AU – Trackr.Live

§ Category

UNC6508 Exfiltrated Through a Gmail Compliance Rule. The Audit Event Your Detection Uses Retires After August

A PRC-nexus actor exfiltrated years of medical and defense research by creating a single domain-level Gmail content compliance rule that silently BCC’d matching mail to an attacker Gmail account. It produced no endpoint telemetry and no user-visible forwarding setting, and the admin audit event family that authoritatively records it is mid-migration, with the legacy events retiring after August 2026.

EventRecordID Gaps Catch Crude Deletion. Unreferencing Plus Renumbering Can Keep the Sequence Clean

An attacker who can manipulate the active or offline EVTX can pull a single 4624 out of the Security log without inherently firing Event ID 1102 — and, by renumbering the records that follow, without leaving a hole in the EventRecordID sequence your rule watches. Here is why gap detection misses that, and what actually catches it.

A Wildcard in Your OIDC Trust Policy Trusts Every Repo in the Org. CloudTrail Logs the One That Used It

GitHub-to-AWS keyless auth moved secrets out of your CI, but the sub-claim wildcard most trust policies ship with trusts far more than the author intended. Here is what the detection actually looks like in CloudTrail, and why your allowlist breaks in July 2026.

CVE-2026-3055 Bleeds Session Tokens Your NetScaler Barely Logs. The Detection Lives Off the Box

The NetScaler memory-overread class has a third sequel. CVE-2026-3055 leaks session tokens through an endpoint the appliance barely logs — so its own logs won’t prove you’re clean, and the detection has to move upstream to the response size and downstream to the reused token, while patching does nothing to the sessions already bled.

ESXi Can Write Its Logs to a RAM Disk. Ransomware Counts on It

On an ESXi host without persistent scratch, /var/run/log lives on an in-memory ramdisk and evaporates at the next boot. Ransomware crews get the same effect for free — they power off, kill, or reboot the workloads before encrypting — which means your entire forensic timeline had to be forwarded off-box before the incident or it never existed at all.

A Federated Identity Credential Adds No Secret. Your Service Principal Persistence Alert Never Fires

Most SOCs detect service principal persistence by watching for “Add service principal credentials.” Federated identity credentials reach the same persistence with a different audit operation, on a different object, sometimes in a log source you never ingested.

Artificial Intelligence

Agent Memory Poisoning Survives the Session. The Detection Lives in the Write Path Nobody Logs

Single-turn prompt injection usually dies when the context window clears. Memory poisoning persists, fires weeks later, and hides in a memory-write event your platform was never built to emit as security telemetry. Here is what to instrument, what to detect, and what the first round of tuning gets wrong.

CVE-2026-20253 Runs as the splunk User — and That’s the Index You’d Hunt It In

An unauthenticated file-write in Splunk Enterprise’s bundled Postgres sidecar chains to code execution as the splunk service account — the same account that owns your _audit and _internal indexes. The detection problem is mostly a log-forwarding hygiene problem you either solved last year or didn’t.

Bring Your Own Installer: When the EDR Bypass Ships Inside the EDR

Attackers don’t need a vulnerable driver to blind an EDR — they need the agent’s own installer and a window. The durable detection isn’t the kill command, it’s the silence that follows. Here is what that detection looks like the first time you deploy it, and why it floods the SOC before it works.

The Missing sub Condition: Why GitHub-to-AWS OIDC Is a Config Audit Before It’s a Detection

Keyless OIDC federation killed long-lived AWS keys in CI, but it moved the trust boundary into a JSON condition block most teams wrote once and never reread. Here is where the sub-claim hole lives, what CloudTrail can and can’t tell you, and why this is a configuration audit before it is ever a detection.