🔍 Runtime Code Path Monitor

Detecting impossible execution paths via instrumentation.

→ Explore in ATT&CK matrix (2 mappings) Deployment detail

What it is

Instrumenting the application runtime (via OpenTelemetry, RASP, or custom middleware) to detect when code execution follows "impossible paths" — sequences of function calls that exist in the binary but are unreachable through any legitimate user interaction. This detects exploitation, deserialization attacks, and code injection.

Implementation requirements

Application instrumentation (OpenTelemetry SDK, Datadog APM, or custom middleware)
Baseline: Map all legitimate code paths via automated testing (integration tests, E2E tests)
Define "impossible paths": function call sequences that never appear in test coverage
Runtime monitor: If an impossible path is executed, trigger DOAR alert with full stack trace
OPSEC: Monitoring overhead must be minimal (< 2% latency impact)
Works best in compiled languages (Go, Rust, Java) where code paths are deterministic
Rollback: Remove the instrumentation in the next release.
Upkeep: Re-baseline legitimate code paths after each release, or new features will look like impossible paths.

Technologies

Application

ATT&CK coverage 2

Technique	Tactic	Status	Confidence	Tier
T1203 Exploitation for Client Execution	Execution	theoretical	weak	T3
↳ Evidence (2 sources) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1203 Exploitation for Client Execution as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1203 to its Lures activity. Client-side exploitation is pushed to user applications; a server-side trap does not see it.
T1190 Exploit Public-Facing Application	Initial Access	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (5 sources) An Innovative Security Strategy using Reactive Web Application Honeypot — SNARE and TANNER, a reactive web-application honeypot that answers exploitation attempts. Deception in Dynamic Web Application Honeypots: Case of Glastopf — Glastopf, a web-application honeypot that replies to attacks with the responses attackers expect. Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK (companion data) — Valeros et al. rate T1190 as highly feasible for infrastructure deception. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1190 Exploit Public-Facing Application as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1190 to its Lures activity.

Evidence

Toward Proactive, Adaptive Defense: A Survey on Moving Target Defense — Cho, J.-H. et al., arXiv:1909.08092 2019 peer-reviewed
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard

Research basis: "Toward Proactive, Adaptive Defense: A Survey on Moving Target Defense" (IEEE/arXiv, 2019).