value of adversary-in-the-middle-phishing-kits, oauth-consent-phishing, device-code-phishing, credential-harvesting-page-web-portal-capture, and credential-stuffing in one move. When the credential can't be replayed, the cookie-theft → session-cookie-theft-pass-the-cookie → token-replay-access-refresh chain that usually follows a successful phish loses its fuel too.

The tail you pay: enrollment and recovery flows, and the legacy systems that still want a password.

5. Delete the blast radius

You can't prevent every infection, so make a single one contained rather than total.

• Microsegment the network. VLANs that stop hosts initiating to each other turn lateral-movement-via-remote-services and human-operated-ransomware's spread into dead ends, and quarantine the insecure-iot-network-services / mirai-style-iot-botnet problem to the segment it lives on.

The tail you pay: segmentation design and the printer that everyone needs to reach from everywhere.

What we can prove in the lab — and what we can't

This is a research site, so the patterns above are a hypothesis until the lab weighs in, and being honest about that is the point. Prevention changes the question our lab answers. Detection asks the SIEM "did a rule fire?"; prevention asks "with the control on, did the attack still reach its objective?" — which needs an A/B detonation: one run with the control off that must succeed, and one with it on that must fail, both measured, both marker-tagged, same way every coverage run already is.

Some of these we can detonate on the existing win-victim / lin-victim endpoints right now:

Some we can only reason about today. Default-deny egress and the DNS-sinkhole patterns (c2-over-application-layer-protocols, dns-tunneling, malvertising) are network-architecture controls, and the home/lab network gear that would let us enforce and measure them end-to-end is deferred until capable hardware exists. Passkeys need an identity provider we don't emulate. We say so rather than dress a thought experiment as a result. The full plan — every pattern, whether the lab can touch it, and the detonation that would prove it — lives in the prevention measurement map in the repo.

The honest caveat: prevention is blind by design

Every pattern here has the same side effect: once you delete a category, you stop seeing attempts against it. The ad sinkhole that ends malvertising also ends your visibility into who was trying to serve you malvertising. So the discipline that makes this safe is simple — log the blocks. A refused NRD, a denied egress, a binary that AppLocker stopped: those are threat intel, and a prevention control that fails silently has traded a loud problem for a quiet one.

These are patterns, not yet verdicts. We will detonate the ones the lab can reach and publish what we find — including, in keeping with this corpus, the ones where the control turns out to cost more than it saves.

Grounded in the corpus records linked above. The lab-measurability of each pattern and its A/B detonation design are recorded in lab/prevention/README.md; measured results will appear on the coverage dashboard and as follow-up posts as each experiment runs.