Cyber Tools – Page 2

§ Category

Your Device Code Flow Alert Fires on Every az login. The Signal Is the Broker Token, Not the Prompt

Device code phishing doesn’t defeat MFA — it redirects a legitimately MFA-completed sign-in — and the naive detection drowns in legitimate CLI traffic. The durable signal is the Authentication Broker redemption and the device registration that follows, and the real fix is a Conditional Access authentication-flows block.

A Federated Identity Credential Adds No Secret. Your Service Principal Persistence Alert Never Fires

Most SOCs detect service principal persistence by watching for “Add service principal credentials.” Federated identity credentials reach the same persistence with a different audit operation, on a different object, sometimes in a log source you never ingested.

Strong Certificate Mapping Only Helps If the CA Owns the SID. ESC16 Takes It Away

Microsoft’s strong certificate mapping enforcement finally landed, and where it’s genuinely in force it does close the naive implicit-mapping hole that made ADCS escalation trivial — a certificate with only a weak name is denied. ESC16 strips the CA-issued SID so the mapping decision falls to whatever’s left: on a compatibility-mode DC that’s weak SAN mapping, and even on a fully-enforced DC it’s an attacker-supplied SID-in-SAN URI the KDC treats as strong. The audit events you’d hunt it with are off by default.

AppDomainManager Hijacking Hides in a Signed Binary. The Tell Is One Line of XML That Kills ETW

AppDomainManager hijacking loads attacker code into a Microsoft-signed .NET process before the app runs — and the same config file that does it can switch off the ETW telemetry your EDR depends on. The cleanest detection isn’t the dropped DLL. It’s the XML.

Cyber Tools

GitHub Logs the Workflow Run, Not the Cache Write. That’s the Gap Cache Poisoning Lives In

The 2026 TanStack compromise (CVE-2026-45321) turned a bundle-size workflow into an npm publishing channel by poisoning a repo-scoped cache. The cache write left almost no runtime telemetry, which makes this a config audit before it’s ever a detection.

Cyber Tools

RC4 Is About to Go Extinct in Kerberos. So Is Your Kerberoasting Detection

Microsoft’s three-phase RC4 disablement for Kerberos closes a real attack surface and quietly breaks the most common Kerberoasting detection rule in the process. The signal you keyed on is about to disappear, and the attack isn’t going with it.

CVE-2026-20253 Runs as the splunk User — and That’s the Index You’d Hunt It In

An unauthenticated file-write in Splunk Enterprise’s bundled Postgres sidecar chains to code execution as the splunk service account — the same account that owns your _audit and _internal indexes. The detection problem is mostly a log-forwarding hygiene problem you either solved last year or didn’t.

Bring Your Own Installer: When the EDR Bypass Ships Inside the EDR

Attackers don’t need a vulnerable driver to blind an EDR — they need the agent’s own installer and a window. The durable detection isn’t the kill command, it’s the silence that follows. Here is what that detection looks like the first time you deploy it, and why it floods the SOC before it works.

ClickFix’s Cleanest Artifact Is RunMRU. The 2026 Variants Walked Away From It

RunMRU is the tidiest endpoint signal for ClickFix, which is exactly why it’s the first thing attackers stopped touching. A look at what the registry detection catches, why it’s already half-blind, and the process-ancestry signal that actually survives.

Artificial Intelligence

Unicode Tag Smuggling Is Prompt Injection With a Byte Signature

Most prompt injection is semantic and resists signature detection. Invisible Unicode tag smuggling is the exception: it leaves a deterministic byte range you can match at the gateway. Here’s the detection, the tuning, and why most teams instrument the wrong path.