Cyber Tools – Trackr.Live

§ Category

Rebuild and Reissue: SMA 1000 Remediation After INC Ransomware

The SonicWall SMA 1000 exploit chain gets from unauthenticated HTTP to root through a loopback service and a control-service password derived from the appliance’s DMI product_uuid. Rapid7 and Resecurity assess INC Ransomware as the dominant actor now weaponizing it, and the loot — session databases and TOTP seeds — is why patching alone does not end the incident.

LegacyHive Mounts a Target’s Hive Into the Helper’s Session

A working Windows exploit dropped roughly half an hour after July’s Patch Tuesday, with no CVE and no Microsoft advisory. LegacyHive edits a registry hive while it is unmounted, so live registry auditing never sees the write, and the payoff is another account’s hive mounted into a session the attacker controls. Here is what actually fires, what the first published rule got wrong, and which controls cut the class.

Plan Before Review: Terraform’s Speculative Stage as an Execution Boundary

When a CI workflow auto-plans a contributor’s pull request in a privileged context, a data source can execute on the runner the moment terraform plan runs — before anyone reads the diff. Here is what that actually exposes, where the detection really lives, and why the process tree is a grandchild deep.

DKM: The AD FS Master Key That Decrypts Your Token Signer

CVE-2026-56155 is an overly permissive ACL on the AD FS DKM container — the object holding the key that protects your token-signing certificate. The July patch ships the fix in audit mode, so read access to a Golden SAML enabler stays open until you flip a registry key or October arrives.

The Renumber Step Is What Closes the EventRecordID Gap

An attacker who can manipulate the active or offline EVTX can pull a single 4624 out of the Security log without inherently firing Event ID 1102 — and, by renumbering the records that follow, without leaving a hole in the EventRecordID sequence your rule watches. Here is why gap detection misses that, and what actually catches it.

FileFix: Process Lineage Outlasts the Content Signatures

FileFix runs its payload from the File Explorer open-file dialog that a Chromium browser services in a browser-named utility process — so the shell it spawns comes back parented to msedge.exe or chrome.exe. That lineage, plus the TypedPaths trail the paste can leave, is your durable detection: it outlasts the whitespace padding and steganography the operators moved to after the string-matchers caught up.

BYOVD: The Driver-Load Event Is the Last High-Confidence Signal

Bring Your Own Vulnerable Driver has industrialized into a commodity EDR-killer market. The defensive problem is a race: the driver’s whole job is to blind the telemetry you’d use to catch it, so you have to get the driver-load event off the host before the killer disables collection or clears the logs.

Screening Serpens Hijacks AppDomainManager Ahead of Its RAT

Iran-nexus Screening Serpens paired AppDomainManager hijacking with DLL sideloading across its 2026 campaigns. A managed loader assembly runs before the host binary’s normal entry point and isn’t reliably represented in Sysmon ImageLoad telemetry, so the detection has to move to file-create events and .config content.

The pnpm Cache Poisoning Primitive GitHub Closed in June

The TanStack compromise published 84 poisoned npm versions across 42 packages by writing a cache entry into the default-branch scope from an untrusted fork PR. GitHub has since made that write path read-only for low-trust triggers — but cache creation still never touches the audit log, so post-hoc detection has to live on the runner and in cache-inventory differencing instead.

io_uring Reads Your Files and Opens Sockets Without Calling the Syscalls Your auditd Rules Watch

A process on a Linux host where io_uring is enabled can read files, connect out, and write to disk without issuing any of the file and network syscalls your auditd rules and EDR hooks watch. Here is the creation-time syscall that still fires, what to alert on, and why the real fix is a sysctl (already the default on RHEL 9).