CM

CM

Legitimate Generator Writes Baseline at Zero Outside Patch Windows

System-level systemd generators run as root at the earliest moment of boot, before auditd, before the EDR agent, before your normal journald/syslog/audit telemetry is reliably up. You will never see the execution. Here is how to build the detection that actually works — file writes and baseline reconciliation — and what breaks it the first week.

CM

A .NET App Config Can Disable the Runtime’s ETW Provider

AppDomainManager hijacking loads attacker code into a Microsoft-signed .NET process before the app runs — and the same config file that does it can switch off the ETW telemetry your EDR depends on. The cleanest detection isn’t the dropped DLL. It’s the XML.

CM

Win+X Opens Windows Terminal Without Writing to RunMRU

RunMRU is the tidiest endpoint signal for ClickFix, which is exactly why it’s the first thing attackers stopped touching. A look at what the registry detection catches, why it’s already half-blind, and the process-ancestry signal that actually survives.

AC

Ubuntu’s userns Mediation Is a Tripwire, Not a Wall

Ubuntu 24.04 enabled AppArmor mediation of unprivileged user namespaces by default, then Qualys published three ways around it. Here’s what the control actually stops, the audit chain that proves it fired, and how to detect abuse without flooding the SOC.

AT

Pasting Into the File Explorer Address Bar Writes No RunMRU Value

Most teams write their first ClickFix detection against the Windows Run dialog’s RunMRU artifact. FileFix and the App-V proxy variant route around it the next day. Here is the detection that survives, and what the first week of tuning has to fix.

CM

When the EDR Goes Quiet: Detecting BYOVD Driver Kills Before the Encryptor Runs

Bring-your-own-vulnerable-driver EDR killers are a standard stage in ransomware intrusions now, not an exotic capability. The driver blocklist is the weakest control you have against them. Here is what to instrument instead.

Artificial Intelligence

Detecting MCP Rug Pulls When an Approved Tool Rewrites Its Own Description

An MCP server you approved last week can mutate its tool descriptions tonight, and most clients won’t tell you. Here’s how the rug pull works, what to log, and what the detection actually looks like before the false positives bury it.

AU

When netstat Lies: Detecting eBPF Magic-Packet Backdoors on Linux

A clean netstat is not proof of safety: eBPF backdoors like LinkPro keep an internal listener, rewrite ports through XDP/TC, and can make bpftool lie about themselves. The durable signal is the bpf() syscall at load time, and on Cilium-heavy fleets, telling real loaders from noise is most of the work.

CM

Image Mode RHEL Moves the Mutable Surface to /etc and /var

Bootc and rpm-ostree turn the root filesystem read-only and push state into a handful of writable paths. That quietly invalidates half your host integrity detections. Here is the new shape of the problem and what to instrument before the first ATO review notices.

CM

CIFSwitch: a 19-year-old local root that only fires if you let it

CIFSwitch is a local-root flaw in the Linux kernel’s CIFS client that a researcher surfaced with AI-assisted analysis after it sat untouched since 2007. The kernel piece is real, but whether it touches you is a configuration question, not a kernel-version one.